어제 오늘 웹서버에 트래픽이 몰리면서 전체 네트웍이 극심하게
느려지고 있습니다.
망 담당자의 말에 따르면 비대칭라인(다운 2M, 업 512)이기 때문에
업로드 트래픽의 영향을 많이 받을 수 있답니다.
아래와 같이 SYN_RECV 가 자주 보입니다.
ip가 유효한 것으로 보아 악의적인 공격은 아닌것 같은데..
[root@LOCAL /root]## netstat -na
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign
Address State
tcp 0 0 LOCAL_HOST:80 211.185.224.80:35650
ESTABLISHED
tcp 0 59352 LOCAL_HOST:80 141.223.180.14:48235
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.220.204.159:2519
ESTABLISHED
tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3770
ESTABLISHED
tcp 0 497 LOCAL_HOST:80 211.187.15.191:3204
ESTABLISHED
tcp 0 57974 LOCAL_HOST:80 211.207.200.157:1287
ESTABLISHED
tcp 0 27444 LOCAL_HOST:80 211.187.15.191:3203
FIN_WAIT1
tcp 0 59532 LOCAL_HOST:80 211.248.167.62:62518
ESTABLISHED
tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3768
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.185.44.88:1889
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 68.81.121.35:4173
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 203.231.85.250:3056
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 210.217.227.73:1210
ESTABLISHED
tcp 0 58560 LOCAL_HOST:80 211.37.206.94:1410
ESTABLISHED
tcp 0 0 LOCAL_HOST:80 210.183.177.20:33844
FIN_WAIT2
tcp 0 58800 LOCAL_HOST:80 61.72.9.73:10147
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.114.22.18:37648
ESTABLISHED
tcp 0 0 LOCAL_HOST:80 210.183.177.20:33768
FIN_WAIT2
tcp 0 59532 LOCAL_HOST:80 211.61.64.205:2341
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.112.156.7:38809
ESTABLISHED
tcp 0 58168 LOCAL_HOST:80 211.105.41.106:2437
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 210.104.161.200:57402
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.40.49.51:64859
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 61.248.134.32:4052
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 210.180.210.2:52388
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.114.22.18:36859
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 152.149.158.199:3741
ESTABLISHED
tcp 0 59040 LOCAL_HOST:80 211.34.7.3:34878
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1158
ESTABLISHED
tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1028
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.228.227.227:65287
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 203.225.57.16:1624
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 61.35.255.4:53385
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.108.228.62:1199
ESTABLISHED
tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1026
ESTABLISHED
tcp 0 59040 LOCAL_HOST:80 203.244.220.37:9426
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1153
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 203.244.197.254:42086
ESTABLISHED
tcp 1 57905 LOCAL_HOST:80 203.241.146.2:1672
LAST_ACK
tcp 0 59532 LOCAL_HOST:80 210.100.146.1:1084
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 218.48.222.144:1288
ESTABLISHED
tcp 0 58168 LOCAL_HOST:80 210.221.122.38:32867
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 219.241.138.76:1317
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 211.241.250.125:1741
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 210.115.222.2:44683
ESTABLISHED
tcp 0 59532 LOCAL_HOST:80 203.244.197.254:36488
ESTABLISHED
tcp 0 34838 LOCAL_HOST:80 218.144.236.85:2380
FIN_WAIT1
tcp 0 58321 LOCAL_HOST:80 61.43.104.128:1375
FIN_WAIT1
tcp 1 59533 LOCAL_HOST:80 210.222.36.10:1709
LAST_ACK
tcp 0 58561 LOCAL_HOST:80 210.125.161.136:1827
FIN_WAIT1
tcp 1 59041 LOCAL_HOST:80 211.115.147.67:47549
LAST_ACK
tcp 1 59361 LOCAL_HOST:80 211.115.147.67:47486
LAST_ACK
tcp 0 0 0.0.0.0:110 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:2000 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:21 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:25 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:3306 0.0.0.0:*
LISTEN
tcp 0 0 LOCAL_HOST:80 211.225.68.228:2512
SYN_RECV
tcp 0 0 LOCAL_HOST:80 61.74.117.17:2329
SYN_RECV
tcp 0 0 LOCAL_HOST:80 211.51.169.153:2380
SYN_RECV
tcp 0 0 LOCAL_HOST:80 0.0.0.0:*
LISTEN
tcp 0 0 LOCAL_HOST:53 0.0.0.0:*
LISTEN
tcp 0 0 127.0.0.1:53 0.0.0.0:*
LISTEN
tcp 0 0 0.0.0.0:113 0.0.0.0:*
LISTEN
udp 0 0 0.0.0.0:161 0.0.0.0:*
udp 0 0 0.0.0.0:1024 0.0.0.0:*
udp 0 0 LOCAL_HOST:53 0.0.0.0:*
udp 0 0 127.0.0.1:53 0.0.0.0:*
raw 0 0 0.0.0.0:1 0.0.0.0:* 7
raw 0 0 0.0.0.0:6 0.0.0.0:* 7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 0 [ ACC ] STREAM LISTENING
570 /tmp/mysql.sock
unix 0 [ ] STREAM CONNECTED 176
@00000018
unix 7 [ ] DGRAM
362 /dev/log
unix 0 [ ACC ] STREAM LISTENING
446 /var/run/ndc
unix 0 [ ] DGRAM 104992
unix 0 [ ] DGRAM 68748
unix 0 [ ] DGRAM 56169
unix 0 [ ] DGRAM 56164
unix 0 [ ] DGRAM 444
unix 0 [ ] DGRAM 384
unix 0 [ ] DGRAM 372
[root@LOCAL /root]## sysctl -a | grep syn
net.ipv4.vs.timeout_synack = 100
net.ipv4.vs.timeout_synrecv = 10
net.ipv4.vs.timeout_synsent = 60
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 10
syn backlog도 늘려줬고, syncookies 옵션도 올렸고..
현재 업로드 트래픽이 50~70KB에 달하고 있습니다.
아파치의 설정을 바꿔서 이 문제를 헤쳐나갈 방법이 없을까요?
현재는 설치시의 초기값을 유지하고 있습니다.
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
--
이것도 저것도 아니면, 역시 회선 문제란 말인가?