DDOS Attack or Apache Problem or Something Else ?

Portal Home > Knowledgebase > Articles Database > DDOS Attack or Apache Problem or Something Else ?

Posted by ignitionservers, 12-26-2009, 04:44 AM
I'm pretty sure that my server is getting DDOSed. I've tried a number of different things to fix this. Here's what happens: Everyday at sometime or the other the server load starts spiking badly. Apache processes max out [limit is at 500 processes..] and apache finally crashes. Once apache restarts, everything is good again. This happens once or twice a day for a period of 10-20 minutes each time. My apache status reports that average number of requests processed per second is more like 30-40 and might be a little higher at peak times. The server config is: Core2Quad E6600 8GB RAM 2x500 GB HDD The mySQL tuning primer and other stats say that mysql has never maxed out on connections. [140/500 is the max that has been used..] I started using a script to send me some outputs the moment the server load starts spiking but I can't really use it for anything.. not sure what the offending IPs are. I tried using ddos.sh [the ddos banning script thing..] as well as mod_evasive, but that didn't help all that much. Here's a sample output from when things get rough:
Posted by ignitionservers, 12-26-2009, 04:48 AM
top output when system is getting hammered: You see lots of tiny apache processes. Looks very fishy. Any way that I can fix this ?
Posted by ignitionservers, 12-26-2009, 04:50 AM
Here's a top output when everything is normal. There are FAR fewer processes and connections so it DOES look like a DDOS attack. Only problem is I can't see repeated IPs so I don't see how I can block this
Posted by madaboutlinux, 12-26-2009, 05:00 AM
It looks like a website is receiving a lots of connection and needs more CPU power to process the requests which is increasing the server load. Looking at the netstat output it doesn't look like an attack. Why not enable phpsuexec on your server? It will make all those "nobody" processes run under the users ownership and you can easily figure out which website is causing problems.
Posted by laswatech, 12-26-2009, 05:07 AM
Use this command to find out from which ip there are more connections.. ======== netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n ====== You can then use your firewall to block the ip.
Posted by madaboutlinux, 12-26-2009, 05:09 AM
I already did that on the netstat output he provided but it doesn't look like an attack.
Posted by ignitionservers, 12-26-2009, 05:13 AM
I have DDOS Deflate installed so IPs with multiple connections are getting dropped. But this doesn't look like an attack simply because there aren't taht many IPs with multiple connections so I don't know who to block =( I did think about this but this server isn't a shared hosting box. It's my own dedicated server and I've got only two websites running on it. Granted that one of them is doing extremely high traffic levels right now (350,000 hits a day and higher..) but the server load is usually below 1. And then apache suddenly starts spiking for no apparent reason and the thing is, the load doesn't climb slowly and steadily. IT just suddenly peaks out with all the processes getting tied up like that. Also, if you look at the RES column, a lot of these apache processes are just small processes. (less than 1mb in size..) What's that all about ? I really can't interpret this I'll install phpsuexec right now though..
Posted by madaboutlinux, 12-26-2009, 05:19 AM
You need to figure out the actual processes that runs when the load spikes and try to optimize your Apache Or Mysql server in that way. You can check the Apache processes from WHM >> Apache Status option.
Posted by ignitionservers, 12-26-2009, 07:00 AM
That's another problem. This spike is so sharp and sudden that the: /usr/local/apache/bin/apachectl fullstatus fails to give any output. [that's the output visible on the WHM page as well..] My script is supposed to email me the outputs of all the command above but the apachectl fullstatus command never completes. A few minutes later when load is still high but apache has crashed and restarted I DO end up getting an email with the output but that doesn't do anything for me cause the trouble is already over.. =/
Posted by madaboutlinux, 12-26-2009, 07:02 AM
Does it happen at a specific time of the day? If yes, keep monitoring and try to find out what the processes are using the Apache Status.
Posted by TurkReno, 12-26-2009, 07:02 AM
Do you know if it's a specific domain that's being hammered? If so, remove the TLD from your WHM and get something like ConfigServer Firewall installed ASAP. Last edited by TurkReno; 12-26-2009 at 07:03 AM. Reason: Adding specifics
Posted by khunj, 12-26-2009, 07:03 AM
Did you check your Apache logs ? At least you could see what those IP are doing.
Posted by madaboutlinux, 12-26-2009, 07:04 AM
He just have his 2 business websites hosted on the server and can't remove them. He will have to eliminate the problem.
Posted by TurkReno, 12-26-2009, 07:08 AM
If he's getting DDOS'd like the logs state above, then simply doing a tail -f access_log on /usr/local/apache/logs won't say much...however, /usr/local/apache/domlogs/ will say a lot more. From what I did from a DomainTools lookup, you're getting hit from too many places. I would remove the domain from WHM and your attackers will get the point. If you don't want to do that and can't shut the domain down, immediately suspend the account. There's something there that is on the domain that's getting hit hard. Could be a SQL process, could just be a synflood. Just my 2c.
Posted by ignitionservers, 12-26-2009, 07:39 AM
I have been doing tail -f access_log and error_log but didn't really get much info out of them. This problem started on the 20th of December and well it happens twice every day at random times. So I don't really know when to look.. I can't shut the domain down because it's the main business on the server. Or suspend it. I never thought of looking at the domlogs/ so I'll try looking at them the next time this happens. I do always find out about this in a few minutes because the server emails me the moment the load goes up beyond 10.0. So I can look at the logs soon after the problem. I installed APF earlier today [was running only iptables so far..] so lets see if that helps at all. I also have the mySQL query log enabled but there are a few slow queries but nothing to really worry about. Besides, the slow-queries all happened after the time of the crash. None around the time of the problem really.. Also, does it strike anyone as odd: 1. Tons of apache processes with sizes under 1M 2. Out of the total processes, 225 apache connections are in CLOSE_WAIT state. Any info on what could be causing this ? Is it a bad script ? [Cause honestly, nothing has been changed.. so I can't suddenly see something going bad..] Last edited by ignitionservers; 12-26-2009 at 07:43 AM.
Posted by khunj, 12-26-2009, 08:27 AM
Since your connections are in the CLOSE_WAIT state, there must be something in apache logs (requests or errors). You can also use tcpdump to capture those incoming packets on port 80. Ex : capture 500 packets on port 80 to /tmp/dump.cap tcpdump -i port 80 -c 500 -w /tmp/dump.cap
Posted by ignitionservers, 12-26-2009, 09:03 AM
khunj, I will try that and include that output in the crash email that gets sent so that I can get an idea of what's going on. The problem is, due to traffic volume I do check the access_log and error_log but am not able to find any useful info in there really.. =/ Also, no big error messages out of the ordinary really.. Also, here are the relevant sections from my httpd.conf
Posted by TurkReno, 12-26-2009, 09:08 AM
Change to: StartServers 10 MaxSpareServers 15 --- You really should be checking your /usr/local/apache/domlogs/ for the domain that you believe is getting attacked. This will show you where or what they are going after. For two sites, having 600m of MySQL VIRT is pretty high.
Posted by ignitionservers, 12-26-2009, 10:32 AM
I've made those changes. mySQL memory usage keeps fluctuating quite a bit. However, it's always above 500m even at non-peak low-load times. Here's an example from right now:
Posted by madaboutlinux, 12-26-2009, 10:36 AM
Your server is using Swap memory i.e. some processes are definitely resource hog. Have someone look into your server especially your Hosting company.
Posted by ignitionservers, 12-26-2009, 10:47 AM
I remember previously having memory usage issues with a certain CentOS kernel. The server shouldn't really be using that much swap since there's some RAM always available. I don't remember which kernel the problem was related to, but right now the kernel I'm using is:
Posted by madaboutlinux, 12-26-2009, 10:49 AM
There shouldn't be any memory problem with the kernel you are on. As you can see from the top output, your server is using up Swap memory which is bad
Posted by ignitionservers, 12-26-2009, 10:59 AM
Is there any way I can see which processes are using the swap ? I would imagine that the swap being used is probably because at some point of time with the spiking processes the server ran out of memory and had to go to swap.
Posted by madaboutlinux, 12-26-2009, 11:01 AM
Right, and this is what cause server load as well. BTW, there isn't a specific command through which you can check which process is using up physical RAM and which is using Swap. Enable phpsuexec and it will be easy for you to figure out the processes...
Posted by ignitionservers, 12-26-2009, 11:12 AM
Well, the server isn't usually using swap. I found this interesting little python script that'll allow me to see the mem usage when the load spikes. Should let me know which process is hogging the RAM and going into SWAP. The problem is that while apache is being hit by multiple processes, most of these are using very small amounts of RAM which leads me to believe that this is a CLOSE_WAIT kind of attack. cpanel doesn't have phpsuexec support anymore. Only Mod SuPHP so I'll have to go with that. The problem with that is that script parameters change so I'm thinking twice about this, cause this is already a production server and I don't want to change things around too much in-case something breaks.. =/ Lets see what the crash report says about the mem usage when it happens. Note that, though when the previous crash happened, there was still a few hundred megs of free memory left on the server...
Posted by FastServ, 12-26-2009, 12:43 PM
It smells like synflood. Check 'netstat -na | grep SYN'. Also check 'httpd status' and 'httpd fullstatus' if you can during the attack. Synfloods will not show in any logs but will be apparent in all of those commands. Ditch APF (junk) and install CSF. Enable synflood protection and syn rate limiting This should also be pretty obvious on your incoming bandwidth graph at the network port, and could be as small as 1mbit/sec.
Posted by FastServ, 12-26-2009, 12:49 PM
There is 6Gb of cached memory which means at least 6Gb is available for use before swapping occurs. Over time, the kernel will move unused pages to swap even if you are not out if memory, and based on all of his mem outputs I've seen, memory is NOT the problem, and by a long shot.
Posted by ignitionservers, 12-26-2009, 04:44 PM
I agree with you on the memory bit, never seen the memory being fully utilised on this box before. Even during the 'attack' the memory isn't fully used. Also, I just installed APF but I'll look into installing CSF. The problem hasn't re-occurred yet but it usually happens when I'm asleep (how convenient ). Unfortunately, I can't get status or fullstatus to work during the attack because the command doesn't return a value until apache crashes and restarts. This is what leads me to believe that this really is some kind of attack and not a random flaw in my config. Will report back with more info when this happens again. By the way, thank you all for taking so much interest in helping me out. I really appreciate all your input.
Posted by ignitionservers, 12-26-2009, 06:43 PM
Alright, I installed CSF and wow it has TONS of options. Also, after configuring and running I received a few emails about IPs being blocked. This does look like a bad guy: However, upon inspecting the domlogs I find that the pages requested were legitimate ones... ... :? So he got blocked as an error ? 448 connections is quite high though.. I've set the limit to 300 for temp blocking.
Posted by ignitionservers, 12-26-2009, 09:14 PM
Well, it just happened again. I got absolutely no useful information from most places. CSF sent in an apachectl status report: vmstat:
Posted by ignitionservers, 12-26-2009, 09:19 PM
I ran a tcpdump as well, got a lot of lines like this: 01:57:09.404180 IP e179067229.adsl.alicedsl.de.sybase-sqlany > ********.org.35448: . ack 1852753 win 19071 And from netstat, I got this: [CODE] Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 212.95.59.57:80 189.194.131.172:21543 SYN_RECV - tcp 0 0 212.95.59.57:80 61.195.248.67:1737 SYN_RECV - tcp 0 0 212.95.59.57:80 109.90.115.188:2169 SYN_RECV - tcp 0 0 212.95.59.57:80 125.236.141.34:52537 SYN_RECV - tcp 0 0 212.95.59.57:80 67.195.111.181:56992 SYN_RECV - tcp 0 0 212.95.59.57:80 64.111.156.1:50991 SYN_RECV - tcp 0 0 212.95.59.57:80 94.8.50.112:50832 SYN_RECV - tcp 0 0 212.95.59.57:80 71.31.184.191:3026 SYN_RECV - tcp 0 0 212.95.59.57:80 180.5.85.200:48556 SYN_RECV - tcp 0 0 212.95.59.57:80 114.51.42.188:4295 SYN_RECV - tcp 0 0 212.95.59.57:80 79.71.14.236:49774 SYN_RECV - tcp 587 0 212.95.59.57:80 94.224.210.100:49536 CLOSE_WAIT - tcp 0 0 78.159.102.64:2706 190.50.218.209:43422 ESTABLISHED 12917/ctorrent tcp 0 0 212.95.59.57:80 70.226.117.207:52998 ESTABLISHED 27578/httpd tcp 1 0 212.95.59.57:80 76.220.239.65:62321 CLOSE_WAIT 27479/httpd tcp 1 0 212.95.59.57:80 124.176.58.46:1510 CLOSE_WAIT 27306/httpd tcp 1 0 212.95.59.57:80 201.11.227.240:1166 CLOSE_WAIT 27370/httpd tcp 341 0 212.95.59.58:80 72.11.174.84:52698 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 65.0.116.127:63377 CLOSE_WAIT 27610/httpd tcp 1 0 212.95.59.57:80 82.37.159.5:1444 CLOSE_WAIT 27557/httpd tcp 622 0 212.95.59.57:80 71.3.28.245:41914 ESTABLISHED - tcp 1 0 212.95.59.57:80 94.67.211.108:11720 CLOSE_WAIT 27350/httpd tcp 489 0 212.95.59.57:80 64.111.54.68:35832 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 90.207.160.156:58777 CLOSE_WAIT 27613/httpd tcp 642 0 212.95.59.57:80 98.64.169.177:50891 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 67.175.105.49:59769 ESTABLISHED 27319/httpd tcp 1 0 212.95.59.57:80 71.109.89.167:50239 CLOSE_WAIT 27089/httpd tcp 0 0 212.95.59.57:80 74.57.70.124:64042 ESTABLISHED 27152/httpd tcp 863 0 212.95.59.58:80 74.65.177.96:55119 CLOSE_WAIT - tcp 0 0 212.95.59.57:8233 60.240.236.239:52841 TIME_WAIT - tcp 1 0 212.95.59.57:80 174.58.39.64:1434 CLOSE_WAIT 27047/httpd tcp 1 0 212.95.59.57:80 87.221.193.97:2673 CLOSE_WAIT 27689/httpd tcp 0 0 212.95.59.57:80 97.102.210.42:60454 CLOSE_WAIT 27803/httpd tcp 1 0 212.95.59.57:80 216.80.113.24:53338 CLOSE_WAIT 27147/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58786 CLOSE_WAIT 27559/httpd tcp 1 0 212.95.59.57:80 217.82.41.165:50807 CLOSE_WAIT 27436/httpd tcp 662 0 212.95.59.57:80 172.164.207.132:49579 CLOSE_WAIT - tcp 625 0 212.95.59.57:80 24.188.34.217:53019 ESTABLISHED - tcp 771 0 212.95.59.57:80 71.68.45.229:49341 ESTABLISHED - tcp 0 84320 212.95.59.57:35099 95.27.92.97:1924 ESTABLISHED 13540/vsftpd tcp 1 0 212.95.59.57:80 92.14.215.42:50399 CLOSE_WAIT 27852/httpd tcp 1 0 212.95.59.57:80 65.0.116.127:63383 CLOSE_WAIT 27805/httpd tcp 0 0 212.95.59.57:80 67.175.105.49:59779 ESTABLISHED 27952/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18134 CLOSE_WAIT 27446/httpd tcp 1 0 212.95.59.57:80 61.195.248.67:1722 CLOSE_WAIT 27452/httpd tcp 1 0 212.95.59.57:80 174.58.39.64:1435 CLOSE_WAIT 27463/httpd tcp 0 0 212.95.59.57:8233 64.111.156.1:49999 ESTABLISHED 25318/vsftpd tcp 1 0 212.95.59.57:80 99.168.95.43:52187 CLOSE_WAIT 27704/httpd tcp 1 0 212.95.59.57:80 68.4.103.40:2722 CLOSE_WAIT 27925/httpd tcp 606 0 212.95.59.58:80 190.205.53.132:50306 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 82.44.85.54:64544 CLOSE_WAIT 27919/httpd tcp 0 0 212.95.59.57:80 210.205.46.84:6145 ESTABLISHED 27383/httpd tcp 1 0 212.95.59.57:80 82.37.159.5:1457 CLOSE_WAIT 27758/httpd tcp 1 0 212.95.59.57:80 201.66.212.214:3694 CLOSE_WAIT 27432/httpd tcp 0 0 212.95.59.57:80 41.234.177.231:55893 ESTABLISHED 27141/httpd tcp 1 0 212.95.59.57:80 201.66.212.214:3714 CLOSE_WAIT 27690/httpd tcp 0 0 212.95.59.58:80 110.55.52.44:4625 ESTABLISHED 27870/httpd tcp 1 0 212.95.59.58:80 82.47.211.185:1198 CLOSE_WAIT 27604/httpd tcp 776 0 212.95.59.57:80 69.63.61.26:58794 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 60.240.236.239:52907 ESTABLISHED 27304/httpd tcp 1 0 212.95.59.57:80 76.89.204.244:62759 CLOSE_WAIT 27918/httpd tcp 1 0 212.95.59.57:80 125.166.233.188:1067 CLOSE_WAIT 27904/httpd tcp 1 0 212.95.59.57:80 85.247.206.124:64870 CLOSE_WAIT 27374/httpd tcp 800 0 212.95.59.57:80 75.159.9.36:61416 CLOSE_WAIT - tcp 1 0 212.95.59.58:80 115.133.4.237:3947 CLOSE_WAIT 27924/httpd tcp 0 0 212.95.59.57:80 92.236.71.147:52880 ESTABLISHED 27740/httpd tcp 1 0 212.95.59.57:80 114.123.16.113:29959 CLOSE_WAIT 27619/httpd tcp 0 0 212.95.59.57:80 68.38.187.114:3520 ESTABLISHED 27414/httpd tcp 0 246840 212.95.59.57:35448 85.179.67.229:1498 ESTABLISHED 26696/vsftpd tcp 1 0 212.95.59.58:80 74.102.192.148:50602 CLOSE_WAIT 26727/httpd tcp 0 0 212.95.59.57:80 79.223.156.195:2017 CLOSE_WAIT 27846/httpd tcp 1 0 212.95.59.57:80 65.0.116.127:63384 CLOSE_WAIT 27868/httpd tcp 0 48180 212.95.59.58:80 187.42.68.198:3347 ESTABLISHED 26878/httpd tcp 1 0 212.95.59.57:80 67.236.97.108:11922 CLOSE_WAIT 27358/httpd tcp 0 127020 212.95.59.57:35613 59.171.180.85:53526 ESTABLISHED 23519/vsftpd tcp 1 0 212.95.59.57:80 67.84.93.29:61958 CLOSE_WAIT 27409/httpd tcp 1 0 212.95.59.57:80 71.28.213.51:61493 CLOSE_WAIT 27860/httpd tcp 1 0 212.95.59.57:80 64.238.164.98:4275 CLOSE_WAIT 27786/httpd tcp 0 0 212.95.59.57:80 67.43.77.78:18129 ESTABLISHED 27169/httpd tcp 1 0 212.95.59.57:80 189.254.205.99:26225 CLOSE_WAIT 27592/httpd tcp 1 0 212.95.59.57:80 71.172.224.2:50783 CLOSE_WAIT 27482/httpd tcp 652 0 212.95.59.57:80 190.139.229.13:27736 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 174.58.39.64:1433 CLOSE_WAIT 27364/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58784 CLOSE_WAIT 27445/httpd tcp 1 0 212.95.59.57:80 125.60.252.164:52253 CLOSE_WAIT 27410/httpd tcp 0 0 212.95.59.57:80 90.179.97.22:18896 ESTABLISHED 26963/httpd tcp 1 0 212.95.59.57:80 82.37.159.5:1439 CLOSE_WAIT 27561/httpd tcp 1 0 212.95.59.58:80 115.133.4.237:3910 CLOSE_WAIT 27708/httpd tcp 0 0 212.95.59.57:80 64.229.76.192:60999 ESTABLISHED 27298/httpd tcp 1 0 212.95.59.58:80 125.163.42.201:3721 CLOSE_WAIT 27915/httpd tcp 0 0 212.95.59.57:80 125.160.134.226:57599 ESTABLISHED 27555/httpd tcp 844 0 212.95.59.57:80 64.238.164.98:4280 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 84.235.126.239:54567 CLOSE_WAIT 27264/httpd tcp 0 0 212.95.59.57:80 173.202.3.219:50972 ESTABLISHED 27884/httpd tcp 1 0 212.95.59.58:80 71.74.166.251:53748 CLOSE_WAIT 26864/httpd tcp 1 0 212.95.59.58:80 74.102.192.148:50551 CLOSE_WAIT 27174/httpd tcp 1 0 212.95.59.57:80 97.102.210.42:60443 CLOSE_WAIT 27372/httpd tcp 1 0 212.95.59.57:80 217.82.41.165:50805 CLOSE_WAIT 27607/httpd tcp 1 0 212.95.59.57:80 64.229.76.192:60996 CLOSE_WAIT 26966/httpd tcp 537 0 212.95.59.57:80 71.76.197.227:1084 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 187.41.181.16:3604 CLOSE_WAIT 27275/httpd tcp 1 0 212.95.59.57:80 71.121.112.234:4161 CLOSE_WAIT 27548/httpd tcp 0 0 212.95.59.58:80 99.192.91.152:60405 ESTABLISHED 27276/httpd tcp 1 0 212.95.59.57:80 201.69.191.93:51263 CLOSE_WAIT 27455/httpd tcp 0 0 212.95.59.57:80 189.144.71.193:58813 ESTABLISHED 27303/httpd tcp 1 0 212.95.59.57:80 76.89.204.244:62326 CLOSE_WAIT 27582/httpd tcp 729 0 212.95.59.57:80 220.109.180.8:2333 ESTABLISHED - tcp 1 14401 212.95.59.57:80 60.18.45.83:5907 LAST_ACK - tcp 0 0 212.95.59.57:80 201.11.227.240:1164 CLOSE_WAIT 27366/httpd tcp 1 0 212.95.59.57:80 200.120.85.244:3381 CLOSE_WAIT 27711/httpd tcp 1 0 212.95.59.57:80 174.58.39.64:1436 CLOSE_WAIT 27536/httpd tcp 0 0 212.95.59.57:80 173.202.3.219:50964 ESTABLISHED 27744/httpd tcp 1 0 212.95.59.57:80 66.64.14.242:3631 CLOSE_WAIT 27493/httpd tcp 1 0 212.95.59.57:80 125.60.252.164:52082 CLOSE_WAIT 27172/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18149 CLOSE_WAIT 27948/httpd tcp 1 0 212.95.59.58:80 67.195.112.26:34957 CLOSE_WAIT 27562/httpd tcp 0 0 212.95.59.57:80 58.174.68.134:51128 ESTABLISHED 27485/httpd tcp 960 0 212.95.59.57:80 76.89.204.244:63055 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 190.88.53.69:53531 CLOSE_WAIT 27953/httpd tcp 630 0 212.95.59.58:80 115.133.4.237:3987 CLOSE_WAIT - tcp 727 0 212.95.59.57:80 125.60.252.164:52796 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 67.43.77.78:18137 CLOSE_WAIT 27583/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58792 CLOSE_WAIT 27967/httpd tcp 1 0 212.95.59.58:80 68.229.220.153:2320 CLOSE_WAIT 27822/httpd tcp 1 0 212.95.59.57:80 124.176.58.46:1516 CLOSE_WAIT 27549/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58788 CLOSE_WAIT 27544/httpd tcp 0 0 212.95.59.58:80 24.23.52.218:33542 ESTABLISHED 27940/httpd tcp 0 0 212.95.59.58:80 41.234.177.231:55896 ESTABLISHED 27307/httpd tcp 1 0 212.95.59.57:80 87.221.193.97:2669 CLOSE_WAIT 27494/httpd tcp 782 0 212.95.59.57:80 87.207.53.7:56301 CLOSE_WAIT - tcp 0 0 212.95.59.57:8233 82.67.1.208:52142 ESTABLISHED 19482/vsftpd tcp 1 0 212.95.59.58:80 74.65.177.96:55110 CLOSE_WAIT 27836/httpd tcp 1 0 212.95.59.57:80 124.176.58.46:1512 CLOSE_WAIT 27316/httpd tcp 1 0 212.95.59.57:80 125.60.241.247:2328 CLOSE_WAIT 27464/httpd tcp 0 0 212.95.59.58:80 68.229.220.153:2318 CLOSE_WAIT 27807/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58776 CLOSE_WAIT 27327/httpd tcp 1 0 212.95.59.57:80 99.226.201.175:60702 CLOSE_WAIT 27703/httpd tcp 522 0 212.95.59.57:80 68.228.48.149:52352 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 68.254.53.193:51401 CLOSE_WAIT 27462/httpd tcp 1 0 212.95.59.57:80 190.88.53.69:53515 CLOSE_WAIT 27353/httpd tcp 453 0 212.95.59.57:80 190.167.45.149:51671 CLOSE_WAIT - tcp 0 242904 212.95.59.57:36206 64.111.156.1:50000 ESTABLISHED 25320/vsftpd tcp 420 0 212.95.59.58:80 67.195.112.26:37521 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 69.63.61.26:58774 CLOSE_WAIT 27274/httpd tcp 669 0 212.95.59.58:80 68.173.247.119:60983 CLOSE_WAIT - tcp 0 0 78.159.102.64:2706 212.113.33.238:56052 ESTABLISHED 12917/ctorrent tcp 1 0 212.95.59.57:80 71.115.212.42:63568 CLOSE_WAIT 27618/httpd tcp 0 0 212.95.59.58:80 24.23.52.218:33546 ESTABLISHED 27764/httpd tcp 0 0 212.95.59.57:8233 71.51.230.121:25191 ESTABLISHED 14544/vsftpd tcp 1 0 212.95.59.57:80 24.12.117.52:63294 CLOSE_WAIT 27961/httpd tcp 261 0 212.95.59.58:80 67.218.116.134:48197 CLOSE_WAIT - tcp 1 0 212.95.59.58:80 118.87.0.72:53657 CLOSE_WAIT 27599/httpd tcp 605 0 212.95.59.58:80 190.205.53.132:50307 ESTABLISHED - tcp 1 0 212.95.59.57:80 92.14.215.42:50401 CLOSE_WAIT 27859/httpd tcp 0 0 212.95.59.57:80 71.234.252.191:51564 ESTABLISHED 27437/httpd tcp 0 0 212.95.59.57:80 76.220.239.65:62322 CLOSE_WAIT 27854/httpd tcp 1 0 212.95.59.58:80 118.96.136.151:3865 CLOSE_WAIT 27745/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58791 CLOSE_WAIT 27954/httpd tcp 1 0 212.95.59.57:80 76.89.204.244:62540 CLOSE_WAIT 27792/httpd tcp 1 0 212.95.59.57:80 94.67.211.108:11719 CLOSE_WAIT 26060/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58782 CLOSE_WAIT 27416/httpd tcp 0 0 212.95.59.57:80 99.168.95.43:52189 CLOSE_WAIT 27885/httpd tcp 1 0 212.95.59.57:80 70.4.172.167:55654 CLOSE_WAIT 27757/httpd tcp 1 0 212.95.59.57:80 70.193.91.11:58101 CLOSE_WAIT 27864/httpd tcp 0 0 212.95.59.58:80 89.187.240.10:63714 ESTABLISHED 27283/httpd tcp 1 0 212.95.59.57:80 69.63.61.26:58777 CLOSE_WAIT 27335/httpd tcp 1 0 212.95.59.57:80 114.51.145.92:49605 CLOSE_WAIT 27853/httpd tcp 0 0 212.95.59.58:80 92.236.71.147:52878 ESTABLISHED 27490/httpd tcp 1 8032 212.95.59.57:80 97.102.210.42:60436 CLOSING - tcp 1 0 212.95.59.57:80 81.52.143.34:34387 CLOSE_WAIT 27449/httpd tcp 1 0 212.95.59.57:80 75.159.9.36:61407 CLOSE_WAIT 27497/httpd tcp 683 0 212.95.59.57:80 71.244.238.148:50100 CLOSE_WAIT - tcp 0 0 212.95.59.57:8233 95.27.92.97:1923 ESTABLISHED 13538/vsftpd tcp 0 0 212.95.59.57:80 118.96.149.72:2169 ESTABLISHED 27845/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18139 CLOSE_WAIT 27608/httpd tcp 1 0 212.95.59.58:80 68.229.220.153:2316 CLOSE_WAIT 27488/httpd tcp 0 0 212.95.59.57:80 210.205.46.84:5880 ESTABLISHED 27084/httpd tcp 0 0 212.95.59.57:80 201.66.212.214:3636 ESTABLISHED 27262/httpd tcp 1 0 212.95.59.57:80 71.234.252.191:51559 CLOSE_WAIT 27083/httpd tcp 1 0 212.95.59.57:80 72.181.179.161:3260 CLOSE_WAIT 27146/httpd tcp 1 0 212.95.59.58:80 90.207.160.156:58746 CLOSE_WAIT 27324/httpd tcp 1 0 212.95.59.58:80 75.159.9.36:61412 CLOSE_WAIT 27916/httpd tcp 0 0 212.95.59.58:80 67.140.196.96:61595 ESTABLISHED 27164/httpd tcp 1 0 212.95.59.57:80 174.58.39.64:1432 CLOSE_WAIT 27343/httpd tcp 598 0 212.95.59.57:80 65.0.116.127:63386 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 67.195.111.181:43443 CLOSE_WAIT 27685/httpd tcp 655 0 212.95.59.57:80 189.55.121.9:3437 CLOSE_WAIT - tcp 223 0 212.95.59.58:80 123.125.66.112:46979 CLOSE_WAIT - tcp 734 0 212.95.59.57:80 220.109.180.8:2337 ESTABLISHED - tcp 1 0 212.95.59.58:80 115.133.4.237:3892 CLOSE_WAIT 27611/httpd tcp 688 0 212.95.59.58:80 190.30.200.10:12858 CLOSE_WAIT - tcp 0 0 78.159.102.64:2706 189.27.46.14:53328 ESTABLISHED 12917/ctorrent tcp 1 0 212.95.59.57:80 173.2.115.208:61255 CLOSE_WAIT 26937/httpd tcp 579 0 212.95.59.57:80 70.196.241.220:57555 CLOSE_WAIT - tcp 0 1 212.95.59.57:80 189.163.249.18:13662 FIN_WAIT1 - tcp 1 0 212.95.59.57:80 201.69.191.93:51257 CLOSE_WAIT 27278/httpd tcp 767 0 212.95.59.57:80 118.96.214.9:18641 CLOSE_WAIT - tcp 0 0 212.95.59.58:80 187.42.68.198:3339 ESTABLISHED 26973/httpd tcp 0 226300 212.95.59.57:35846 86.162.212.174:52573 ESTABLISHED 27985/vsftpd tcp 1 0 212.95.59.57:80 64.238.164.98:4276 CLOSE_WAIT 27498/httpd tcp 0 0 212.95.59.57:35831 186.81.84.207:113 FIN_WAIT2 - tcp 1 0 212.95.59.57:80 71.234.252.191:51558 CLOSE_WAIT 27305/httpd tcp 1 0 212.95.59.58:80 82.47.211.185:1189 CLOSE_WAIT 27309/httpd tcp 1 0 212.95.59.57:80 68.4.103.40:2720 CLOSE_WAIT 