I am running CentOS 6 with http -2.2.15

Going under HTTP attack, i can see many http process running.

> netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
>       1 established)
>       1 Foreign
>       2 LAST_ACK
>      11 LISTEN
>      15 FIN_WAIT2
>      19 CLOSING
>      27 FIN_WAIT1
>      91 SYN_RECV
>   10399 TIME_WAIT

Count of all connections:

netstat -an | grep :80 | wc -l

Count all unique IP address:

netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l

Please, advice what we could do to find out who is making the most connects?

PS: server load has not been affected by this attack though.

Thanks for any assistance.

  • Perhaps you have that many blank lines in the output? – user160910 Jul 11 '13 at 13:39
  • 1
    Try adding grep -v '^$'| before the uniq -c to remove blank lines. – user160910 Jul 11 '13 at 13:46
  • Adding grep -v '^$'| hides the 10237 line. Looks normal now, but still truth is total number of connections is 10533. It's attack ? – Evan Hamlet Jul 11 '13 at 13:56
  • Ok, got it... it was just formatting problem. removed cut to check. Please advice how to mitigate this http attack. Thanks – Evan Hamlet Jul 11 '13 at 14:03
  • There is no way for me to know if this is an attack for sure with this info. It looks like a lot of connections have closed, but are still waiting for a final transmission (TIME WAIT). Do these numbers persist? – user160910 Jul 11 '13 at 14:17

These are blank lines being counted, adding grep -v '^$' before the uniq in the pipeline will resolve it. It is very possible this is not an attack, but perhaps a software problem. What are your normal numbers? I have seen articles about MySQL 4/5 causing a high number of TIME WAIT state connections. Have you had any new installations or updates,config changes that correspond with the problem?


I can't see any evidence of an attack in the data you have posted here.

The only thing I would consider unusual about those numbers is how slowly TCP connections are opening and closing. I wouldn't expect to see double digits for SYN_RECV, FIN_WAIT1 and FIN_WAIT2. That means that if there is an attack, it's probably not TCP/port 80 based or it's saturating some network pipe which slows down your communications, possibly upstream from your devices.

Look at your bandwidth graphs and ask your hosting provider to look at theirs. If that doesn't show up anything, start looking for malfunctioning networking equipment. If you can see a large spike in bandwidth, extract statistics out of whatever edge networking device you can about the sort of traffic you are seeing.

TIME_WAIT connections are not a problem for you. They only get to be a problem when you have so many of them that you can't open new connections. This threshold is about 30,000 by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.