Results 1 to 8 of 8

Thread: what is this?

  1. #1

    what is this?

    Hi guys,

    We have a video streaming server, sometimes the server gets really slow and when we digg into it, we see that the same ip is trying to download the same file many many times. for example i either run this command

    netstat -n | grep :80 | awk '{ print $5 }' | awk -F: '{ print $1 }' | sort | uniq -c | sort -n | tail

    or go to WHM and see the 'apache stats' and i see 100 http connections from the same ip, trying to download the same video 100 times,,,

    what is this? is this some sort of attack? could that be 100 different people that use a proxy? or what is going on?

    please help

  2. #2
    guys, could they be using some sort of download software that would try to download the same file manytimes to maybe speed the download up?

    thanks

  3. #3
    It's most likely an attack, trying to use up your available bandwidth. You may want to look into setting up ddos-deflate.
    478east
    High Bandwidth Servers
    Custom Hosting Solutions

  4. #4
    Check the load on the server if its much more then and the server is facing
    too much performance problem then you should blocked this IP using the firewall.

  5. #5
    Join Date
    Sep 2009
    Location
    UK
    Posts
    316
    I think you need to block that IP to avoid that.

  6. #6
    You need to check the IP address to make sure whether it's a proxy server or not.
    But feel free to block it as it eats too much of your system resources.....

  7. #7
    You should be able to block just that IP via iptables.
    NationalNet - Hosting. Handled.
    Extreme Support Managed Hosting | Inexpensive Dedicated Servers | Affordable Atlanta Colocation | CDN
    sales @ nationalnet.com | 888-4-NATNET | www.nationalnet.com

  8. #8
    Join Date
    Apr 2001
    Posts
    1,044
    Probably a proxy as been said or an attack against your server to either max out its port or use up your apache daemons...although 100 connections isnt much to do anything to apache.
    ReliableServers.com
    Dedicated Servers | Colocation | Cloud Servers | CDN
    1000 Gbps Network | New Jersey DataCenter
    973-849-0535

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •