Hi,

I keep getting too many connections to apache. when I run netstat -atu it saids and there are about 150 or so of these:

tcp 0 0 99.99.99.99:https 208.179.99.90:4468 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4471 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4470 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4465 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4464 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4467 ESTABLISHED
tcp 0 0 99.99.99.99:https 208.179.99.90:4466

I replaced 99.99.99.99 with the actual ips

there's a bunch of these..and then that same 208 ip is at another ip on my server and this is happening at different times with different ips on my server. If is not just this 209.179 IP but if happens with different IPs and it happens at different times of the day.

That could be one of the following.

1- Some sites hosted on your server get a lot of traffic which makes a lot of apache processes run.
2- someone is attacking your server with some kind of syn attack.


I think, most likely it will be a perl script for a banner or advertising site on your server.

To check, just type

ps -aux | grep perl

You will find a list of processes, with the owner that runs them on the far left. Just suspend this user and send him a note. Or, you can limit him using RLimitCPU and RLimitNPROC

Hi,

I found out it has to do with the 408 apache problem in this tread:
http://www.webhostingtalk.com/showthread.php?s=&threadid=89636

any help is appreciated. Thanks.