You will need to dig deeper in the what is going on to see if the traffic is legitimate.
Legit Traffic
Legitimate bots can be identified by their user agents. Checking the IP's owner or reverse DNS can often help pinpoint spoofed user agent data.
I have seen Googlebot, Yahoo's Slurp and other spiders create 40+ connections to a system.
Note that browsers can make up to 20 connections (I think the default is around 8) to a server. If you have several users behind a NAT, they could easily use up 20-40 connections.
Signs of DDoS
I have seen DDoS attacks us a low level of connections but from a wide range of IP addresses. For example, the attackers will typically have no more than 100 connections to the server but from dozens or even hundreds of IPs.
This tactic is used to undermine certain rate limiting methods available to block HTTP floods.
In these cases, I take the top offending IPs and look at several items:
- what country do they originate (IP Whois)
- do they come from the same class C/B network
- what are they accessing (check apache logs)
- do they appear to have normal user behavior
- commonalities in user-agent strings
For example, during a recent DDoS mitigation, we identified that the platform doing the attack identified itself as a specific browser/language combination. Providing a rule to drop these requests eliminated 60% of the attack.
In another case, I discovered that about 50% of the attacking IPs were assigned to one region in China. Using country specific IP blocks, we were able to drop this traffic.
So digging into the top IPs should quickly tell you if you should allow it or block it.
netstat -anp | awk '$4 ~ /:80 / {print $5,$6}' | grep ESTABLISHED | cut -d: -f1 | sort | uniq -c | sort -n
grep ESTABLISHED
might be a good idea. An avid user of a site can easily cause dozens of connections in the TIME_WAIT state and this is rarely anything to be concerned about.