This question already has an answer here:
- I am under DDoS. What can I do? 1 answer
My server has been down most of the day, running top shows several Apache processes (httpd) each one using 70% or more of the CPU, and MySql eating almost all memory.
I have tried rebooting the server, restarting the services and each time the situations goes back to the same.
netstat -n | grep :80 | wc -l
to see the number of connections open to the web server shows around 600 at some points.
That made my think I'm under a DDOS but when I run
There is a tons of connections (more than 200) that look like this:
tcp 0 0 mail.my-domain.com:tproxy mail.my-domain.com:55907 TIME_WAIT
tcp 0 0 mail.my-domain.com:tproxy mail.my-domain.com:55687 TIME_WAIT
tcp 0 0 mail.my-domain.com:tproxy mail.my-domain.com:55733 TIME_WAIT
tcp 0 0 mail.my-domain.com:tproxy mail.my-domain.com:55909 TIME_WAIT
tcp 0 0 mail.my-domain.com:tproxy mail.my-domain.com:55893 TIME_WAIT
Why could be my mail subdomain opening so many HTTP connections?
My mail server is EXIM, when I check "SHOW PROCESSLIST" on MySQL all that I see is bunch of Sleep commands running.
What can I do? I'm running out of ideas, PLEASE help!