 | View Full Version : how do you know ur site is being attacked kaskus 01-11-2002, 03:18 PM how do you know ur site is being attacked by someone . the connection to the server is very slow, it's never happened before. any idea how to find out is it being attacked or just server problem ? hypernatic.net 01-11-2002, 05:56 PM run a netstat -a ? Check for open ports?... try that to start with... kaskus 01-12-2002, 12:07 AM where should i tried that command ? im in virtual host and dont have telnet access yet bobcares 01-12-2002, 11:34 AM netstat can be used only via the shell. Why not see the your logs and see what is happening. This is the least you can do from the control panel (this is possible if you have access to raw logs). Have a great day :) regards amar kaskus 01-12-2002, 05:00 PM yes i have access to webstat. what part should i check to know that im being attacked jamenjaw 01-12-2002, 08:44 PM Originally posted by ****** yes i have access to webstat. what part should i check to know that im being attacked if you can see a LOT of hits from one site (im talking in the 10,000 range) or from a cupple of dirffernt domains then you are being attacked. i would cut the address its coming from and place it in an e-mail to your webhost provider. then they can check it out or let you know if someone elses site (or the server it self) is being attacked. and they will take it from there. good hunting:D James muppie 01-13-2002, 05:09 AM I suggest you to contact your host provider and ask them to help you handle / investigate. They have a better access to the server and are knowledgeable in these sort of things. Besides, it is also in their interest to know and find out what's happening. You will be doing both you and them a favour. clocker1996 01-13-2002, 10:09 AM iplog install iplog tariehk 01-14-2002, 08:27 PM where can you get iplog? Robot Two 01-20-2002, 05:14 PM It can be difficult to determine whether an attack is in progress in a virtual hosting environment. Many denial of service and remote exploit atacks will not leave any trace in the web server logs. There are a good deal of attacks which will not leave a trail in other logs as well, without a dececnt Intrusion Detection System in place. In this sort of situation, you should really contact your provider. Most likely, on of the other customers on your virtual host is using a lot of resources, and therefore bogging down your virtual server. In this case, you have a legitimate reason to complain to your provider, and they should remedy the problem from there. If you are indeed being attacked, the provider has better resources available to combat a denial of service or an intrusion. More importantly, though, they should want to know because all the other customers being hosted on the same machine are also being affected! Keep in mind, though, that it can be perfectly normal for servers to get a higher than normal usage rate for brief periods of time -- especially if you are sharing a virtual server with other customers. |