Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Apache is listening on port 80.

I have a script doing a curl on a small static image and timing the response. It normally takes 0.04 secs but on 6 out of 10 requests it takes anywhere from 2 to 20 secs.

If I change the port to 81 all requests are fast.

Do you have any idea what can cause something like that?

Edit: Another weird thing is that "telnet 127.0.0.1 80" again often takes 3-20 secs. Port 81 answers at once.

share|improve this question
add comment

4 Answers

How busy is Apache and how what is your MaxClients set at? If you are receiving a lot of incoming requests and have a low MaxClients then some requests will be delayed until an Apache child thread eventually becomes available to serve it. You can enable mod_status to get a live view of Apache requests and what each child is doing. It should tell you pretty quickly if all children are busy or not.

If it is a specific port 80 issue you can check iptables --list to see if there are any port 80 related rules that might be coming into play. It is also possible the issue is with something between your client and server (or on your client itself). Try performing some benchmarks locally on the server to see if there's any similar performance issues.

share|improve this answer
add comment

This is almost certainly a network issue and not a problem with your Apache configuration.

Port 80 traffic is probably being filtered or queued somewhere between you and the target system. Perhaps there is a proxy or other caching server in action. Port 81 traffic would naturally bypass any restrictions or special conditions placed on "normal" web traffic.

share|improve this answer
add comment

Do you have hostname lookup turned Off in Apache?

HostnameLookups Off

Unrelated but this can probably help you learn about basic Apache optimization

share|improve this answer
add comment
up vote 1 down vote accepted

This was a SYN flood attack. The way to check this is by issuing

ss -t -a |grep SYN-RECV

I resolved this by enabling SYN cookies

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.