Recently I noticed that the CPU load of my server is increasing rapidly. In any day, the CPU load does not reach 2.5. I have the following server:
Intel® Xeon® E3-1270 v2 Single Processor - Quad Core Dedicated Server
CPU Speed: 4 x 3.5 Ghz w/ 8MB Smart Cache
Motherboard: SuperMicro X9SCM-F
Total Cores: 4 Cores + 8 Threads
RAM: 32 GB DDR3 1333 ECC
Hard Drive: 120GB
Smart Cache: 8MB
When the server reaches 4.5, I immediately logon to my server using ssh and issue this command netstat -na |grep :80 |wc -l
to see how many connection I have. To my surprise it reaches more than 950 connections.
When I look into the IP address by issuing this command netstat -na |grep :80
, I saw that there this ip 210.4.99.44
is consuming more than 600 connections.
When I look into the access.log I found the following for this IP address:
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /java/4552/sites/all/modules/ctools/css/ctools.css HTTP/1.0" 200 59506 "http://www.mysite.com/java/4552/site$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /forums/programming/c/sites/all/themes/arras/custom.css HTTP/1.0" 404 24875 "http://www.mysite.com/forums/pr$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /comment/reply/3673/21593/misc/drupal.js HTTP/1.0" 200 32289 "http://www.mysite.com/comment/reply/3673/21593$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /forums/programming/c/sites/all/themes/arras/arras.css HTTP/1.0" 404 25012 "http://www.mysite.com/forums/pro$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /forums/programming/c/sites/all/themes/arras/arras-blue.css HTTP/1.0" 404 24921 "http://www.mysite.com/forum$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /comment/reply/3673/21593/modules/system/system.messages.css HTTP/1.0" 200 32507 "http://www.mysite.com/comm$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /comment/reply/3673/21593/modules/system/system.theme.css HTTP/1.0" 200 32691 "http://www.mysite.com/comment$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /comment/reply/3673/21593/modules/user/user.css HTTP/1.0" 200 32378 "http://www.mysite.com/comment/reply/367$
210.4.99.44 - - [06/Jul/2013:10:59:23 +0800] "GET /comment/reply/3673/21593/misc/jquery.once.js HTTP/1.0" 200 32586 "http://www.mysite.com/comment/reply/3673/$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /comment/reply/3673/21593/misc/textarea.js HTTP/1.0" 200 32543 "http://www.mysite.com/comment/reply/3673/215$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /forums/programming/c/sites/all/modules/views/css/views.css HTTP/1.0" 404 24931 "http://www.mysite.com/forum$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /comment/reply/3673/21593/misc/jquery.js HTTP/1.0" 200 32424 "http://www.mysite.com/comment/reply/3673/21593$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /comment/reply/3673/21593/modules/comment/comment.css HTTP/1.0" 200 32556 "http://www.mysite.com/comment/rep$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /forums/programming/c/sites/all/modules/video_filter/video_filter.css HTTP/1.0" 404 24868 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:24 +0800] "GET /comment/reply/3673/21593/modules/system/system.base.css HTTP/1.0" 200 32663 "http://www.mysite.com/comment/$
210.4.99.44 - - [06/Jul/2013:10:59:29 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/ie6.css HTTP/1.0" 404 24973 "http://www.mysite.co$
210.4.99.44 - - [06/Jul/2013:10:59:29 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/arras-blue.css HTTP/1.0" 404 24048 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:29 +0800] "GET /forums/programming/c/c/sites/all/modules/ctools/css/ctools.css HTTP/1.0" 404 24945 "http://www.mysite.com/f$
210.4.99.44 - - [06/Jul/2013:10:59:29 +0800] "GET /forums/programming/visual-basic-60/sites/all/modules/video_filter/video_filter.css HTTP/1.0" 404 25067 "http://www.$
210.4.99.44 - - [06/Jul/2013:10:59:33 +0800] "GET /sites/default/files/download/donk90/file1.zip HTTP/1.0" 200 133016 "http://www.mysite.com/sites/default/fi$
210.4.99.44 - - [06/Jul/2013:10:59:34 +0800] "GET /forums/programming/c/c/misc/jquery.js HTTP/1.0" 404 24918 "http://www.mysite.com/forums/programming/c/c/mis$
