How to find the count of Apache workers' at a given point for shared IPs?

Question

One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing:

netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc -l

This is useful during a DDoS attack, for example. From this one can determine if one's counter measures are being effective in reducing the number of Apache workers' being spawned to handle too much traffic, etc.

Recently I was faced with a situation where there was an attack on a shared IP address and I was not readily able to find which user was consuming the most Apache workers. How can one determine such a value?

It has been suggested I watch for traffic per user, but that does not seem to really give the answer I'm looking for when there are a large number of workers being spawned that are creating a deadlock and so I got to the point where I am trying to isolate the worker ownership on a per user basis.

Answer 1

you could be parsing the mod_status w/ExtendedStatus On output. This is the real-time state of all workers/threads/children. plus SSL.

Beware, this makes it hard to track actual request counts if the server is responding fast (you don't see what happens between status reloads - only the most recent request of a worker).

curl 'http://localhost/server-status' | perl -ne 'print "$1\n" if m~<td nowrap>(.*?)</td>.*</td></tr>~ ' | sort | uniq -c | sort -n

or going hardcore grep for 'Host:' headers in tcpdump sniff - this doesnt give a real-time worker count but shows the live server stream - so you have to do your own (sort|uniq|sort) sampling if it scrolls too fast - but you get to see ALL requests served asked. Take care, it's not a safe parser though (headers/packets can be garbled etc)

tcpdump -qlnpA dst port 80 | egrep '^Host:'

you can go fancy with that tcpdump, like

tcpdump -qlnpA dst port 80 | egrep -e '^Host:' -e '(GET|POST)\s.*HTTP'

Answer 2

if you don't grep for the server IP, you may be able to tell just by looking at the output. If not, you can use sed to get just the client IP, then use sort and uniq -c to get counts, but it'll be easier to maintain a script.