Results 1 to 5 of 5
  1. #1
    Join Date
    Feb 2010

    * do you have any idea on this ?


    We have one server at 100TB. and running openvz few clients on the server.

    this few days, we receive packet loss ( it is not lot, but not sure why it happened )

    they report that ( their tech and SL ) our server received an attack.

    but i have checked few times, none of ip connecting to our server more then 20 times, i have ask them to provide any proof that which ip getting attack, but they just told our main ip getting attack ( Wow, our main ip never get used, as vps node, i don't think anyone will use / host anything website etc on the main node.

    just submitted ticket ticket to their support, it already 2 hours now, they report they on it already, but i have checked the system, still no one login our system that 2 hours.

    Do anyone knows how can i check that is there any attack or there have some issue on their end ?

    And i have email to tom as well, he only respond they are working on this, but this already 2 hours..i'm not sure how they check it, please anyone help me

  2. #2
    If you have access to your server,
    You can try to run a command: tcpdump -n -c 1000
    It will show your server traffic.
    You need to be root in order to run tcpdump

  3. #3
    Join Date
    Feb 2010
    thanks mate, because i usually use something like

    tcpdump -l -n -i eth1 ( because for your command, will how eth0 as well, as SOftlayer provide eth0 for private, you will cap private connection as well )

    but i have checked, no single ip connected to our server more then 20 per ip.

    P.S the packet loss already gone, but no idea why it happened

    i have tried to ping yahoo when my server packet loss

    PING ( 56(84) bytes of data.
    64 bytes from ( icmp_seq=1 ttl=54
    time=116 ms
    64 bytes from ( icmp_seq=2 ttl=54
    time=109 ms
    64 bytes from ( icmp_seq=3 ttl=54
    time=90.9 ms
    64 bytes from ( icmp_seq=4 ttl=54
    time=114 ms
    64 bytes from ( icmp_seq=5 ttl=54
    time=84.3 ms
    64 bytes from ( icmp_seq=6 ttl=54
    time=91.0 ms
    64 bytes from ( icmp_seq=7 ttl=54
    time=122 ms
    64 bytes from ( icmp_seq=8 ttl=54
    time=78.6 ms
    64 bytes from ( icmp_seq=9 ttl=54
    time=81.3 ms
    64 bytes from ( icmp_seq=10 ttl=54
    time=48.1 ms
    64 bytes from ( icmp_seq=11 ttl=54
    time=48.3 ms
    64 bytes from ( icmp_seq=12 ttl=54
    time=47.2 ms
    64 bytes from ( icmp_seq=13 ttl=54
    time=48.4 ms
    64 bytes from ( icmp_seq=14 ttl=54
    time=48.4 ms
    64 bytes from ( icmp_seq=17 ttl=54
    time=95.4 ms
    64 bytes from ( icmp_seq=18 ttl=54
    time=117 ms
    64 bytes from ( icmp_seq=19 ttl=54
    time=84.2 ms
    64 bytes from ( icmp_seq=20 ttl=54
    time=110 ms
    64 bytes from ( icmp_seq=21 ttl=54
    time=107 ms
    64 bytes from ( icmp_seq=22 ttl=54
    time=96.1 ms
    64 bytes from ( icmp_seq=23 ttl=54
    time=100 ms
    64 bytes from ( icmp_seq=25 ttl=54
    time=100 ms
    64 bytes from ( icmp_seq=26 ttl=54
    time=98.9 ms
    64 bytes from ( icmp_seq=27 ttl=54
    time=94.3 ms
    64 bytes from ( icmp_seq=28 ttl=54
    time=115 ms
    64 bytes from ( icmp_seq=29 ttl=54
    time=113 ms
    64 bytes from ( icmp_seq=30 ttl=54
    time=100 ms
    64 bytes from ( icmp_seq=31 ttl=54
    time=95.0 ms
    64 bytes from ( icmp_seq=32 ttl=54
    time=63.7 ms
    64 bytes from ( icmp_seq=33 ttl=54
    time=87.4 ms
    64 bytes from ( icmp_seq=35 ttl=54
    time=92.6 ms
    64 bytes from ( icmp_seq=38 ttl=54
    time=123 ms

    --- ping statistics ---
    38 packets transmitted, 32 received, 15% packet loss, time 37007ms
    rtt min/avg/max/mdev = 47.268/91.505/123.842/22.883 ms

    the ms is very unstable

    Last edited by plesk002; 04-10-2011 at 02:31 AM.

  4. #4
    Join Date
    Feb 2010
    just received an update form them / SL

    " There was an attack on another server within the same Data Center, that your
    server is in, that was causing the packetloss you was seeing. The attack
    has been taken care of and there is no more packetloss seen toward your server. "

    but the first time, they told us our server getting attack, it seem they do not happy to check it for us, if you report your server unstable, it should be something happen form your end.

    may be you can try to turn off server, and the attack will be gone

  5. #5
    Join Date
    Nov 2009
    Vista, CA
    may be you can try to turn off server, and the attack will be gone
    I think in this situation you need to do something against attack rather then just go...
    WebIntellects - Fully Managed Dedicated and Virtual Private Servers since1999.
    WebhostGIANT - LOW Cost Hosting

Similar Threads

  1. Replies: 69
    Last Post: 03-03-2007, 01:48 PM
  2. Got an origional idea for forums? I can help bring your idea to life :)
    By DiverseFlow in forum Other Offers & Requests
    Replies: 8
    Last Post: 05-13-2005, 10:24 PM
  3. War! Good Idea? Bad Idea?
    By designerforhire in forum Web Hosting Lounge
    Replies: 23
    Last Post: 07-10-2004, 09:35 AM
  4. Customer Incentives? Good idea or bad idea?
    By PHPGeek2k3 in forum Running a Web Hosting Business
    Replies: 2
    Last Post: 07-04-2003, 12:30 PM
  5. mod_gzip -- Good Idea? Bad Idea?
    By NVB in forum Dedicated Server
    Replies: 18
    Last Post: 01-01-2002, 05:39 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts