Useful commands to detect a flood or DOS?

htmlcoder · 03-04-2005, 08:12 AM

Hi:
For the linux gurus here, just wondering, what are some useful commands to detect in real time a possible mini Apache flood or DOS? I see big bandwidth spikes at times throughout the day. One useful command I type is:

netstat -apn|grep :80|awk '{print $5}'|sort

to see the # of connections open by a particular IP. Any other useful commands? Thanks,

Capt_Caveman · 03-04-2005, 08:54 AM

You could use a iptables logging rule to notify you when a certain threshold rate of incoming packets or new connections is reached. You might also want to checkout something like mod_dosevasive.