LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-03-2006, 04:38 AM   #1
vincentltl
LQ Newbie
 
Registered: Apr 2006
Posts: 6

Rep: Reputation: 0
traffic attack,huge size in web log


I found that there are many lines in my web log, my server is fedora linux.
The lines are "221.8.186.158 - - [03/Apr/2006:16:35:26 +0800] "GET log.cpc.sohu.com:90/?pv.png HTTP/1.0" 200 857 "adsence.sogou.com/index.html?pid=mywebcode&ww=200&dc=3&dir=0&num=6&color=1&charset=gb" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
61.243.176.38 - - [03/Apr/2006:16:36:11 +0800] "CONNECT tcpconn4.tencent.com:443 HTTP/1.1" 400 310 "-" "-""
These lines continue existing in my log, resulting in a huge size within an hour.
Would you suggest me some ways to solve it. Thank you so much.
 
Old 04-03-2006, 04:57 AM   #2
IBall
Senior Member
 
Registered: Nov 2003
Location: Perth, Western Australia
Distribution: Ubuntu, Debian, Various using VMWare
Posts: 2,088

Rep: Reputation: 62
You can always take the "big stick" approach, and block all access to your server from those IP addresses:
Code:
iptables -A INPUT -s 221.8.186.158 -j DROP
How can you be sure that these are not legitimate accesses to your website?

Try installing "snort" on your server. This is basically a packet sniffer, and will email you daily with a report detailing accesses to you server.

I hope this helps
--Ian

PS: Please do not post the same thread in multiple forums. It will NOT get you a better or faster or more responses.
 
Old 04-03-2006, 10:06 AM   #3
vincentltl
LQ Newbie
 
Registered: Apr 2006
Posts: 6

Original Poster
Rep: Reputation: 0
Thank you so much.
Since I'm new in Linux, How can i install snort??
 
Old 04-04-2006, 12:26 AM   #4
IBall
Senior Member
 
Registered: Nov 2003
Location: Perth, Western Australia
Distribution: Ubuntu, Debian, Various using VMWare
Posts: 2,088

Rep: Reputation: 62
What distro are you using? Most distros use either rpm or deb packages, so installing programs depends on what you are using...

--ian
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Traffic attack, many lines in web log. vincentltl Linux - Software 2 04-03-2006 06:55 AM
Traffic attack, huge size in http log vincentltl Linux - Security 2 04-03-2006 06:52 AM
nTop, port 0 traffic - help I am under attack! waffe Linux - Security 1 12-09-2005 07:53 AM
I sometimes get HUGE size font on the web and some programs in my Laptop, please help zLinuxz Linux - General 5 12-19-2003 03:48 PM
Log, possibly attack? fabriciolb Linux - Security 3 09-11-2003 06:37 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 01:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration