Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I also disable apache and tried to update something using yum and also tested lynx -dump test.com and it's taking a lot of time to make the dump.

after executing this command

netstat -an |grep ESTABLISHED

I got a lot of connections like this

udp 0 0 here.my.ip.number:52644 ip.109.188.1:53 ESTABLISHED

udp 0 0 here.my.ip.number:52782 ip.109.188.1:53 ESTABLISHED

udp 0 0 here.my.ip.number:53573 ip.109.188.1:53 ESTABLISHED

I think this ip is an attacker I tried to block using iptables

/sbin/iptables -I INPUT -s ip.109.188.1 -j DROP

but I still see it when I use netstat.

everytime I restart apache process fill up really fast but memory is fine, I still have 2gb free but around 200 sleeping processes.

Please help me anyone, my website is down for several hours, this is driving me crazy and my host Godaddy couldn't help me. They said it was my database. I'm using VPS and centos 5.

share|improve this question
1  
To me it seems that your VPS is initiating connections to ip.109.188.1:53 and this is not about incoming connections. Is ip.109.188.1 the forwarding DNS server configured by coincidence? (see /etc/resolv.conf) And please provide some output of netstat -anp (p for process). –  gertvdijk Nov 23 '12 at 1:05
    
Those are outbound DNS queries FROM your server TO an external DNS server. –  joeqwerty Nov 23 '12 at 1:07
    
Guys thanks for the help, I almost lost my mind today. I wanna kill Godaddy right now. It's all their fault. Their dns resolver just sucks and they told me there was nothing wrong with the network. I changed to google ip 8.8.8.8 and 8.8.4.4. Now it works. I think they do this on purpose to force people to upgrade. When you restart the machine their junk resolver goes back. I need a permanent fix right now. I also can't use my email I guess. –  Victor Nov 23 '12 at 1:47
1  
Make sure your Apache httpd.conf file includes this directive: HostnameLookups Off –  platforms Nov 23 '12 at 6:20
add comment

1 Answer

This is not a DDoS attack (probably). Rather, your server is simply making an excessive number of outbound DNS queries.

While these will build up if you are trying to use a slow resolver to query lots of names, the root cause is likely that you are running a service which is doing rDNS queries on a lot of traffic.

The specific reason for these queries depends on what your server is being used for, but common causes are SMTP servers (checking rDNS to see whether it matches the presented hostname or looks dynamic, for spam filtering), and IRC daemons (to determine hostmasks). Apache, too, can cause these queries (use the HostnameLookups Off directive as mentioned in the comments to disable it).

Depending on the content of the DNS queries, it might also indicate that you have malware on your host which is querying DNS, though this is one of the least likely causes.

To determine the process responsible for opening these connections, add the -p option to netstat and observe which process is associated with the connections with an outbound port of UDP/53.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.