Results 1 to 7 of 7
  1. #1
    Join Date
    Jan 2007
    Posts
    31

    Unresponsive Server Mystery

    I've been having this problem for the past week: everyday in the afternoon my dedicated server goes unresponsive for about an hour or so--you can FTP into it (upload and download work fine) and access the control panel, but it refuses to serve up any webpages / files through the browser (no one can access my site). Meanwhile the CPU / RAM seems to be just sitting there being completely unused. This problem just starts by itself and then goes away by itself somewhat regularly. Restarting the server has no effect on this.

    I'm puzzled as to what the problem could possibly be or how I can fix it--any ideas? My server's running Fedora 6 / GoDaddy control panel if it helps.

    Thanks guys, bye.

  2. #2
    Join Date
    Nov 2002
    Location
    WebHostingTalk
    Posts
    8,878
    * Moved to Technical and Security Issues....

    Sirius
    I support the Human Rights Campaign!
    Moving to the Tampa, Florida area? Check out life in the suburbs in Trinity, Florida.

  3. #3
    Join Date
    Jan 2001
    Location
    Miami, FL
    Posts
    1,072
    what does netstat show....

    This sounds like it could be a DDOS attack on port 80 using sync floods.
    Biznesshosting, Inc. DBA VOLICO - Intelligent Hosting Solutions
    East Coast Enterprise Dedicated Servers and Miami Colocation.
    managed and unmanaged dedicated servers. High bandwidth colocation. Managed clusters.

  4. #4
    Join Date
    Jan 2007
    Posts
    31
    I don't know much about linux / netstat and such, but typing netstat gets a long list of results like:

    unix 2 [ ] STREAM CONNECTED 60814
    unix 2 [ ] STREAM CONNECTED 60798
    unix 2 [ ] STREAM CONNECTED 60711
    unix 2 [ ] STREAM CONNECTED 18268
    unix 3 [ ] STREAM CONNECTED 15808 /var/run/dbus/system_bus_socket
    unix 3 [ ] STREAM CONNECTED 15807
    unix 3 [ ] STREAM CONNECTED 15640 @/var/run/hald/dbus-E3q2BlZHJH

    I've attached a text-file containing as much of netstat's output as I can. Thanks.
    Attached Files Attached Files

  5. #5
    Join Date
    Nov 2001
    Location
    Ann Arbor, MI
    Posts
    2,978
    The part at the top probably would have been more helpful. Try netstat -tupan. However, it seems likely that just looking at your web server's logs or doing an strace on the web server daemon would help you find out what was going on.
    -Mark Adams
    www.bitserve.com - Secure Michigan web hosting for your business.
    Only host still offering a full money back uptime guarantee and prorated refunds.
    Offering advanced server management and security incident response!

  6. #6
    Join Date
    Jan 2007
    Posts
    31
    Ok, I did netstat -tupan and attached the results in a text-file below. It's most stuff like:

    tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:218.6.150.77:2333 TIME
    _WAIT -
    tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:12.217.91.159:63913 TIME
    _WAIT -
    tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:65.78.94.103:3731 TIME
    _WAIT -
    tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:76.246.47.167:4187 TIME
    _WAIT -
    Attached Files Attached Files

  7. #7
    Join Date
    Jul 2004
    Location
    Athens, Greece
    Posts
    203
    During the problem, use tcpdump to check if your server actually receives any web traffic and try to surf the site to check if your IP will appear on the list:
    Code:
    tcpdump -ni <interface> 'host <yourip> and port 80' (without <>)
    - If it does but it doesn't respond back, then you may have to check server-related issues (firewall, daemon or even an incoming attack)
    - If it doesn't, then your provider may be blocking the IP/port for some reason (i.e incoming attack or different issue)
    SharkTECH Internet Services
    http://www.sharktech.net
    DDOS Firewalled Dedicated Servers
    Managed Services / IRC Allowed

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •