Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At the moment my server is lagging pretty bad, and it crashes. It's a dedicated server which has run completely fine last two days.

What does this command do?

netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more

This I what I get:

    154 76.217.x.xx
     11 79.51.xx.xxx
     10 174.119.xx.xx
      9 201.230.xxx.xxx
      8 24.184.xx.xxx
      8 127.0.0.1
      6 50.51.xxx.xxx
      6 216.121.xxx.xxx
      4 80.203.xx.xxx
      4 24.186.xxx.xxx
      4 223.25.xx.xxx
      4 119.93.xx.xx

What does the number beside the IP mean? Does it mean connections? If so... the top IP is ddosing me?

share|improve this question
3  
There are 228 connections this doesn't look like a DoS attack let alone a DDoS attack. What is your I/O, CPU, memory, webserver, applictaion doing ? –  Iain Aug 5 '11 at 15:23
2  
Yeah, that was me. Sorry. But seriously 228 connections is nothing. You have an issue on your web server. –  Jacob Aug 5 '11 at 15:38
    
@Jacob - you're a bad, bad man. Haven't you learned your lesson from that 500 connection DoS against Google? –  voretaq7 Aug 5 '11 at 15:48
1  
may want to also check 443(?) connections for https as well, as its also a web port. –  Jimsmithkka Aug 5 '11 at 16:43
    
Are you sure your site didn't get listed on digg/slashdot/reddit/.... –  Zoredache Aug 5 '11 at 16:45

3 Answers 3

  • netstat print network connections
  • -n show numerical address
  • grep :80 filter connections connect to port 80
  • cut -c 45- get only 4th and 5th column
  • cut -d: -f1 take the first field separate by colon
  • sort | uniq -c sort by IP address and count the numbers of unique IP
  • sort -rn reverse the numerical sort

You can use awk instead of cut -c 45- to get the 5th column only:

netstat -n | grep :80 | awk '{ print $5 }' | cut -d: -f1 | sort | uniq -c | sort -rn | head

About your result, it seems normal, no DDoS. Take a look at access_log for more details.

share|improve this answer
2  
+1, although <pedant> sort -rn is a reversed numerical sort` </pedant> –  SmallClanger Aug 5 '11 at 15:44
    
More pedantry: cut -c 45- grabs from the 45th character to the end of the line. –  Ladadadada Dec 11 '11 at 10:43

Quanta & DTest explained what the command does. Everyone will tell you that a few hundred connections does not a DoS make (talk to me when you have at least 5-10 thousand), and I'll expand on that by saying that in order for it to be a DDos you'd be seeing a lot more entries (probably with a lot more connections each) than what you're showing above.


When you have a problem with a server DO NOT jump to the exotic causes (DDoS, Cosmic Rays, Z0MG H4X0R3D!, etc.) -- Chances are you have a far more boring and mundane problem.

You say "it crashes" -- do you mean the whole server locks up, panics or otherwise requires a hard reboot?
If so, check your RAM (MemTest86+ or similar). That's usually the issue.

If it's not a real, hard crash start looking at the normal mundane troubleshooting items:

  • Run top
    • What is the load average? What is it when you have a problem?
    • How much swap are you using? Are you using more when you have a problem? (If so, memory leak!)
    • What programs are trying to get on the CPU?
  • Run your operating system's disk I/O information tools (Not a Debian guy, maybe someone can list 'em?)
    • Are you disk bound? (is the disk constantly using 100% of its bandwidth?)
  • Look at your network statistics
    • Are you hitting a bandwidth cap from your ISP?
  • Look at your ancillary programs, if applicable
    • Database Connections
    • Shared File Systems
    • Any other resource that may be locked/blocking when you need it
share|improve this answer
    
+1: except in cases of being hacked with vast numbers of cosmic rays, this is solid advice. –  Sirex Aug 5 '11 at 17:25
    
@voretaq7 Thanks for the guide. I found this in the error log: [Fri Aug 05 05:31:58 2011] [error] [client 91.194.219.139] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:) –  Muazam Aug 6 '11 at 3:09

The number is the number of unique entries for each ip (generated by uniq -c)

netstat -n will give you all the current network traffic, which you then pipe to grep :80, which only grabs connections on your web server. Next we cut out the leading part of the line with cut -c 45-, and then everything after the IP (starting at the colon) with cut -f 1 -d ':' then we sort it, get the unique IPs with a count (uniq -c) and then sort it in reverse order so the most IPs appear at the top.

This doesn't necessarily mean you are getting DDoS'd because the majority of traffic is coming from a single IP. Someone might be crawling your site for content or some other reason.

share|improve this answer
    
unique entries as? –  Muazam Aug 5 '11 at 15:00
    
@Muazam Number of 'active connections' at the time the 'netstat -n' command was run. –  DTest Aug 5 '11 at 15:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.