0

I have a KVM node I'm running with only 7 VM instances. When GigE uplink port is enabled, server connection goes crazy hitting over 300MBps somehow. I cannot trace which IP is possibly being attacked, or vice versa (it appears in Observium to be outgoing spikes not incoming).

My issue is netstat is not providing any info. I want to know specifically where the connections are coming from, whether in or out and which specific IP, or even VM server.

I'm running Centos 6.8 64bit on the KVM node.

[root@server ~]# netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
[root@server ~]# netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
      3 xxx.xxx.xxx.xxx
      1 8.8.8.8
[root@server ~]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
[root@server ~]# netstat -n -p | grep SYN_REC | sort -u
[root@server ~]# netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'
[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
      1 8.8.8.8
      1 Address
      1 servers)
      4 xxx.xxx.xxx.xxx
[root@server ~]# netstat -an | grep :80 | sort
[root@server ~]# netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more
[root@server ~]# netstat -an | grep ESTABLISHED | awk '\''{print $5}'\'' | awk -F: '\''{print $1}'\'' | sort | uniq -c | awk '\''{ printf("%s\t%s\t",$2,$1); for (i = 0; i < $1; i++) {printf("*")}; print ""}'\''
> ^C
[root@server ~]# netstat -an | grep :80 | sort
[root@server ~]# netstat -n -p|grep SYN_REC | wc -l
0
[root@server ~]# netstat -n -p | grep SYN_REC | sort -u
[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
      1 xxx.xxx.xxx.xxx
      1 Address
      1 servers)
      4 xxx.xxx.xxx.xxx
[root@server ~]# netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
[root@server ~]# netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1
[root@server ~]# 
3
  • If the traffic is outgoing then its not likely being caused by a DDOS attack.
    – Ramhound
    Jul 21 '16 at 18:49
  • @Ramhound it could be a DDoS ... lets say your website has a image file that is 2 meg ... the request for the image is pretty small, but you could totally flood the servers bandwidth by requesting it 100 times a second. Jul 21 '16 at 19:16
  • 2
    netstat is a completely inappropriate tool for this job. Use wireshark or at least iptables logging. ICMP floods, connections to nonexistent ports, traffic blocked by your firewall... there are plenty of kinds of traffic that netstat won't see at all.
    – DerfK
    Jul 21 '16 at 19:31
1

While it is interesting that nothing is showing up in netstat, you could attack this problem from a different angle. If something is sending 300 MB/s it will most likely be chewing up a decent amount of CPU ... try running top and based on the services that are using the most CPU check logs accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.