| Linux - Server This forum is for the discussion of Linux Software used in a server related context. |
| Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
03-14-2011, 07:38 AM
|
#1
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Rep: 
|
Lots of "C" (Closing connection)
Hello.
My server works fine, is never overloaded, but suddenly the Apache workers start to rise up to the limit (450), and are all internal processes "OPTIONS * HTTP/1.0" with "C" (Closing connection). Then the server runs very slow and this can take several hours until I restart Apache.
e.g. today:
Code:
0-0 24789 1/7/7 C 0.10 3980 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
1-0 24790 1/2/2 C 0.03 3989 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
2-0 24791 1/41/41 C 0.31 3894 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
3-0 24792 1/26/26 C 0.32 3912 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
4-0 24793 1/5/5 C 0.02 3975 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
5-0 24803 1/6/6 C 0.04 3974 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
6-0 24809 1/18/18 C 0.22 3938 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
7-0 24810 1/6/6 C 0.04 3987 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
8-0 24816 1/7/7 C 0.09 3977 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
9-0 24817 1/3/3 C 0.00 3986 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
10-0 24818 1/36/36 C 0.25 3908 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
11-0 24819 1/47/47 C 0.56 3803 0 0.0 0.11 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
12-0 24826 1/40/40 C 0.30 3910 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
13-0 24827 1/47/47 C 0.40 3843 0 0.0 0.06 0.06 ::1 my.server.com OPTIONS * HTTP/1.0
14-0 24828 1/2/2 C 0.01 3988 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
15-0 24829 1/8/8 C 0.04 3963 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
16-0 24830 1/16/16 C 0.23 3922 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
17-0 24831 1/67/67 C 0.58 3767 0 0.0 0.11 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
18-0 24832 1/25/25 C 0.40 3928 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
19-0 24833 1/4/4 C 0.01 3976 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
20-0 24936 1/32/32 C 0.45 3904 0 0.0 0.07 0.07 ::1 my.server.com OPTIONS * HTTP/1.0
21-0 25211 1/22/22 C 0.20 3902 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
22-0 25219 1/62/62 C 0.59 3714 0 0.0 0.11 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
23-0 25221 1/18/18 C 0.20 3906 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
24-0 25250 1/39/39 C 0.57 3798 0 0.0 0.11 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
25-0 25339 1/8/8 C 0.16 3923 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
26-0 25463 1/10/10 C 0.08 3898 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
27-0 25525 1/24/24 C 0.25 3844 0 0.0 0.07 0.07 ::1 my.server.com OPTIONS * HTTP/1.0
28-0 25534 1/14/14 C 0.14 3883 0 0.0 0.06 0.06 ::1 my.server.com OPTIONS * HTTP/1.0
29-0 25535 1/17/17 C 0.26 3856 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
30-0 25730 1/6/6 C 0.04 3896 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
31-0 25736 1/6/6 C 0.06 3905 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
32-0 25737 1/17/17 C 0.21 3867 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
.....
....
...
See the images:
http://i53.tinypic.com/aboymu.png
http://i51.tinypic.com/rlg8rs.png
I took a long time looking for the source of the problem but I can not find out.
Can you help me, please?
(excuse me by my English) |
|
|
|
|
03-15-2011, 04:20 PM
|
#2
|
|
Member
Registered: Aug 2009
Location: Chicago
Distribution: CentOS
Posts: 114
Rep: 
|
See if you can run 'service httpd fullstatus' to get a better explanation of what each thread is doing. Also, you should check netstat when this is happening.
|
|
|
|
|
03-15-2011, 06:47 PM
|
#3
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
Quote:
Originally Posted by jcalzare
See if you can run 'service httpd fullstatus' to get a better explanation of what each thread is doing. Also, you should check netstat when this is happening.
|
OK, Thaks.
