One can find the number of Apache workers an IP address is consuming at an instantaneous point in time by executing:

netstat -pantu | grep :80 |sort | uniq -c |grep <IP_HERE, eg: 192.168> | wc -l

This is useful during a DDoS attack, for example. From this one can determine if one's counter measures are being effective in reducing the number of Apache workers' being spawned to handle too much traffic, etc.

Recently I was faced with a situation where there was an attack on a shared IP address and I was not readily able to find which user was consuming the most Apache workers. How can one determine such a value?

It has been suggested I watch for traffic per user, but that does not seem to really give the answer I'm looking for when there are a large number of workers being spawned that are creating a deadlock and so I got to the point where I am trying to isolate the worker ownership on a per user basis.

  • You don't really want to know a count of Apache workers. You want to know which user attracted the DDoS. May 25 '14 at 17:15
  • I want to know the apache workers to that I can know which user is being DDoS'd. Traffic hasn't seemed to be a valid indicator as, last time, most of the workers were hung and traffic gave no indication. Is there another way of isolating the user being DDoS'd in a shared IP setting?
    – ylluminate
    May 25 '14 at 17:44

you could be parsing the mod_status w/ExtendedStatus On output. This is the real-time state of all workers/threads/children. plus SSL.

Beware, this makes it hard to track actual request counts if the server is responding fast (you don't see what happens between status reloads - only the most recent request of a worker).

curl 'http://localhost/server-status' | perl -ne 'print "$1\n" if m~<td nowrap>(.*?)</td>.*</td></tr>~ ' | sort | uniq -c | sort -n

or going hardcore grep for 'Host:' headers in tcpdump sniff - this doesnt give a real-time worker count but shows the live server stream - so you have to do your own (sort|uniq|sort) sampling if it scrolls too fast - but you get to see ALL requests served asked. Take care, it's not a safe parser though (headers/packets can be garbled etc)

tcpdump -qlnpA dst port 80 | egrep '^Host:'

you can go fancy with that tcpdump, like

tcpdump -qlnpA dst port 80 | egrep -e '^Host:' -e '(GET|POST)\s.*HTTP'

if you don't grep for the server IP, you may be able to tell just by looking at the output. If not, you can use sed to get just the client IP, then use sort and uniq -c to get counts, but it'll be easier to maintain a script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.