안녕하세요? Send-Q가 거의 일정한 양으로 커넥이 되어지는 것으로 보아 누군가가 게시판에 와레즈 자료를 올려놓은 것으로 보입니다. 아파치 로그를 살펴보시면 어느 파일을 받고 있는지 알 수 있을 것입니다. 그럼, 불법자료 퇴치하시길~ : 어제 오늘 웹서버에 트래픽이 몰리면서 전체 네트웍이 극심하게 : 느려지고 있습니다. : : 망 담당자의 말에 따르면 비대칭라인(다운 2M, 업 512)이기 때문에 : 업로드 트래픽의 영향을 많이 받을 수 있답니다. : : 아래와 같이 SYN_RECV 가 자주 보입니다. : ip가 유효한 것으로 보아 악의적인 공격은 아닌것 같은데.. : : [root@LOCAL /root]## netstat -na : Active Internet connections (servers and established) : Proto Recv-Q Send-Q Local Address Foreign : Address State : tcp 0 0 LOCAL_HOST:80 211.185.224.80:35650 : ESTABLISHED : tcp 0 59352 LOCAL_HOST:80 141.223.180.14:48235 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.220.204.159:2519 : ESTABLISHED : tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3770 : ESTABLISHED : tcp 0 497 LOCAL_HOST:80 211.187.15.191:3204 : ESTABLISHED : tcp 0 57974 LOCAL_HOST:80 211.207.200.157:1287 : ESTABLISHED : tcp 0 27444 LOCAL_HOST:80 211.187.15.191:3203 : FIN_WAIT1 : tcp 0 59532 LOCAL_HOST:80 211.248.167.62:62518 : ESTABLISHED : tcp 0 57974 LOCAL_HOST:80 211.219.238.192:3768 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.185.44.88:1889 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 68.81.121.35:4173 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 203.231.85.250:3056 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 210.217.227.73:1210 : ESTABLISHED : tcp 0 58560 LOCAL_HOST:80 211.37.206.94:1410 : ESTABLISHED : tcp 0 0 LOCAL_HOST:80 210.183.177.20:33844 : FIN_WAIT2 : tcp 0 58800 LOCAL_HOST:80 61.72.9.73:10147 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.114.22.18:37648 : ESTABLISHED : tcp 0 0 LOCAL_HOST:80 210.183.177.20:33768 : FIN_WAIT2 : tcp 0 59532 LOCAL_HOST:80 211.61.64.205:2341 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.112.156.7:38809 : ESTABLISHED : tcp 0 58168 LOCAL_HOST:80 211.105.41.106:2437 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 210.104.161.200:57402 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.40.49.51:64859 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 61.248.134.32:4052 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 210.180.210.2:52388 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.114.22.18:36859 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 152.149.158.199:3741 : ESTABLISHED : tcp 0 59040 LOCAL_HOST:80 211.34.7.3:34878 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1158 : ESTABLISHED : tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1028 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.228.227.227:65287 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 203.225.57.16:1624 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 61.35.255.4:53385 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.108.228.62:1199 : ESTABLISHED : tcp 0 55660 LOCAL_HOST:80 211.243.215.117:1026 : ESTABLISHED : tcp 0 59040 LOCAL_HOST:80 203.244.220.37:9426 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.209.89.52:1153 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 203.244.197.254:42086 : ESTABLISHED : tcp 1 57905 LOCAL_HOST:80 203.241.146.2:1672 : LAST_ACK : tcp 0 59532 LOCAL_HOST:80 210.100.146.1:1084 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 218.48.222.144:1288 : ESTABLISHED : tcp 0 58168 LOCAL_HOST:80 210.221.122.38:32867 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 219.241.138.76:1317 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 211.241.250.125:1741 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 210.115.222.2:44683 : ESTABLISHED : tcp 0 59532 LOCAL_HOST:80 203.244.197.254:36488 : ESTABLISHED : tcp 0 34838 LOCAL_HOST:80 218.144.236.85:2380 : FIN_WAIT1 : tcp 0 58321 LOCAL_HOST:80 61.43.104.128:1375 : FIN_WAIT1 : tcp 1 59533 LOCAL_HOST:80 210.222.36.10:1709 : LAST_ACK : tcp 0 58561 LOCAL_HOST:80 210.125.161.136:1827 : FIN_WAIT1 : tcp 1 59041 LOCAL_HOST:80 211.115.147.67:47549 : LAST_ACK : tcp 1 59361 LOCAL_HOST:80 211.115.147.67:47486 : LAST_ACK : tcp 0 0 0.0.0.0:110 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:2000 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:21 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:22 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:25 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:3306 0.0.0.0:* : LISTEN : tcp 0 0 LOCAL_HOST:80 211.225.68.228:2512 : SYN_RECV : tcp 0 0 LOCAL_HOST:80 61.74.117.17:2329 : SYN_RECV : tcp 0 0 LOCAL_HOST:80 211.51.169.153:2380 : SYN_RECV : tcp 0 0 LOCAL_HOST:80 0.0.0.0:* : LISTEN : tcp 0 0 LOCAL_HOST:53 0.0.0.0:* : LISTEN : tcp 0 0 127.0.0.1:53 0.0.0.0:* : LISTEN : tcp 0 0 0.0.0.0:113 0.0.0.0:* : LISTEN : udp 0 0 0.0.0.0:161 0.0.0.0:* : udp 0 0 0.0.0.0:1024 0.0.0.0:* : udp 0 0 LOCAL_HOST:53 0.0.0.0:* : udp 0 0 127.0.0.1:53 0.0.0.0:* : raw 0 0 0.0.0.0:1 0.0.0.0:* 7 : raw 0 0 0.0.0.0:6 0.0.0.0:* 7 : Active UNIX domain sockets (servers and established) : Proto RefCnt Flags Type State I-Node Path : unix 0 [ ACC ] STREAM LISTENING : 570 /tmp/mysql.sock : unix 0 [ ] STREAM CONNECTED 176 : @00000018 : unix 7 [ ] DGRAM : 362 /dev/log : unix 0 [ ACC ] STREAM LISTENING : 446 /var/run/ndc : unix 0 [ ] DGRAM 104992 : unix 0 [ ] DGRAM 68748 : unix 0 [ ] DGRAM 56169 : unix 0 [ ] DGRAM 56164 : unix 0 [ ] DGRAM 444 : unix 0 [ ] DGRAM 384 : unix 0 [ ] DGRAM 372 : : : [root@LOCAL /root]## sysctl -a | grep syn : net.ipv4.vs.timeout_synack = 100 : net.ipv4.vs.timeout_synrecv = 10 : net.ipv4.vs.timeout_synsent = 60 : net.ipv4.tcp_max_syn_backlog = 1024 : net.ipv4.tcp_syncookies = 1 : net.ipv4.tcp_syn_retries = 10 : : syn backlog도 늘려줬고, syncookies 옵션도 올렸고.. : : : 현재 업로드 트래픽이 50~70KB에 달하고 있습니다. : : : : 아파치의 설정을 바꿔서 이 문제를 헤쳐나갈 방법이 없을까요? : 현재는 설치시의 초기값을 유지하고 있습니다. : : Timeout 300 : KeepAlive On : MaxKeepAliveRequests 100 : KeepAliveTimeout 15 : : -- : 이것도 저것도 아니면, 역시 회선 문제란 말인가?--서명 없는데...
![[TOP]](/images/color///top.gif){kind=small}
RE: 웹서버 트래픽 증가 (SYN_RECV) 
![[ 적수네 동네 ]](/images/button/lsn.gif){kind=small}
![[ 리눅스 상표권 독점 반대 ]](/images/button/savelinux.gif){kind=small}
![[ 한글 리눅스 문서 프로젝트 ]](/images/button/kldp1.gif){kind=small}
![[ KrLine ]](/images/button/linux01.gif){kind=small}
![[ 사랑넷 ]](/images/button/sarangnet.jpg){kind=small}
![[ Valid HTML 4.0! ]](/images/button/w3.gif){kind=small}
![[ SlashDot ]](/images/button/slashbutton.gif){kind=small}
![[ Freshmeat ]](/images/button/freshmeat.gif){kind=small}