When this happens again I will observe it. Anyway, in 'httpd fullstatus' I always see all processes like:
Code:
0-0 24789 1/7/7 C 0.10 3980 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
except a few normal processes like:
Code:
15-0 1678 1/39/301 K 0.71 0 15 0.0 0.03 0.46 187.141.84.85 www.mydomain.com GET /images/logo_...... HTTP/1.1
or
14-0 1856 1/27/332 C 0.58 0 15 1.0 0.03 0.48 200.82.253.19 www.mydomain.com GET /images/logo_...... HTTP/1.1
or
45-0 - 0/0/65 . 1.30 21 0 0.0 0.00 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
|
|
|
|
|
03-16-2011, 05:18 PM
|
#4
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
Well, here are the running processes:
Code:
Server Version: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g DAV/2 PHP/5.2.17 Apache
Server Built: Feb 21 2011 02:17:06
--------------------------------------------------------------------------------
Current Time: Wednesday, 16-Mar-2011 22:50:00 CET
Restart Time: Wednesday, 16-Mar-2011 22:04:28 CET
Parent Server Generation: 0
Server uptime: 45 minutes 32 seconds
Total accesses: 27988 - Total Traffic: 65.7 MB
CPU Usage: u436.2 s22 cu0 cs0 - 16.8% CPU load
10.2 requests/sec - 24.6 kB/second - 2460 B/request
450 requests currently being processed, 0 idle workers
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCKCCCCCCCCCCCCCCCCCCCCCCCCK
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCKCCWKKKCCCCCWCCCCCCCW
WK
Scoreboard Key:
"_" Waiting for Connection, "S" Starting up, "R" Reading Request,
"W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
"C" Closing connection, "L" Logging, "G" Gracefully finishing,
"I" Idle cleanup of worker, "." Open slot with no current process
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
0-0 10189 1/34/34 C 0.39 2611 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
1-0 10190 1/89/89 C 1.26 2451 0 0.0 0.10 0.10 ::1 my.server.com OPTIONS * HTTP/1.0
2-0 10191 1/8/8 C 0.07 2697 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
3-0 10192 1/46/46 C 0.75 2572 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
4-0 10193 1/7/7 C 0.08 2707 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
5-0 10195 1/11/11 C 0.26 2703 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
6-0 10197 1/45/45 C 0.63 2569 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
7-0 10198 1/8/8 C 0.08 2694 15 1.0 0.01 0.01 186.125.25.174 www.mydomain.net GET /images/logo_... HTTP/1.1
8-0 10199 1/8/8 C 0.09 2694 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
9-0 10200 1/8/8 C 0.40 2702 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
10-0 10201 1/3/3 C 0.02 2724 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
11-0 10202 1/10/10 C 0.12 2687 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
12-0 10203 1/37/37 C 0.67 2597 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
13-0 10204 1/19/19 C 0.24 2658 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
14-0 10205 1/42/42 C 0.68 2570 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
15-0 10206 1/2/2 C 0.01 2723 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
16-0 10207 1/33/33 C 0.42 2612 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
17-0 10208 1/20/20 C 0.33 2648 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
18-0 10209 1/7/7 C 0.13 2701 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
19-0 10210 1/6/6 C 0.07 2704 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
20-0 10212 1/23/23 C 0.39 2644 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
21-0 10213 1/20/20 C 0.28 2681 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
22-0 10214 1/51/51 C 0.99 2544 0 0.0 0.11 0.11 ::1 my.server.com OPTIONS * HTTP/1.0
23-0 10215 1/4/4 C 0.05 2709 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
24-0 10216 1/11/11 C 0.13 2684 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
25-0 10217 1/4/4 C 0.04 2711 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
26-0 10218 1/14/14 C 0.16 2665 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
27-0 10219 1/6/6 C 0.06 2700 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
28-0 10220 1/33/33 C 0.52 2678 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
29-0 10221 1/2/2 C 0.01 2722 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
30-0 10222 1/22/22 C 0.38 2637 0 0.0 0.07 0.07 ::1 my.server.com OPTIONS * HTTP/1.0
31-0 10223 1/25/25 C 0.44 2635 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
32-0 10224 1/7/7 C 0.06 2696 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
33-0 10225 1/2/2 C 0.01 2720 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
34-0 10226 1/4/4 C 0.03 2710 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
35-0 10227 1/4/4 C 0.09 2714 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
36-0 10229 1/18/18 C 0.25 2660 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
37-0 10230 1/5/5 C 0.05 2705 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
38-0 10231 1/13/13 C 0.19 2670 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
39-0 10232 1/97/97 C 1.70 2444 0 0.0 0.14 0.14 ::1 my.server.com OPTIONS * HTTP/1.0
40-0 10233 1/3/3 C 0.02 2716 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
41-0 10234 1/20/20 C 0.26 2650 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
42-0 10235 1/14/14 C 0.13 2664 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
43-0 10236 1/5/5 C 0.06 2713 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
44-0 10237 1/4/4 C 0.08 2712 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
45-0 10238 1/6/6 C 0.09 2706 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
46-0 10239 1/19/19 C 0.31 2663 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
