안녕하세요?
Send-Q가 거의 일정한 양으로 커넥이 되어지는 것으로 보아 누군가가 게시판에 와레즈
자료를 올려놓은 것으로 보입니다.
아파치 로그를 살펴보시면 어느 파일을 받고 있는지 알 수 있을 것입니다.
그럼, 불법자료 퇴치하시길~
: 어제 오늘 웹서버에 트래픽이 몰리면서 전체 네트웍이 극심하게
: 느려지고 있습니다.
:
: 망 담당자의 말에 따르면 비대칭라인(다운 2M, 업 512)이기 때문에
: 업로드 트래픽의 영향을 많이 받을 수 있답니다.
:
: 아래와 같이 SYN_RECV 가 자주 보입니다.
: ip가 유효한 것으로 보아 악의적인 공격은 아닌것 같은데..
:
: [root@LOCAL /root]## netstat -na
: Active Internet connections (servers and established)
: Proto Recv-Q Send-Q Local Address Foreign
: Address State
: tcp 0 0 LOCAL_HOST:80 211.185.224.80:35650
: ESTABLISHED
: tcp 0 59352 LOCAL_HOST:80 141.223.180.14:48235
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.220.204.159:2519
: ESTABLISHED
: tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3770
: ESTABLISHED
: tcp 0 497 LOCAL_HOST:80 211.187.15.191:3204
: ESTABLISHED
: tcp 0 57974 LOCAL_HOST:80 211.207.200.157:1287
: ESTABLISHED
: tcp 0 27444 LOCAL_HOST:80 211.187.15.191:3203
: FIN_WAIT1
: tcp 0 59532 LOCAL_HOST:80 211.248.167.62:62518
: ESTABLISHED
: tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3768
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.185.44.88:1889
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 68.81.121.35:4173
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 203.231.85.250:3056
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 210.217.227.73:1210
: ESTABLISHED
: tcp 0 58560 LOCAL_HOST:80 211.37.206.94:1410
: ESTABLISHED
: tcp 0 0 LOCAL_HOST:80 210.183.177.20:33844
: FIN_WAIT2
: tcp 0 58800 LOCAL_HOST:80 61.72.9.73:10147
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.114.22.18:37648
: ESTABLISHED
: tcp 0 0 LOCAL_HOST:80 210.183.177.20:33768
: FIN_WAIT2
: tcp 0 59532 LOCAL_HOST:80 211.61.64.205:2341
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.112.156.7:38809
: ESTABLISHED
: tcp 0 58168 LOCAL_HOST:80 211.105.41.106:2437
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 210.104.161.200:57402
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.40.49.51:64859
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 61.248.134.32:4052
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 210.180.210.2:52388
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.114.22.18:36859
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 152.149.158.199:3741
: ESTABLISHED
: tcp 0 59040 LOCAL_HOST:80 211.34.7.3:34878
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1158
: ESTABLISHED
: tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1028
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.228.227.227:65287
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 203.225.57.16:1624
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 61.35.255.4:53385
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.108.228.62:1199
: ESTABLISHED
: tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1026
: ESTABLISHED
: tcp 0 59040 LOCAL_HOST:80 203.244.220.37:9426
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1153
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 203.244.197.254:42086
: ESTABLISHED
: tcp 1 57905 LOCAL_HOST:80 203.241.146.2:1672
: LAST_ACK
: tcp 0 59532 LOCAL_HOST:80 210.100.146.1:1084
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 218.48.222.144:1288
: ESTABLISHED
: tcp 0 58168 LOCAL_HOST:80 210.221.122.38:32867
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 219.241.138.76:1317
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 211.241.250.125:1741
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 210.115.222.2:44683
: ESTABLISHED
: tcp 0 59532 LOCAL_HOST:80 203.244.197.254:36488
: ESTABLISHED
: tcp 0 34838 LOCAL_HOST:80 218.144.236.85:2380
: FIN_WAIT1
: tcp 0 58321 LOCAL_HOST:80 61.43.104.128:1375
: FIN_WAIT1
: tcp 1 59533 LOCAL_HOST:80 210.222.36.10:1709
: LAST_ACK
: tcp 0 58561 LOCAL_HOST:80 210.125.161.136:1827
: FIN_WAIT1
: tcp 1 59041 LOCAL_HOST:80 211.115.147.67:47549
: LAST_ACK
: tcp 1 59361 LOCAL_HOST:80 211.115.147.67:47486
: LAST_ACK
: tcp 0 0 0.0.0.0:110 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:2000 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:21 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:22 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:25 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:3306 0.0.0.0:*
: LISTEN
: tcp 0 0 LOCAL_HOST:80 211.225.68.228:2512
: SYN_RECV
: tcp 0 0 LOCAL_HOST:80 61.74.117.17:2329
: SYN_RECV
: tcp 0 0 LOCAL_HOST:80 211.51.169.153:2380
: SYN_RECV
: tcp 0 0 LOCAL_HOST:80 0.0.0.0:*
: LISTEN
: tcp 0 0 LOCAL_HOST:53 0.0.0.0:*
: LISTEN
: tcp 0 0 127.0.0.1:53 0.0.0.0:*
: LISTEN
: tcp 0 0 0.0.0.0:113 0.0.0.0:*
: LISTEN
: udp 0 0 0.0.0.0:161 0.0.0.0:*
: udp 0 0 0.0.0.0:1024 0.0.0.0:*
: udp 0 0 LOCAL_HOST:53 0.0.0.0:*
: udp 0 0 127.0.0.1:53 0.0.0.0:*
: raw 0 0 0.0.0.0:1 0.0.0.0:* 7
: raw 0 0 0.0.0.0:6 0.0.0.0:* 7
: Active UNIX domain sockets (servers and established)
: Proto RefCnt Flags Type State I-Node Path
: unix 0 [ ACC ] STREAM LISTENING
: 570 /tmp/mysql.sock
: unix 0 [ ] STREAM CONNECTED 176
: @00000018
: unix 7 [ ] DGRAM
: 362 /dev/log
: unix 0 [ ACC ] STREAM LISTENING
: 446 /var/run/ndc
: unix 0 [ ] DGRAM 104992
: unix 0 [ ] DGRAM 68748
: unix 0 [ ] DGRAM 56169
: unix 0 [ ] DGRAM 56164
: unix 0 [ ] DGRAM 444
: unix 0 [ ] DGRAM 384
: unix 0 [ ] DGRAM 372
:
:
: [root@LOCAL /root]## sysctl -a | grep syn
: net.ipv4.vs.timeout_synack = 100
: net.ipv4.vs.timeout_synrecv = 10
: net.ipv4.vs.timeout_synsent = 60
: net.ipv4.tcp_max_syn_backlog = 1024
: net.ipv4.tcp_syncookies = 1
: net.ipv4.tcp_syn_retries = 10
:
: syn backlog도 늘려줬고, syncookies 옵션도 올렸고..
:
:
: 현재 업로드 트래픽이 50~70KB에 달하고 있습니다.
:
:
:
: 아파치의 설정을 바꿔서 이 문제를 헤쳐나갈 방법이 없을까요?
: 현재는 설치시의 초기값을 유지하고 있습니다.
:
: Timeout 300
: KeepAlive On
: MaxKeepAliveRequests 100
: KeepAliveTimeout 15
:
: --
: 이것도 저것도 아니면, 역시 회선 문제란 말인가?--서명 없는데...