I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I also disable apache and tried to update something using yum and also tested lynx -dump test.com and it's taking a lot of time to make the dump.
after executing this command
netstat -an |grep ESTABLISHED
I got a lot of connections like this
udp 0 0 here.my.ip.number:52644 ip.109.188.1:53 ESTABLISHED
udp 0 0 here.my.ip.number:52782 ip.109.188.1:53 ESTABLISHED
udp 0 0 here.my.ip.number:53573 ip.109.188.1:53 ESTABLISHED
I think this ip is an attacker I tried to block using iptables
/sbin/iptables -I INPUT -s ip.109.188.1 -j DROP
but I still see it when I use netstat.
everytime I restart apache process fill up really fast but memory is fine, I still have 2gb free but around 200 sleeping processes.
Please help me anyone, my website is down for several hours, this is driving me crazy and my host Godaddy couldn't help me. They said it was my database. I'm using VPS and centos 5.
ip.109.188.1:53
and this is not about incoming connections. Isip.109.188.1
the forwarding DNS server configured by coincidence? (see/etc/resolv.conf
) And please provide some output ofnetstat -anp
(p
for process).httpd.conf
file includes this directive:HostnameLookups Off