47-0 10240 1/7/7 C 0.12 2699 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
48-0 10241 1/11/11 C 0.17 2683 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
49-0 10242 1/31/31 C 0.48 2606 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
50-0 10243 1/9/9 C 0.09 2686 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
51-0 10244 1/49/49 C 0.82 2548 0 0.0 0.06 0.06 ::1 my.server.com OPTIONS * HTTP/1.0
52-0 10245 1/28/28 C 0.39 2689 0 0.0 0.08 0.08 ::1 my.server.com OPTIONS * HTTP/1.0
53-0 10246 1/23/23 C 0.29 2636 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
54-0 10247 1/41/41 C 0.58 2568 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
55-0 10248 1/2/2 C 0.01 2719 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
56-0 10249 1/2/2 C 0.01 2721 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
57-0 10250 1/7/7 C 0.15 2698 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
58-0 10251 1/10/10 C 0.10 2682 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
59-0 10252 1/11/11 C 0.53 2680 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
60-0 10253 1/7/7 C 0.19 2695 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
61-0 10254 1/3/3 C 0.02 2715 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
62-0 10255 1/2/2 C 0.01 2718 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
63-0 10256 1/4/4 C 0.04 2708 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
64-0 10257 1/1/1 C 0.00 2725 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
65-0 10258 1/10/10 C 0.14 2688 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
66-0 10259 1/11/11 C 0.18 2679 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
67-0 10260 1/2/2 C 0.01 2717 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
68-0 10404 1/11/11 C 0.13 2659 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
69-0 10421 1/35/35 C 0.45 2574 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
70-0 10423 1/25/25 C 0.46 2604 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
71-0 10427 1/46/46 C 0.84 2575 0 0.0 0.09 0.09 ::1 my.server.com OPTIONS * HTTP/1.0
72-0 10429 1/24/24 C 0.38 2601 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
73-0 10430 1/21/21 C 0.25 2599 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
74-0 10431 1/7/7 C 0.07 2643 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
75-0 10432 1/37/37 C 0.57 2554 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
76-0 10433 1/46/46 C 0.99 2523 0 0.0 0.08 0.08 ::1 my.server.com OPTIONS * HTTP/1.0
77-0 10434 1/1/1 C 0.00 2666 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
78-0 10439 1/19/19 C 0.66 2602 0 0.0 0.08 0.08 ::1 my.server.com OPTIONS * HTTP/1.0
79-0 10446 1/25/25 C 0.34 2573 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
80-0 10448 1/40/40 C 0.54 2547 0 0.0 0.03 0.03 ::1 my.server.com OPTIONS * HTTP/1.0
81-0 10449 1/3/3 C 0.04 2645 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
82-0 10452 1/82/82 C 1.20 2434 0 0.0 0.15 0.15 ::1 my.server.com OPTIONS * HTTP/1.0
83-0 10458 1/16/16 C 0.18 2586 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
84-0 10463 1/15/15 C 0.21 2593 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
85-0 10572 1/9/9 C 0.10 2609 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
86-0 10575 1/31/31 C 0.51 2537 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
87-0 10576 1/13/13 C 0.15 2598 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
88-0 10580 1/15/15 C 0.20 2577 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
89-0 10586 1/57/57 C 0.82 2445 0 0.0 0.07 0.07 ::1 my.server.com OPTIONS * HTTP/1.0
90-0 10588 1/10/10 C 0.12 2587 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
91-0 10589 1/4/4 C 0.04 2607 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
92-0 10590 1/8/8 C 0.08 2592 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
93-0 10594 1/19/19 C 0.41 2552 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
94-0 10596 1/3/3 C 0.02 2610 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
95-0 10597 1/4/4 C 0.04 2605 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
96-0 10599 1/43/43 C 0.68 2483 0 0.0 0.14 0.14 ::1 my.server.com OPTIONS * HTTP/1.0
97-0 10600 1/9/9 C 0.22 2576 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
98-0 10601 1/4/4 C 0.03 2603 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
99-0 10602 1/25/25 C 0.48 2526 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
100-0 10603 1/35/35 C 0.50 2505 0 0.0 0.04 0.04 ::1 my.server.com OPTIONS * HTTP/1.0
101-0 10604 1/4/4 C 0.04 2600 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
102-0 10605 1/1/1 C 0.00 2613 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
103-0 10606 1/43/43 C 0.72 2480 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
104-0 10607 1/47/47 C 0.98 2501 0 0.0 0.10 0.10 ::1 my.server.com OPTIONS * HTTP/1.0
105-0 10608 1/2/2 C 0.01 2608 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
106-0 10609 1/111/111 C 1.66 2283 0 0.0 0.15 0.15 ::1 my.server.com OPTIONS * HTTP/1.0
107-0 10610 1/81/81 C 1.25 2433 0 0.0 0.09 0.09 ::1 my.server.com OPTIONS * HTTP/1.0
108-0 10629 1/77/77 C 1.50 2351 0 0.0 0.13 0.13 ::1 my.server.com OPTIONS * HTTP/1.0
109-0 10634 1/14/14 C 0.16 2546 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
110-0 10636 1/5/5 C 0.05 2571 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
111-0 10637 1/10/10 C 0.15 2579 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
112-0 10639 1/1/1 C 0.00 2588 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
113-0 10640 1/11/11 C 0.16 2555 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
