Huge traffic, strange entries in access-logs.. ?

jaggy00 · 09-24-2008, 09:36 AM

I get a lot of these:

Quote:

77.120.129.134 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
88.185.131.100 - - [24/Sep/2008:17:24:01 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
195.222.97.162 - - [24/Sep/2008:17:23:59 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
79.117.213.211 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.47.215.35 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
78.160.32.117 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
41.249.10.231 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
121.88.33.26 - - [24/Sep/2008:17:24:02 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
222.107.251.77 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
200.30.101.2 - - [24/Sep/2008:17:24:03 +0400] "GET /?8cdf7678 HTTP/1.1" 200 109821 "-" ""
125.132.186.37 - - [24/Sep/2008:17:24:03 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
124.56.25.23 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
195.16.91.6 - - [24/Sep/2008:17:24:00 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
89.178.114.211 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
116.121.139.193 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
222.107.251.77 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
68.55.221.118 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
165.246.181.206 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
211.112.65.224 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
89.178.114.211 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
79.117.213.211 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.47.215.35 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
92.114.113.144 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
71.195.137.202 - - [24/Sep/2008:17:24:04 +0400] "GET / HTTP/1.1" 200 109821 "-" ""
165.246.181.206 - - [24/Sep/2008:17:24:05 +0400] "GET / HTTP/1.1" 200 109821 "-" ""

in Apache access log for a particular web-site. MaxClients is set to 500 and all slots are still filled out. I've suspected DDoS attack, but that's how connection list looks like:

Quote:

1 established)
1 FIN_WAIT2
1 Foreign
1 TIME_WAIT
5 LAST_ACK
20 CLOSE_WAIT
27 LISTEN
38 FIN_WAIT1
101 SYN_RECV
611 ESTABLISHED

So that it seems no DDoS there.

What could that be? Any Help appreciated.

born4linux · 09-25-2008, 12:04 AM

the ips are spanning across different regions - some in europe, some in us, some in asia.
and ips are from ISPs - most probably assigned to their subscribers.

botnet attack?

maybe you should setup a honeypot just for the fun of it.

jaggy00 · 09-25-2008, 04:33 AM

Oh, I'm not that good actually and do not have spare resources at the moment, if you could give some good links on the topic, I would be very glad.

By the way, I'm using vnstat and iftop to evaluate traffic movement and they show me huge incoming traffic, although I know there should't be any. Can botnet attack generate it?

And one more issue, I've installed apf and wrote an access rule for 80 port, so that only specific countries could enter (took ranges from ip2country databases). At first I've noticed that traffic doesn't lower despite of the ACL-s, and then just to test I've removed 80 port from INGRESS section at all. And the site still remained accessible =-O I've did iptables -F and then apf -r and iptables -L - rules really are there, but they fo not block anything...

I'm frustrated.

linuxgurusa · 09-25-2008, 08:58 AM

Botnet attack maybe

Or you have a BBS type website, or jarhead or mambo website or any type of Guesbook type website etc that has exploits on it and the guys are attacking the site ... hence why I think it is botnet attacks as well yes ... not fun ;-)