Hi,
my bandwidth is running up like crazy, and i can't think of what i
can do, other then change ips.
I'm getting constant http requests, and they seem to be "real" so it is running up lots of bandwidth and spawning httpd alot...

Dec 12 16:30:55 TCP: http connection attempt from 213.65.84.243:64167
Dec 12 16:30:56 TCP: http connection attempt from 212.151.148.62:1167
Dec 12 16:30:56 TCP: http connection attempt from 213.65.84.243:64174
Dec 12 16:30:56 TCP: http connection attempt from 213.1.141.180:1213
Dec 12 16:30:56 TCP: http connection attempt from 213.66.97.11:4234
Dec 12 16:30:56 TCP: http connection attempt from 212.151.148.62:1169
Dec 12 16:30:56 TCP: http connection attempt from 213.66.97.11:4240
Dec 12 16:30:56 TCP: http connection attempt from 139.92.69.233:1661
Dec 12 16:30:56 TCP: http connection attempt from 213.66.156.243:53286
Dec 12 16:30:57 TCP: http connection attempt from 213.67.112.243:55023
Dec 12 16:30:57 TCP: http connection attempt from 217.208.168.62:34223
Dec 12 16:30:57 TCP: http connection attempt from 212.151.41.156:1656
Dec 12 16:30:57 TCP: http connection attempt from 212.151.135.83:1324
Dec 12 16:30:57 TCP: http connection attempt from 213.67.108.243:50502
Dec 12 16:30:57 TCP: http connection attempt from 217.208.168.62:34221
Dec 12 16:30:57 TCP: http connection attempt from 217.208.168.62:34217
Dec 12 16:30:57 TCP: http connection attempt from 213.66.84.243:49522
Dec 12 16:30:57 TCP: http connection attempt from 212.151.135.83:1330
Dec 12 16:30:58 TCP: http connection attempt from 213.66.84.243:49526
Dec 12 16:30:58 TCP: http connection attempt from 212.151.41.156:1659
Dec 12 16:30:58 TCP: http connection attempt from 62.30.0.4:37612
Dec 12 16:30:58 TCP: http connection attempt from 209.178.182.241:1364

I plan on changing ips, but I would like to know if there are any other solutions? I can't think of what else can i do?

Can anyone help?

have you tried restarting the webserver?
/etc/rc.d/init.d/httpd restart
im sure you have but figure Ill start with the obvious

yes i have
that isnt going to do me anything
heh

I think you might be subject to a DOS attack. Contact your upstream provider.

Originally posted by Skeptical
I think you might be subject to a DOS attack. Contact your upstream provider.

duhh

Are they valid requests or are they simple Syn-Ack connects?

If valid, just make a null-byte file in your web root so you don't spawn processes like crazy.

If invalid, run a packet mangler in front of apache to only allow valid rules.

greetz,
davidu

You might check out this tread too:

http://www.webhostingtalk.com/showthread.php?s=&threadid=28564