I have an Apache 2 server running PHP5, prefork MPM, eaccelerator and modevasive.
My server sometimes goes down, apparently due to flooding from some IPs. At least this is what I understand from running netstat. I get things like this :
tcp 0 0 my.ip.is.here:80 88.160.126.117:55864 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:57073 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:56989 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57813 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57695 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:57274 ESTABLISHED
tcp 602 0 my.ip.is.here:80 80.214.0.41:51131 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:57513 ESTABLISHED
tcp 0 0 my.ip.is.here:80 77.88.31.248:64551 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:55131 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57565 ESTABLISHED
tcp 357 0 my.ip.is.here:80 209.85.228.92:51134 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57817 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:53902 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:57060 ESTABLISHED
tcp 718 0 my.ip.is.here:80 82.252.2.103:49506 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57553 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57692 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:55571 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57762 ESTABLISHED
tcp 639 0 my.ip.is.here:80 88.160.126.117:57771 ESTABLISHED
tcp 1750 0 my.ip.is.here:80 41.105.112.207:19940 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:57187 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:56782 ESTABLISHED
tcp 668 0 my.ip.is.here:80 86.72.212.166:64263 ESTABLISHED
tcp 750 0 my.ip.is.here:80 88.160.126.117:57681 ESTABLISHED
tcp 0 0 my.ip.is.here:80 88.160.126.117:56741 ESTABLISHED
so it looks like 88.160.126.117 is flooding my server. (It's a different IP everytime, so I can't manually block it) Mod_evasive does log this IP in its log, but does not stop this problem at all!
Even when I restart apache2, networking, the server gets stuck again reaching its maxclients setting.
Any idea what I may do?
My modevasive configuration is:
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 20
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10