210.4.99.44 - - [06/Jul/2013:10:59:34 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/suckerfish.css HTTP/1.0" 404 25088 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:34 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/custom.css HTTP/1.0" 404 24853 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:34 +0800] "GET /forums/programming/c/c/misc/drupal.js HTTP/1.0" 404 25001 "http://www.mysite.com/forums/programming/c/c/mis$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/html-elements.css HTTP/1.0" 404 24943 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/user/user.css HTTP/1.0" 404 25182 "http://www.mysite.com/forums/$210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/arras.css HTTP/1.0" 404 24962 "http://www.mysite.$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/themes/arras/geshifilter-languages.css HTTP/1.0" 404 24957 "http://www$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/public:/geshi/geshifilter-languages.css HTTP/1.0" 404 24855 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/modules/geshifilter/geshifilter.css HTTP/1.0" 404 25081 "http://www.so$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/system/system.base.css HTTP/1.0" 404 24883 "http://www.mysite.co$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/system/system.menus.css HTTP/1.0" 404 25044 "http://www.mysite.c$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/modules/views/css/views.css HTTP/1.0" 404 24914 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/field/theme/field.css HTTP/1.0" 404 24926 "http://www.mysite.com$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/system/system.messages.css HTTP/1.0" 404 24976 "http://www.mysiteste$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/sites/all/modules/ctools/css/ctools.css HTTP/1.0" 404 24960 "http://www.mysite$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/system/system.theme.css HTTP/1.0" 404 25088 "http://www.mysite.c$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/book/book.css HTTP/1.0" 404 24941 "http://www.mysite.com/forums/$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/forum/forum.css HTTP/1.0" 404 24989 "http://www.mysite.com/forum$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/misc/jquery.once.js HTTP/1.0" 404 24950 "http://www.mysite.com/forums/pr$
210.4.99.44 - - [06/Jul/2013:10:59:35 +0800] "GET /forums/programming/visual-basic-60/modules/node/node.css HTTP/1.0" 404 24970 "http://www.mysite.com/forums/$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /forums/programming/visual-basic-60/modules/poll/poll.css HTTP/1.0" 404 25049 "http://www.mysite.com/forums/$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /forums/programming/visual-basic-60/misc/drupal.js HTTP/1.0" 404 24885 "http://www.mysite.com/forums/program$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /users/jvidals/sites/all/themes/arras/ie6.css HTTP/1.0" 404 24955 "http://www.mysite.com/users/jvidals/sites$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /forums/programming/visual-basic-60/modules/comment/comment.css HTTP/1.0" 404 24889 "http://www.mysite.com/f$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /forums/programming/visual-basic-60/misc/jquery.js HTTP/1.0" 404 24928 "http://www.mysite.com/forums/program$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /users/jvidals/sites/all/themes/arras/suckerfish.js HTTP/1.0" 404 24915 "http://www.mysite.com/users/jvidals$
210.4.99.44 - - [06/Jul/2013:10:59:36 +0800] "GET /users/jvidals/sites/all/themes/arras/suckerfish.css HTTP/1.0" 404 24946 "http://www.mysite.com/users/jvidal$
210.4.99.44 - - [06/Jul/2013:10:59:38 +0800] "GET /sites/default/files/download/VincentProgrammer/phonebook.zip HTTP/1.0" 200 46500 "http://www.mysite.com/sit$
210.4.99.44 - - [06/Jul/2013:10:59:47 +0800] "GET /java/4552/misc/jquery.js HTTP/1.0" 200 45624 "http://www.mysite.com/java/4552/misc" "WE 9.50"
210.4.99.44 - - [06/Jul/2013:10:59:53 +0800] "GET /tutorials/php/php-tutorial.html HTTP/1.0" 200 45632 "http://www.mysite.com/comment/reply/3673/sites/all/the$
210.4.99.44 - - [06/Jul/2013:10:59:54 +0800] "GET /tutorials/php/php-tutorial.html HTTP/1.0" 200 45640 "http://www.mysite.com/comment/reply/3673/sites/all/mod$
210.4.99.44 - - [06/Jul/2013:10:59:58 +0800] "GET /tutorials/php/php-tutorial.html HTTP/1.0" 200 45640 "http://www.mysite.com/comment/reply/3673/modules/field$
210.4.99.44 - - [06/Jul/2013:11:00:26 +0800] "GET /sites/default/files/download/user/voting_system.zip HTTP/1.0" 200 1227639 "http://www.mysite$
Note that this is just a few sample pages that this IP address is accessing.
I hurriedly block the IP address using iptables and the CPU load drops quickly to 0.8...
Is this some form of a DDOS attack?
I thought that a DDOS attack is coming from different IP Addresses, but what happen to me is there is only one IP address. And also I thought that a DDOS attack just send a packet using ping command. But the log in my server seems that the IP address is opening a web page on my site (just like a normal visitor), those it does not ping my server.
The IP address does not stop sending request for almost two hours until I block it.
So what kind of attack is this? And what tools they are using? I am thinking that this is an "ab" benchmarking tool. But I haven't tried it yet so I can't make sure they are using that.
BTW, after blocking this IP address, the connection drops to 280 something. So I believe that this IP is really attacking my server.
Any help please.