My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast.
However, the server appears to sometimes have "SYN flooding" attacks. I really believe/suspect these are intentional and not caused by our legit users. (as they appear to happen when there are some individuals that register new accounts and try to cause trouble)
Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.
Unfortunately, when that happens, my whole traffic is affected:
[Mon Jun 27 22:15:28.842067 2016] [mpm_event:error] [pid 12022:tid 132875292207712] AH00485: scoreboard is full, not at MaxRequestWorkers
My MaxRequestWorkers is 600. I have increased it a few times in the past.
Recently I also have increased
ListenBackLog to 5000.
My server has 16GB RAM and 1 Gbps bandwidth.
I am not really happy that there appears to be someone that can easily control whether my website is alive or not.
What can one do to stop this?
netstat seems to give me the IPs connected to the server right now.
Is it possible to get the top IPs at a given time in the past?