114-0 10641 1/55/55 C 1.05 2436 0 0.0 0.07 0.07 ::1 my.server.com OPTIONS * HTTP/1.0
115-0 10642 1/34/34 C 0.74 2500 0 0.0 0.05 0.05 ::1 my.server.com OPTIONS * HTTP/1.0
116-0 10645 1/20/20 C 0.23 2545 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
117-0 10646 1/2/2 C 0.00 2578 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
118-0 10647 1/43/43 C 1.14 2454 0 0.0 0.09 0.09 ::1 my.server.com OPTIONS * HTTP/1.0
119-0 10758 1/4/4 C 0.04 2553 0 0.0 0.00 0.00 ::1 my.server.com OPTIONS * HTTP/1.0
120-0 10762 1/21/21 C 0.29 2493 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
121-0 10763 1/16/16 C 0.24 2516 0 0.0 0.02 0.02 ::1 my.server.com OPTIONS * HTTP/1.0
.....etc
Code:
/$ netstat -nt
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 212.xx.xxx.xxx:80 201.230.251.23:13251 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 186.40.187.3:4998 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 200.108.107.61:38621 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.230.143.85:4742 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 190.198.243.140:3486 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 98.119.152.204:49465 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.179.91.229:49254 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 83.37.246.169:52529 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 200.52.42.187:54558 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 187.194.71.82:12615 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 85.240.109.206:57992 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.164.232.246:3871 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 88.18.57.140:56692 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 200.25.197.114:42177 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.131.7.184:53789 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.131.177.212:50752 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.239.55.150:18482 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 186.106.23.210:11540 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 190.149.51.193:50506 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 186.124.242.238:51571 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 84.157.31.131:49558 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 186.137.73.86:60058 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 95.125.215.34:50917 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 200.126.103.123:55829 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.145.137.88:56620 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 95.125.215.34:50916 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 190.238.41.39:54399 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 79.146.237.81:22194 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 200.108.107.61:38698 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.212.162.189:3221 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.234.47.199:10743 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 187.139.18.113:1279 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 187.142.124.127:26843 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.170.105.29:28985 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 190.149.17.65:55606 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.194.224.202:50152 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 190.69.121.90:13580 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.152.7.225:54472 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.240.96.97:55115 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 85.30.99.174:1800 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 189.144.64.208:23977 SYN_RECV
tcp 0 0 212.xx.xxx.xxx:80 201.196.104.178:1939 SYN_RECV
tcp 0 0 127.0.0.1:47260 127.0.0.1:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:40055 74.125.230.116:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:57576 205.188.87.207:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:22 87.220.76.82:54589 ESTABLISHED
tcp 0 1 212.xx.xxx.xxx:51480 74.125.230.112:80 SYN_SENT
tcp 0 0 212.xx.xxx.xxx:37189 74.125.230.115:80 TIME_WAIT
tcp 0 0 127.0.0.1:47280 127.0.0.1:80 ESTABLISHED
tcp 0 0 212.xx.xxx.xxx:41312 74.125.226.146:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:40039 74.125.230.116:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:40107 74.125.230.116:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:48579 74.125.226.148:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:40083 74.125.230.116:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:57575 205.188.87.207:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:37311 82.194.77.4:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:51463 74.125.230.112:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:22 87.220.76.82:54590 ESTABLISHED
tcp 0 0 212.xx.xxx.xxx:51419 74.125.230.112:80 TIME_WAIT
tcp 0 0 212.xx.xxx.xxx:54655 74.125.226.147:80 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.235.208.246:10095 FIN_WAIT2
tcp6 483 0 212.xx.xxx.xxx:80 190.155.204.39:42092 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 189.221.233.19:50387 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 75.167.79.80:49888 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 190.124.131.100:1928 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.134.158.69:3445 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 95.22.75.102:56721 TIME_WAIT
tcp6 445 0 212.xx.xxx.xxx:80 83.38.74.106:12803 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:38385 TIME_WAIT
tcp6 340 0 212.xx.xxx.xxx:80 189.140.118.219:1506 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 200.70.26.230:1809 TIME_WAIT
tcp6 405 0 212.xx.xxx.xxx:80 187.134.81.219:2895 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 200.25.197.110:39991 TIME_WAIT
tcp6 427 0 212.xx.xxx.xxx:80 79.151.160.165:24556 ESTABLISHED
tcp6 562 0 212.xx.xxx.xxx:80 189.188.129.51:26657 ESTABLISHED
tcp6 0 1 212.xx.xxx.xxx:80 201.212.162.189:3352 LAST_ACK
tcp6 0 0 212.xx.xxx.xxx:80 201.253.214.186:2138 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 186.141.137.3:1294 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 188.81.66.227:55151 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 24.50.227.68:51400 TIME_WAIT
tcp6 1 1329 212.xx.xxx.xxx:80 190.125.34.65:49445 CLOSING
tcp6 0 0 212.xx.xxx.xxx:80 190.86.52.234:52522 FIN_WAIT2
tcp6 0 1329 212.xx.xxx.xxx:80 186.9.251.8:1743 FIN_WAIT1
tcp6 0 0 212.xx.xxx.xxx:80 187.132.161.107:4645 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 201.144.60.167:49147 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 186.57.144.99:3065 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 201.172.173.115:50071 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 200.84.22.184:2894 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 61.135.184.214:43055 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 189.239.55.150:18486 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 64.255.164.46:59963 TIME_WAIT
tcp6 506 0 212.xx.xxx.xxx:80 189.189.251.136:4625 ESTABLISHED
tcp6 608 0 212.xx.xxx.xxx:80 186.16.66.248:2261 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 83.34.157.74:23138 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 95.20.122.133:1709 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 79.151.174.18:15557 TIME_WAIT
tcp6 508 0 212.xx.xxx.xxx:80 69.117.8.19:58916 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 91.187.81.16:51378 ESTABLISHED
tcp6 316 0 212.xx.xxx.xxx:80 187.139.240.108:3933 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 201.235.83.8:59675 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.230.90.126:49480 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.236.175.166:14383 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 189.171.113.93:15318 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 189.216.111.223:53846 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 186.32.82.201:51992 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 186.22.6.177:2531 TIME_WAIT
tcp6 389 0 212.xx.xxx.xxx:80 67.195.114.236:40196 ESTABLISHED
tcp6 558 0 212.xx.xxx.xxx:80 98.254.198.92:1315 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 187.140.92.15:63777 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 196.28.52.1:50365 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 200.127.58.118:49397 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 79.157.114.137:1034 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 200.45.176.182:1140 TIME_WAIT
tcp6 0 632 212.xx.xxx.xxx:80 190.238.41.39:54333 FIN_WAIT1
tcp6 0 0 212.xx.xxx.xxx:80 78.13.60.130:59699 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 200.6.177.73:61414 FIN_WAIT2
tcp6 308 0 212.xx.xxx.xxx:80 65.52.110.41:30645 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 200.108.131.2:61608 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 79.145.97.93:10722 FIN_WAIT2
tcp6 442 0 212.xx.xxx.xxx:80 87.220.59.179:52866 ESTABLISHED
tcp6 508 0 212.xx.xxx.xxx:80 189.130.9.190:61245 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 88.89.25.6:49402 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.166.148.92:55327 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.174.12.166:17938 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 88.15.187.208:33437 TIME_WAIT
tcp6 386 0 212.xx.xxx.xxx:80 186.21.148.137:2698 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 88.31.58.161:49939 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 84.127.58.75:1452 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 186.137.228.80:4517 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 186.98.101.44:52760 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 85.55.12.117:55582 TIME_WAIT
tcp6 356 0 212.xx.xxx.xxx:80 190.42.49.89:18482 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 186.104.141.102:13724 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 200.120.38.163:50790 FIN_WAIT2
tcp6 410 0 212.xx.xxx.xxx:80 201.236.132.121:11206 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 189.132.89.210:12175 TIME_WAIT
tcp6 434 0 212.xx.xxx.xxx:80 83.57.132.170:3421 ESTABLISHED
tcp6 0 1 212.xx.xxx.xxx:80 24.139.137.147:49716 FIN_WAIT1
tcp6 0 0 212.xx.xxx.xxx:80 200.114.34.5:51082 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 190.29.162.95:58751 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 189.221.233.19:50377 TIME_WAIT
tcp6 397 0 212.xx.xxx.xxx:80 189.196.14.151:4280 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:35160 TIME_WAIT
tcp6 0 1 212.xx.xxx.xxx:80 186.113.203.225:1911 FIN_WAIT1
tcp6 0 0 212.xx.xxx.xxx:80 74.40.167.82:50232 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 95.125.215.34:50883 TIME_WAIT
tcp6 689 0 212.xx.xxx.xxx:80 212.231.237.100:1869 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 190.129.63.84:3889 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 186.180.152.33:3983 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 186.124.242.238:51538 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.159.119.180:50767 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 201.240.237.178:14285 TIME_WAIT
tcp6 402 0 212.xx.xxx.xxx:80 190.96.13.40:21058 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 132.248.255.82:22538 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 186.48.133.42:1591 TIME_WAIT
tcp6 379 0 212.xx.xxx.xxx:80 95.54.22.98:4577 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:35979 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 201.220.76.38:50779 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 213.135.236.98:43839 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 190.174.135.251:25811 TIME_WAIT
tcp6 475 0 212.xx.xxx.xxx:80 195.49.248.207:51914 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 190.206.186.55:63089 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 81.172.91.69:51040 TIME_WAIT
tcp6 288 0 212.xx.xxx.xxx:80 190.245.72.54:2264 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 190.139.62.233:1190 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 74.40.167.82:50229 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 212.183.247.99:54363 TIME_WAIT
tcp6 393 0 212.xx.xxx.xxx:80 201.210.142.138:2398 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 201.220.76.38:50772 FIN_WAIT2
tcp6 457 0 212.xx.xxx.xxx:80 190.247.70.247:2459 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 187.135.52.100:50248 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 187.137.207.194:12457 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 190.151.13.210:51176 TIME_WAIT
tcp6 308 0 212.xx.xxx.xxx:80 81.44.218.17:51428 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 190.134.54.254:1272 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 88.28.73.83:62120 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.40.200.165:15724 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 95.23.126.82:64640 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.199.73.108:2272 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 201.196.104.178:1954 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 83.97.213.123:4667 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:39392 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 187.199.240.127:17312 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 187.139.78.87:64308 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 85.55.119.253:59307 TIME_WAIT
tcp6 342 0 212.xx.xxx.xxx:80 200.122.27.27:61459 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 89.131.36.63:2603 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 77.205.147.205:53434 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:35275 TIME_WAIT
tcp6 1 0 212.xx.xxx.xxx:80 84.236.169.156:62713 CLOSE_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 188.86.42.244:52355 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 87.220.182.2:2975 TIME_WAIT
tcp6 413 0 212.xx.xxx.xxx:80 190.75.170.12:35730 ESTABLISHED
tcp6 347 0 212.xx.xxx.xxx:80 200.8.71.4:51055 ESTABLISHED
tcp6 496 0 212.xx.xxx.xxx:80 189.168.81.64:53250 ESTABLISHED
tcp6 1 0 212.xx.xxx.xxx:80 201.235.83.8:59686 CLOSE_WAIT
tcp6 490 0 212.xx.xxx.xxx:80 79.148.25.105:51062 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:35931 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.41.177.126:2015 TIME_WAIT
tcp6 461 0 212.xx.xxx.xxx:80 87.220.98.169:49359 ESTABLISHED
tcp6 472 0 212.xx.xxx.xxx:80 190.167.201.11:41824 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 190.121.238.142:35634 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 187.139.78.87:64297 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 83.57.132.170:3338 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 64.255.164.81:38529 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 123.125.67.225:10600 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.174.63.157:43787 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 67.195.114.236:39366 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 201.245.211.94:3911 FIN_WAIT2
tcp6 0 0 212.xx.xxx.xxx:80 190.12.20.20:48661 TIME_WAIT
tcp6 489 0 212.xx.xxx.xxx:80 201.239.93.5:3737 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 200.108.108.62:26908 FIN_WAIT2
tcp6 341 0 212.xx.xxx.xxx:80 190.232.207.46:12476 ESTABLISHED
tcp6 0 0 212.xx.xxx.xxx:80 207.46.199.220:24137 TIME_WAIT
tcp6 0 0 212.xx.xxx.xxx:80 190.47.206.240:3738 ESTABLISHED
tcp6 488 0 212.xx.xxx.xxx:80 85.49.228.182:56640 ESTABLISHED
....etc
What do you happening?...
Help me please, I'll go crazy.  |
|
|
|
|
03-16-2011, 05:34 PM
|
#5
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
I bring other data:
At the time of the collapse had started many simultaneous connections from the IP 69.28.58.43 to different pages hosted on the server. After, these connections have disappeared and began to appear a lot of "C" (closing connections).
|
|
|
|
|
03-18-2011, 02:01 PM
|
#6
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
Please, help me.
|
|
|
|
|
03-25-2011, 10:22 AM
|
#7
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
I still have the problem. Please, no one can tell me why this happens?.
|
|
|
|
|
03-25-2011, 12:17 PM
|
#8
|
|
Senior Member
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125
|
Have a look a this link and be sure to take a look at the screen shot that is referenced in the first post. This looks like you may be having the same sort of issue. One thing I found instructive about that site is that at the bottom of the screen shot it has a diagram that tells you what the fields in the output mean. I really hate to speculate like this, but it looks like it might be a form of DDOS. I say distributed because performing an nslookup of some of the IP addresses in question is showing them from coming from all over the world, e.g. Argentina, Singapore, and Estonia. It looks like the objective is to open as many ports as possible and flood your system with the requests.
I am NOT an expert in how to counteract this type of scenario, assuming that is what you are facing and your ISP may have some suggestions. You may be able to gain control of the system by using iptables to slow them down sufficiently. Unless you have some indication that this is a failure in your application(s), the other suggestion I have would be to 'report' this thread and ask that it be moved to security, where someone might have some more suggestions.
Before going that route, I would use Google or another search engine to look for keywords, like "OPTIONS * HTTP/1.0", with some other creative words like flood and see if you get any hits. I would also add other keywords like cpanel, vmware, or other applications you may be running. |
|
|
|
|
03-25-2011, 12:18 PM
|
#9
|
|
Moderator
Registered: May 2001
Posts: 29,415
|
Quote:
Originally Posted by talle
in 'httpd fullstatus' I always see all processes like:
Code:
0-0 24789 1/7/7 C 0.10 3980 0 0.0 0.01 0.01 ::1 my.server.com OPTIONS * HTTP/1.0
|
In the HTTP 1.1 RFC2616, the OPTIONS method when used with an asterisk queries the capabilities of the server. Regular client request behaviour, depending on server purpose (also see: DAV methods), should generally speaking show GETs and PUTs and no esoteric methods. While HEAD, TRACE and OPTIONS can be used for testing purposes the 69.28.48.0/20 CIDR (AS37958: CHINACACHE-1) you posted about belongs to ChinaCache North America, Inc. which is linked to the Huaweisymantecspider bot ( http://www.thevirtualworkforce.com/C...ymantec-Spider , http://www.webmasterworld.com/search...rs/4235612.htm). Note it uses different User Agent strings (for instance http://www.botsvsbrowsers.com/details/531625/index.html) so that blocking by UA as suggested ( https://nodpi.org/forum/index.php?topic=3366.5;wap2) may or may not work. To keep your web server from spending any CPU cycles on excessive TCP connections in the TIME-WAIT state, and with the inherent risk of Apache getting bogged down rejecting requests (connection throttling or limiting, rewriting, mod_evasive, mod_security), I would suggest (temporarily) blocking the offending IP address or IP ranges at the network level (firewall) if you have no customers slash viewers in that range. To keep Netfilter from tracking entries you could use NOTRACK but you could also drop it in the raw table PREROUTING chain, for example:
Code:
/sbin/iptables -t raw -A PREROUTING -s 69.28.48.0/20 -j DROP
and then kill Apache completely and start it again. |
|
|
1 members found this post helpful.
|
|
03-28-2011, 12:12 PM
|
#10
|
|
Senior Member
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125
|
I would like to follow up on a couple of technical points from the last post by unSpawn. First, I would like to ask a question regarding blocking IP ranges. Specifically, the post refers to the AS number of the ISP (AS37958). From a post by unSpawn several years ago (searching isn't finding the thread at the moment), I recall that it is best to identify the IP addresses to block based upon the AS number because the IPV4 address range is very fragmented. My first question is, is there a good way to find the AS number? Google searching seems to get bogged down in the AS term, which it seems to treat to mean the word 'as' and this causes searching to return poor hits. Is there a more correct search terminology for this number? The second part of this would be how to best go about block on this information. The old post that I am referring to contains an AWK script that attempts to extract the IP addresses associated with a particular AS number and add these to the IPtables blocked list. I tried experimenting with the script and didn't get very far, but it did provide a link to a site that correlated the ISP to the AS number. Is this still the best manner to go about this or is there a more modern technique?
Second, I was wondering what the advantages and disadvantages of blocking an IP in the prerouting chain over the input chain is? To be honest, I have never considered this before, nor can I say I can recall coming across this technique in an iptables tutorial before. It seems that it would, as unSpawn says, reject it earlier and help prevent excessive resource usage in a DOS scenario and it makes me wonder what is the downside of this approach?
|
|
|
|
|
03-28-2011, 01:27 PM
|
#11
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
Once I saw that the IP that initiated this process was the Google AdSense bot. I can not and should not block this IP. The essential problem is that this process starts, or triggers, they do not close until I restart Apache.
|
|
|
|
|
03-28-2011, 06:48 PM
|
#12
|
|
Senior Member
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125
|
I am sorry, but I am missing something here. Would you please clarify how you determined that these events are caused by Google's bots? The evidence so far does not seem to indicate this and I find it a strange behavior for Google to cause. If it really is caused by their bots, then there must be something seriously mis-configured in your server. Again, if you would please share the information you have, we will help you to solve the problem, assuming you haven't already.
Edit: in partial answer to my own question, AS stands for autonomous system and searching for those terms will provide relevant information.
Last edited by Noway2; 03-29-2011 at 07:56 AM.
|
|
|
|
|
04-01-2011, 12:58 PM
|
#13
|
|
LQ Newbie
Registered: Mar 2011
Posts: 8
Original Poster
Rep:
|
I was already going crazy, and ... Bingo!
Carefully watching the server-status every time it happened this issue, I've noticed that there were requests to nonexistent folders (or files) in a domain.
I don't know why these requests generated this increase in the internal processes that not self closing. But I modified the .htaccess file removing:
Code:
RewriteCond% {REQUEST_FILENAME}!-f
RewriteCond% {REQUEST_FILENAME}!-d
RewriteRule. / index.php [L]
And solved!
Thank you all for the inconvenience that have you taken with my issue.
(I'm sorry, the Google translator is not perfect) |
|
|
|
|
04-03-2011, 04:39 AM
|
#14
|
|
Moderator
Registered: May 2001
Posts: 29,415
|
Sorry. Didn't see your questions earlier on.
Quote:
Originally Posted by Noway2
From a post by unSpawn several years ago (searching isn't finding the thread at the moment), I recall that it is best to identify the IP addresses to block based upon the AS number because the IPV4 address range is very fragmented. My first question is, is there a good way to find the AS number? Is there a more correct search terminology for this number?
|
Not only are IPv4 ranges fragmented but assignments may change (CIDR Report) instantly. AS stands for Autonomous System and an ASN can be found using the indispensable RobTex (here showing LQ: check nfo in the A records row) or Fixed Orbit or some Looking Glasses (also see CYMRU: IP to ASN Mapping.
Quote:
Originally Posted by Noway2
The second part of this would be how to best go about block on this information. The old post that I am referring to contains an AWK script that attempts to extract the IP addresses associated with a particular AS number and add these to the IPtables blocked list. I tried experimenting with the script and didn't get very far, but it did provide a link to a site that correlated the ISP to the AS number. Is this still the best manner to go about this or is there a more modern technique?
|
Hmm. The only related Awk script I remember is the one I posted for CYMRU bogons which nowadays looks like this BTW:
Code:
#!/bin/bash --
export TMPDIR=/dev/shm && BOGONTMP=`mktemp -p /dev/shm -d ${progn}.XXXXXXXXXX` && {
curl -s http://www.team-cymru.org/Services/Bogons/bogon-bn-nonagg.txt > "${BOGONTMP}/bogons" || { rm -rf "${BOGONTMP}"; exit 1; }
egrep -v "^(127\.|192\.168\.|169\.254\.)" "${BOGONTMP}/bogons" | while read BOGON; do
/sbin/iptables -n -t raw -L PREROUTING|grep -q -m1 "${BOGON}"||echo "/sbin/iptables -t raw -A PREROUTING -i eth0 -s ${BOGON} -j DROP"
/sbin/iptables -n -t raw -L OUTPUT|grep -q -m1 "${BOGON}"||echo "/sbin/iptables -t raw -A OUTPUT -o eth0 -d ${BOGON} -j DROP"
done; rm -rf "${BOGONTMP}"; }
exit 0
Apart from web interfaces there's CLI tools like (j)whois: 'whois -h ${WHOIS_SERVER} ${IP_ADDRESS}', which is faster for endpoint lookups and then there's Layer Four Traceroute 'lft' (specify which WHOIS database to use say 'lft -C ${HOSTNAME_OR_IP_ADDRESS}') which comes in handy when you need to enumerate ASNs on a route to an endpoint.
Quote:
Originally Posted by Noway2
Second, I was wondering what the advantages and disadvantages of blocking an IP in the prerouting chain over the input chain is? To be honest, I have never considered this before, nor can I say I can recall coming across this technique in an iptables tutorial before. It seems that it would, as unSpawn says, reject it earlier and help prevent excessive resource usage in a DOS scenario and it makes me wonder what is the downside of this approach?
|
A reason for using the raw table is to avoid dedicating any conntrack entries to items you're going to block anyway but this makes more sense when blocking large amounts of individual IP addresses (at which point you probably want to switch over from using the "recent" module to using ipsets anyway).
HTH |
|
|
1 members found this post helpful.
|
All times are GMT -5. The time now is 09:00 AM.
|
|
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
|
 Latest Threads
LQ News
|
|
