Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I want to sign up with CloudFlare to stop the attack, but I don't know what specific site is being attacked. As one precaution, I've moved the 4 sites I think it could be to different IP's on my server.

I'm using this command to get the IP's and # of occurances:

netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':' '{print $1}' | sort | uniq -c | sort -n

So, is there any way to show what specific website they're on?

share|improve this question

closed as not constructive by mdpc, Ward, Dennis Kaarsemaker, Grant, MDMarra Jun 6 '13 at 21:06

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Have you checked the Apache logs? – j883376 Jun 6 '13 at 2:06
Have you researched the extensive archives here and on other SE machines for dealing with attacks on your server? – mdpc Jun 6 '13 at 2:54

No, netstat can't tell you that; it works on a level below Apache.

Apache will have to tell you which sites are being hit, generally through the logging mechanism.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.