LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 09-24-2008, 08:36 AM   #1
jaggy00
LQ Newbie
 
Registered: Jan 2007
Distribution: CentOS & Fedora Core
Posts: 25

Rep: Reputation: 15
Unhappy Huge traffic, strange entries in access-logs.. ?


I get a lot of these:

Quote:
77.120.129.134 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
88.185.131.100 - - [24/Sep/2008:17:24:01 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
195.222.97.162 - - [24/Sep/2008:17:23:59 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
79.117.213.211 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.47.215.35 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
78.160.32.117 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
41.249.10.231 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
121.88.33.26 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
222.107.251.77 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
200.30.101.2 - - [24/Sep/2008:17:24:03 +0400] "GET /?8cdf7678 HTTP/1.1" 200 109821 "-" ""
125.132.186.37 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
124.56.25.23 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
195.16.91.6 - - [24/Sep/2008:17:24:00 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
89.178.114.211 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
116.121.139.193 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
222.107.251.77 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
68.55.221.118 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
165.246.181.206 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
211.112.65.224 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
89.178.114.211 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
79.117.213.211 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.47.215.35 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.114.113.144 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
71.195.137.202 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
165.246.181.206 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
in Apache access log for a particular web-site. MaxClients is set to 500 and all slots are still filled out. I've suspected DDoS attack, but that's how connection list looks like:

Quote:
1 established)
1 FIN_WAIT2
1 Foreign
1 TIME_WAIT
5 LAST_ACK
20 CLOSE_WAIT
27 LISTEN
38 FIN_WAIT1
101 SYN_RECV
611 ESTABLISHED
So that it seems no DDoS there.

What could that be? Any Help appreciated.
 
Old 09-24-2008, 11:04 PM   #2
born4linux
Senior Member
 
Registered: Sep 2002
Location: Philippines
Distribution: Slackware, RHEL&variants, AIX, SuSE
Posts: 1,127

Rep: Reputation: 49
the ips are spanning across different regions - some in europe, some in us, some in asia.
and ips are from ISPs - most probably assigned to their subscribers.

botnet attack?

maybe you should setup a honeypot just for the fun of it.
 
Old 09-25-2008, 03:33 AM   #3
jaggy00
LQ Newbie
 
Registered: Jan 2007
Distribution: CentOS & Fedora Core
Posts: 25

Original Poster
Rep: Reputation: 15
Oh, I'm not that good actually and do not have spare resources at the moment, if you could give some good links on the topic, I would be very glad.

By the way, I'm using vnstat and iftop to evaluate traffic movement and they show me huge incoming traffic, although I know there should't be any. Can botnet attack generate it?

And one more issue, I've installed apf and wrote an access rule for 80 port, so that only specific countries could enter (took ranges from ip2country databases). At first I've noticed that traffic doesn't lower despite of the ACL-s, and then just to test I've removed 80 port from INGRESS section at all. And the site still remained accessible =-O I've did iptables -F and then apf -r and iptables -L - rules really are there, but they fo not block anything...

I'm frustrated.
 
Old 09-25-2008, 07:58 AM   #4
linuxgurusa
Member
 
Registered: Mar 2008
Location: Namibia, Swakopmund
Distribution: Redhat, Fedora
Posts: 127

Rep: Reputation: 27
Botnet attack maybe

Or you have a BBS type website, or jarhead or mambo website or any type of Guesbook type website etc that has exploits on it and the guys are attacking the site ... hence why I think it is botnet attacks as well yes ... not fun ;-)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Huge amount of "PHP Notice:" -> huge logs Braynid Linux - Software 4 03-18-2008 06:35 AM
entries about network traffic in task_struct linuxdoniv Linux - Newbie 0 03-02-2008 10:17 AM
traffic attack,huge size in web log vincentltl Linux - Networking 3 04-04-2006 12:26 AM
Traffic attack, huge size in http log vincentltl Linux - Security 2 04-03-2006 06:52 AM
Entries in access logs tebucky Linux - Security 7 12-19-2005 12:28 PM


All times are GMT -5. The time now is 02:00 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration