어제 오늘 웹서버에 트래픽이 몰리면서 전체 네트웍이 극심하게 느려지고 있습니다. 망 담당자의 말에 따르면 비대칭라인(다운 2M, 업 512)이기 때문에 업로드 트래픽의 영향을 많이 받을 수 있답니다. 아래와 같이 SYN_RECV 가 자주 보입니다. ip가 유효한 것으로 보아 악의적인 공격은 아닌것 같은데.. [root@LOCAL /root]## netstat -na Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 LOCAL_HOST:80 211.185.224.80:35650 ESTABLISHED tcp 0 59352 LOCAL_HOST:80 141.223.180.14:48235 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.220.204.159:2519 ESTABLISHED tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3770 ESTABLISHED tcp 0 497 LOCAL_HOST:80 211.187.15.191:3204 ESTABLISHED tcp 0 57974 LOCAL_HOST:80 211.207.200.157:1287 ESTABLISHED tcp 0 27444 LOCAL_HOST:80 211.187.15.191:3203 FIN_WAIT1 tcp 0 59532 LOCAL_HOST:80 211.248.167.62:62518 ESTABLISHED tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3768 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.185.44.88:1889 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 68.81.121.35:4173 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 203.231.85.250:3056 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 210.217.227.73:1210 ESTABLISHED tcp 0 58560 LOCAL_HOST:80 211.37.206.94:1410 ESTABLISHED tcp 0 0 LOCAL_HOST:80 210.183.177.20:33844 FIN_WAIT2 tcp 0 58800 LOCAL_HOST:80 61.72.9.73:10147 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.114.22.18:37648 ESTABLISHED tcp 0 0 LOCAL_HOST:80 210.183.177.20:33768 FIN_WAIT2 tcp 0 59532 LOCAL_HOST:80 211.61.64.205:2341 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.112.156.7:38809 ESTABLISHED tcp 0 58168 LOCAL_HOST:80 211.105.41.106:2437 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 210.104.161.200:57402 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.40.49.51:64859 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 61.248.134.32:4052 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 210.180.210.2:52388 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.114.22.18:36859 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 152.149.158.199:3741 ESTABLISHED tcp 0 59040 LOCAL_HOST:80 211.34.7.3:34878 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1158 ESTABLISHED tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1028 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.228.227.227:65287 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 203.225.57.16:1624 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 61.35.255.4:53385 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.108.228.62:1199 ESTABLISHED tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1026 ESTABLISHED tcp 0 59040 LOCAL_HOST:80 203.244.220.37:9426 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1153 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 203.244.197.254:42086 ESTABLISHED tcp 1 57905 LOCAL_HOST:80 203.241.146.2:1672 LAST_ACK tcp 0 59532 LOCAL_HOST:80 210.100.146.1:1084 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 218.48.222.144:1288 ESTABLISHED tcp 0 58168 LOCAL_HOST:80 210.221.122.38:32867 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 219.241.138.76:1317 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 211.241.250.125:1741 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 210.115.222.2:44683 ESTABLISHED tcp 0 59532 LOCAL_HOST:80 203.244.197.254:36488 ESTABLISHED tcp 0 34838 LOCAL_HOST:80 218.144.236.85:2380 FIN_WAIT1 tcp 0 58321 LOCAL_HOST:80 61.43.104.128:1375 FIN_WAIT1 tcp 1 59533 LOCAL_HOST:80 210.222.36.10:1709 LAST_ACK tcp 0 58561 LOCAL_HOST:80 210.125.161.136:1827 FIN_WAIT1 tcp 1 59041 LOCAL_HOST:80 211.115.147.67:47549 LAST_ACK tcp 1 59361 LOCAL_HOST:80 211.115.147.67:47486 LAST_ACK tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN tcp 0 0 LOCAL_HOST:80 211.225.68.228:2512 SYN_RECV tcp 0 0 LOCAL_HOST:80 61.74.117.17:2329 SYN_RECV tcp 0 0 LOCAL_HOST:80 211.51.169.153:2380 SYN_RECV tcp 0 0 LOCAL_HOST:80 0.0.0.0:* LISTEN tcp 0 0 LOCAL_HOST:53 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:113 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:161 0.0.0.0:* udp 0 0 0.0.0.0:1024 0.0.0.0:* udp 0 0 LOCAL_HOST:53 0.0.0.0:* udp 0 0 127.0.0.1:53 0.0.0.0:* raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0:* 7 Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 0 [ ACC ] STREAM LISTENING 570 /tmp/mysql.sock unix 0 [ ] STREAM CONNECTED 176 @00000018 unix 7 [ ] DGRAM 362 /dev/log unix 0 [ ACC ] STREAM LISTENING 446 /var/run/ndc unix 0 [ ] DGRAM 104992 unix 0 [ ] DGRAM 68748 unix 0 [ ] DGRAM 56169 unix 0 [ ] DGRAM 56164 unix 0 [ ] DGRAM 444 unix 0 [ ] DGRAM 384 unix 0 [ ] DGRAM 372 [root@LOCAL /root]## sysctl -a | grep syn net.ipv4.vs.timeout_synack = 100 net.ipv4.vs.timeout_synrecv = 10 net.ipv4.vs.timeout_synsent = 60 net.ipv4.tcp_max_syn_backlog = 1024 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_syn_retries = 10 syn backlog도 늘려줬고, syncookies 옵션도 올렸고.. 현재 업로드 트래픽이 50~70KB에 달하고 있습니다. 아파치의 설정을 바꿔서 이 문제를 헤쳐나갈 방법이 없을까요? 현재는 설치시의 초기값을 유지하고 있습니다. Timeout 300 KeepAlive On MaxKeepAliveRequests 100 KeepAliveTimeout 15 -- 이것도 저것도 아니면, 역시 회선 문제란 말인가?
![[TOP]](/images/color///top.gif){kind=small}
RE: 웹서버 트래픽 증가 (SYN_RECV) 
![[ 적수네 동네 ]](/images/button/lsn.gif){kind=small}
![[ 리눅스 상표권 독점 반대 ]](/images/button/savelinux.gif){kind=small}
![[ 한글 리눅스 문서 프로젝트 ]](/images/button/kldp1.gif){kind=small}
![[ KrLine ]](/images/button/linux01.gif){kind=small}
![[ 사랑넷 ]](/images/button/sarangnet.jpg){kind=small}
![[ Valid HTML 4.0! ]](/images/button/w3.gif){kind=small}
![[ SlashDot ]](/images/button/slashbutton.gif){kind=small}
![[ Freshmeat ]](/images/button/freshmeat.gif){kind=small}