27749/httpd tcp 1 0 212.95.59.57:80 70.4.172.167:59214 CLOSE_WAIT 27045/httpd tcp 0 0 212.95.59.57:80 189.119.208.66:62405 ESTABLISHED 27287/httpd tcp 790 0 212.95.59.58:80 77.10.62.111:11093 CLOSE_WAIT - tcp 782 0 212.95.59.57:80 87.207.53.7:56225 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 94.67.211.108:11734 CLOSE_WAIT 27889/httpd tcp 1 0 212.95.59.58:80 125.163.42.201:3719 CLOSE_WAIT 27823/httpd tcp 0 0 212.95.59.57:80 190.88.53.69:53526 CLOSE_WAIT 27880/httpd tcp 1 0 212.95.59.57:80 67.84.93.29:61985 CLOSE_WAIT 27743/httpd tcp 0 0 212.95.59.57:80 188.102.40.101:3776 ESTABLISHED 27804/httpd tcp 1 0 212.95.59.57:80 201.66.212.214:3666 CLOSE_WAIT 27394/httpd tcp 1 0 212.95.59.57:80 92.14.215.42:50402 CLOSE_WAIT 27894/httpd tcp 0 0 212.95.59.57:8233 78.86.143.66:52336 ESTABLISHED 21326/vsftpd tcp 1 0 212.95.59.58:80 125.163.42.201:3718 CLOSE_WAIT 27785/httpd tcp 417 0 212.95.59.58:80 188.51.88.157:56816 CLOSE_WAIT - tcp 592 0 212.95.59.58:80 86.162.212.174:52412 ESTABLISHED - tcp 604 0 212.95.59.57:80 64.255.180.85:55082 ESTABLISHED - tcp 1 0 212.95.59.57:80 71.115.212.42:63564 CLOSE_WAIT 27321/httpd tcp 0 0 212.95.59.57:80 67.175.105.49:59773 ESTABLISHED 27838/httpd tcp 0 0 212.95.59.57:80 218.226.189.115:2241 ESTABLISHED 27963/httpd tcp 0 0 212.95.59.57:80 125.164.105.171:14302 ESTABLISHED 27622/httpd tcp 1 0 212.95.59.57:80 81.100.165.218:21093 CLOSE_WAIT 27882/httpd tcp 1 0 212.95.59.57:80 70.196.241.220:38580 CLOSE_WAIT 27616/httpd tcp 1 0 212.95.59.57:80 71.244.238.148:50095 CLOSE_WAIT 27733/httpd tcp 1 0 212.95.59.57:80 64.111.54.68:35753 CLOSE_WAIT 27266/httpd tcp 600 0 212.95.59.57:80 208.54.4.51:30395 CLOSE_WAIT - tcp 869 0 212.95.59.57:80 118.96.214.9:18640 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 69.63.61.26:58775 CLOSE_WAIT 27318/httpd tcp 0 0 212.95.59.57:80 60.240.236.239:52913 ESTABLISHED 27310/httpd tcp 0 0 212.95.59.57:80 99.226.201.175:60697 ESTABLISHED 27277/httpd tcp 1 0 212.95.59.58:80 66.249.65.234:45244 CLOSE_WAIT 27351/httpd tcp 736 0 212.95.59.57:80 220.109.180.8:2332 ESTABLISHED - tcp 0 176660 212.95.59.57:35007 78.86.143.66:54323 ESTABLISHED 21328/vsftpd tcp 0 0 212.95.59.57:8233 92.243.109.104:4890 ESTABLISHED 22342/vsftpd tcp 1 0 212.95.59.58:80 74.102.192.148:50576 CLOSE_WAIT 27109/httpd tcp 0 0 212.95.59.57:80 173.202.3.219:50969 ESTABLISHED 27824/httpd tcp 800 0 212.95.59.57:80 75.159.9.36:61419 CLOSE_WAIT - tcp 812 0 212.95.59.57:80 173.202.3.219:50973 ESTABLISHED - tcp 1 0 212.95.59.57:80 71.234.252.191:51557 CLOSE_WAIT 27329/httpd tcp 1 0 212.95.59.57:80 71.121.112.234:4165 CLOSE_WAIT 27584/httpd tcp 0 0 212.95.59.57:80 187.60.254.78:50626 ESTABLISHED 27886/httpd tcp 1 0 212.95.59.57:80 187.41.74.251:1690 CLOSE_WAIT 27290/httpd tcp 1 0 212.95.59.58:80 74.102.192.148:50600 CLOSE_WAIT 27170/httpd tcp 1 0 212.95.59.57:80 61.195.248.67:1724 CLOSE_WAIT 27869/httpd tcp 594 0 212.95.59.58:80 86.162.212.174:52451 ESTABLISHED - tcp 745 0 212.95.59.58:80 65.182.27.243:26044 ESTABLISHED - tcp 1 0 212.95.59.57:80 81.100.165.218:21097 CLOSE_WAIT 27957/httpd tcp 0 0 212.95.59.58:80 85.54.241.17:10947 ESTABLISHED 27397/httpd tcp 1 0 212.95.59.57:80 94.67.211.108:11722 CLOSE_WAIT 27572/httpd tcp 436 0 212.95.59.57:80 68.47.99.207:2954 CLOSE_WAIT - tcp 0 0 212.95.59.57:8233 79.72.29.93:4050 ESTABLISHED 26675/vsftpd tcp 1 0 212.95.59.57:80 71.121.112.234:4163 CLOSE_WAIT 27621/httpd tcp 1 0 212.95.59.57:80 94.67.211.108:11721 CLOSE_WAIT 27481/httpd tcp 411 0 212.95.59.58:80 67.195.112.26:37745 CLOSE_WAIT - tcp 0 261166 212.95.59.57:35116 203.218.63.73:1392 FIN_WAIT1 - tcp 0 0 212.95.59.57:80 71.234.252.191:51563 CLOSE_WAIT 27422/httpd tcp 1 0 212.95.59.57:80 90.207.160.156:58752 CLOSE_WAIT 27461/httpd tcp 292 0 127.0.0.1:80 127.0.0.1:48331 CLOSE_WAIT - tcp 1 18721 212.95.59.57:80 60.18.45.83:5918 LAST_ACK - tcp 612 0 212.95.59.57:80 67.175.105.49:59781 ESTABLISHED - tcp 1 0 212.95.59.57:80 92.14.215.42:50388 CLOSE_WAIT 27291/httpd tcp 494 0 212.95.59.57:80 67.195.111.181:46329 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 92.105.111.228:64752 CLOSE_WAIT 27308/httpd tcp 1 0 212.95.59.57:80 121.121.140.96:2758 CLOSE_WAIT 27459/httpd tcp 0 0 212.95.59.57:80 118.96.149.72:2161 ESTABLISHED 27755/httpd tcp 1 0 212.95.59.57:80 114.51.145.92:49606 CLOSE_WAIT 27962/httpd tcp 550 0 212.95.59.57:80 71.115.212.42:63570 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 174.58.39.64:1437 CLOSE_WAIT 27623/httpd tcp 1 0 212.95.59.57:80 95.95.138.94:58229 CLOSE_WAIT 27738/httpd tcp 0 0 78.159.102.64:46060 77.179.42.160:60944 ESTABLISHED 12917/ctorrent tcp 0 0 212.95.59.58:80 67.140.196.96:61582 ESTABLISHED 27044/httpd tcp 1 0 212.95.59.57:80 67.84.93.29:61987 CLOSE_WAIT 27813/httpd tcp 0 0 212.95.59.57:80 82.37.159.5:1462 CLOSE_WAIT 27945/httpd tcp 1 0 212.95.59.58:80 115.133.4.237:3860 CLOSE_WAIT 27453/httpd tcp 1 0 212.95.59.57:80 87.221.193.97:2663 CLOSE_WAIT 27286/httpd tcp 0 0 212.95.59.57:8233 217.82.41.165:50663 ESTABLISHED 25158/vsftpd tcp 693 0 212.95.59.57:80 71.244.238.148:50099 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 121.121.140.96:2766 CLOSE_WAIT 27614/httpd tcp 0 0 212.95.59.57:80 87.11.121.247:2073 ESTABLISHED 27911/httpd tcp 1 0 212.95.59.57:80 76.220.239.65:62319 CLOSE_WAIT 27282/httpd tcp 776 0 212.95.59.57:80 69.63.61.26:58798 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 79.223.156.195:2005 CLOSE_WAIT 27424/httpd tcp 445 0 212.95.59.58:80 83.7.103.8:65477 CLOSE_WAIT - tcp 1 0 212.95.59.58:80 97.89.172.228:49227 CLOSE_WAIT 27382/httpd tcp 0 0 212.95.59.57:80 208.191.142.155:1800 ESTABLISHED 27753/httpd tcp 1 0 212.95.59.57:80 75.159.9.36:61408 CLOSE_WAIT 27451/httpd tcp 1 0 212.95.59.57:80 75.81.2.181:52364 CLOSE_WAIT 27550/httpd tcp 1 0 212.95.59.57:80 114.51.145.92:49604 CLOSE_WAIT 27331/httpd tcp 1 0 212.95.59.58:80 125.163.42.201:3720 CLOSE_WAIT 27861/httpd tcp 0 0 212.95.59.57:80 90.207.160.156:58791 ESTABLISHED 27760/httpd tcp 1 0 212.95.59.58:80 75.159.9.36:61410 CLOSE_WAIT 27750/httpd tcp 909 0 212.95.59.57:80 187.60.254.78:55254 ESTABLISHED - tcp 0 0 212.95.59.57:80 187.60.254.78:54343 ESTABLISHED 27759/httpd tcp 1 0 212.95.59.57:80 125.166.233.188:1065 CLOSE_WAIT 27537/httpd tcp 464 0 212.95.59.57:80 67.195.111.181:46407 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 72.252.216.67:56617 ESTABLISHED 27348/httpd tcp 0 0 212.95.59.58:80 118.172.243.122:17398 ESTABLISHED 27756/httpd tcp 0 0 212.95.59.57:8233 86.162.212.174:52423 ESTABLISHED 27979/vsftpd tcp 0 140160 212.95.59.57:35984 82.67.1.208:52143 ESTABLISHED 19549/vsftpd tcp 0 0 78.159.102.64:2706 84.245.25.242:22260 ESTABLISHED 12917/ctorrent tcp 0 0 212.95.59.57:80 67.175.105.49:59771 ESTABLISHED 27731/httpd tcp 1 0 212.95.59.58:80 67.195.112.151:56331 CLOSE_WAIT 27484/httpd tcp 1 0 212.95.59.57:80 41.5.216.207:50631 CLOSE_WAIT 27040/httpd tcp 1 0 212.95.59.57:80 67.244.132.209:55308 CLOSE_WAIT 27906/httpd tcp 0 0 212.95.59.57:80 210.205.46.84:5901 ESTABLISHED 26949/httpd tcp 1 0 212.95.59.57:80 189.180.7.149:1297 CLOSE_WAIT 27574/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18135 CLOSE_WAIT 27477/httpd tcp 1 0 212.95.59.58:80 82.47.211.185:1190 CLOSE_WAIT 27281/httpd tcp 0 0 212.95.59.57:80 71.238.214.144:52156 CLOSE_WAIT 27404/httpd tcp 669 0 212.95.59.58:80 68.173.247.119:60984 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 71.76.197.227:1079 CLOSE_WAIT 27901/httpd tcp 1 0 212.95.59.57:80 67.195.111.181:40229 CLOSE_WAIT 27311/httpd tcp 883 0 212.95.59.57:80 64.238.164.98:4281 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 69.63.61.26:58790 CLOSE_WAIT 27964/httpd tcp 800 0 212.95.59.57:80 75.159.9.36:61418 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 190.88.53.69:53523 CLOSE_WAIT 27492/httpd tcp 1 0 212.95.59.57:80 65.0.116.127:63381 CLOSE_WAIT 27739/httpd tcp 0 0 212.95.59.57:80 189.163.249.18:13685 ESTABLISHED 27328/httpd tcp 849 0 212.95.59.57:80 24.12.117.52:63442 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 71.244.238.148:50092 CLOSE_WAIT 27296/httpd tcp 0 0 212.95.59.58:80 189.119.208.66:62413 ESTABLISHED 27156/httpd tcp 0 0 212.95.59.57:80 92.236.71.147:52876 ESTABLISHED 27433/httpd tcp 1 0 212.95.59.57:80 189.55.121.9:3429 CLOSE_WAIT 27702/httpd tcp 0 0 212.95.59.57:80 189.179.236.194:2339 ESTABLISHED 26539/httpd tcp 1 0 212.95.59.57:80 190.59.58.204:33510 CLOSE_WAIT 27910/httpd tcp 1 0 212.95.59.58:80 123.125.66.20:43470 CLOSE_WAIT 27320/httpd tcp 0 36301 212.95.59.57:80 189.138.215.76:62037 FIN_WAIT1 - tcp 1 0 212.95.59.57:80 92.14.215.42:50393 CLOSE_WAIT 27423/httpd tcp 1 0 212.95.59.57:80 71.115.212.42:63569 CLOSE_WAIT 27956/httpd tcp 1 0 212.95.59.58:80 67.195.112.26:33665 CLOSE_WAIT 27447/httpd tcp 1 0 212.95.59.57:80 92.14.215.42:50392 CLOSE_WAIT 27299/httpd tcp 626 0 212.95.59.57:80 24.188.34.217:53018 CLOSE_WAIT - tcp 709 0 212.95.59.57:80 71.244.238.148:50096 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 88.110.83.138:62315 CLOSE_WAIT 27908/httpd tcp 758 0 212.95.59.57:80 71.57.65.8:64780 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 71.244.238.148:50093 CLOSE_WAIT 27375/httpd tcp 1 0 212.95.59.58:80 173.69.138.66:54988 CLOSE_WAIT 27171/httpd tcp 1 0 212.95.59.57:80 71.244.238.148:50094 CLOSE_WAIT 27603/httpd tcp 650 0 212.95.59.58:80 115.133.4.237:3954 CLOSE_WAIT - tcp 1 0 212.95.59.58:80 119.63.198.39:54392 CLOSE_WAIT 27914/httpd tcp 942 0 212.95.59.58:80 125.163.42.201:3722 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 125.60.241.247:2330 CLOSE_WAIT 27606/httpd tcp 1 0 212.95.59.57:80 98.64.169.177:50890 CLOSE_WAIT 27663/httpd tcp 0 0 212.95.59.57:8233 85.179.67.229:1283 ESTABLISHED 26694/vsftpd tcp 1 0 212.95.59.58:80 67.87.38.96:53687 CLOSE_WAIT 27369/httpd tcp 614 0 212.95.59.57:80 68.53.51.40:1163 CLOSE_WAIT - tcp 622 0 212.95.59.57:80 172.164.207.132:49581 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 71.234.252.191:51562 CLOSE_WAIT 27393/httpd tcp 1 0 212.95.59.57:80 67.236.97.108:11916 CLOSE_WAIT 27280/httpd tcp 0 0 212.95.59.57:8233 59.171.180.85:53525 ESTABLISHED 23517/vsftpd tcp 1 0 212.95.59.57:80 71.115.212.42:63566 CLOSE_WAIT 27371/httpd tcp 0 0 212.95.59.57:80 71.238.214.144:52155 CLOSE_WAIT 27384/httpd tcp 0 0 212.95.59.57:80 114.51.42.188:4099 ESTABLISHED 27082/httpd tcp 832 0 212.95.59.57:80 92.14.215.42:50403 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 69.63.61.26:58779 CLOSE_WAIT 27381/httpd tcp 1 0 212.95.59.57:80 71.115.212.42:63567 CLOSE_WAIT 27684/httpd tcp 1 0 212.95.59.57:80 97.102.210.42:60461 CLOSE_WAIT 27826/httpd tcp 1 0 212.95.59.57:80 67.195.111.181:41296 CLOSE_WAIT 27427/httpd tcp 0 0 212.95.59.57:80 65.0.116.127:63385 CLOSE_WAIT 27939/httpd tcp 0 0 212.95.59.57:80 211.1.219.223:61056 ESTABLISHED 27814/httpd tcp 0 0 212.95.59.57:80 90.179.97.22:18910 ESTABLISHED 27923/httpd tcp 1 0 212.95.59.57:80 67.195.111.181:44785 CLOSE_WAIT 27905/httpd tcp 650 0 212.95.59.58:80 115.133.4.237:3970 CLOSE_WAIT - tcp 0 45012 212.95.59.57:56009 85.53.35.185:1209 ESTABLISHED 7354/vsftpd tcp 1 0 212.95.59.57:80 67.43.77.78:18138 CLOSE_WAIT 27577/httpd tcp 1 0 212.95.59.57:80 124.106.55.51:10907 CLOSE_WAIT 27966/httpd tcp 0 0 212.95.59.57:80 202.189.152.228:3873 ESTABLISHED 27585/httpd tcp 1 0 212.95.59.58:80 119.63.31.163:1354 CLOSE_WAIT 27793/httpd tcp 1 0 212.95.59.57:80 93.179.45.167:3313 CLOSE_WAIT 27835/httpd tcp 629 0 212.95.59.57:80 125.60.241.247:2332 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 24.42.155.73:55895 CLOSE_WAIT 27408/httpd tcp 0 0 212.95.59.57:80 67.43.77.78:18147 CLOSE_WAIT 27268/httpd tcp 0 0 212.95.59.57:80 79.223.156.195:2015 CLOSE_WAIT 27504/httpd tcp 0 220460 212.95.59.57:36185 92.243.109.104:4971 ESTABLISHED 22349/vsftpd tcp 1 0 212.95.59.57:80 65.0.116.127:63379 CLOSE_WAIT 27725/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58778 CLOSE_WAIT 27373/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58780 CLOSE_WAIT 27398/httpd tcp 853 0 212.95.59.57:80 64.238.164.98:4277 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 87.221.193.97:2665 CLOSE_WAIT 27379/httpd tcp 1 0 212.95.59.57:80 67.195.111.181:41920 CLOSE_WAIT 27476/httpd tcp 0 242484 212.95.59.57:36163 151.23.190.159:1653 ESTABLISHED 27139/vsftpd tcp 413 0 212.95.59.57:80 72.50.126.103:63646 CLOSE_WAIT - tcp 800 0 212.95.59.57:80 75.159.9.36:61420 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 189.180.7.149:1288 CLOSE_WAIT 27155/httpd tcp 0 0 212.95.59.58:80 110.55.52.44:4601 ESTABLISHED 27399/httpd tcp 1 0 212.95.59.57:80 173.2.115.208:61259 CLOSE_WAIT 27867/httpd tcp 1 0 212.95.59.57:80 71.185.4.83:1304 CLOSE_WAIT 27819/httpd tcp 0 0 212.95.59.58:80 65.182.27.243:26043 ESTABLISHED 27899/httpd tcp 1 0 212.95.59.58:80 195.239.178.214:60842 CLOSE_WAIT 27863/httpd tcp 0 0 212.95.59.57:80 125.164.105.171:14323 ESTABLISHED 27573/httpd tcp 1 0 212.95.59.58:80 91.50.191.90:61723 CLOSE_WAIT 27761/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18141 CLOSE_WAIT 27686/httpd tcp 1 20161 212.95.59.57:80 60.18.45.83:5915 LAST_ACK - tcp 1 0 212.95.59.57:80 67.218.116.164:59198 CLOSE_WAIT 27406/httpd tcp 1 0 212.95.59.57:80 64.111.54.68:35833 CLOSE_WAIT - tcp 205 0 212.95.59.57:80 124.171.248.186:1200 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 121.121.140.96:2754 CLOSE_WAIT 27368/httpd tcp 663 0 212.95.59.57:80 187.12.55.229:52381 ESTABLISHED - tcp 0 0 212.95.59.57:8233 70.179.121.85:49684 ESTABLISHED 26245/vsftpd tcp 737 0 212.95.59.57:80 220.109.180.8:2338 ESTABLISHED - tcp 1 0 212.95.59.57:80 173.2.115.208:61257 CLOSE_WAIT 27594/httpd tcp 0 0 212.95.59.57:80 72.193.203.83:52559 ESTABLISHED 27921/httpd tcp 1 0 212.95.59.57:80 75.159.9.36:61405 CLOSE_WAIT 27413/httpd tcp 0 0 212.95.59.57:80 71.238.214.144:52157 CLOSE_WAIT 27411/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58789 CLOSE_WAIT 27943/httpd tcp 1 0 212.95.59.58:80 74.102.192.148:50599 CLOSE_WAIT 27158/httpd tcp 0 0 212.95.59.57:80 71.238.214.144:52183 CLOSE_WAIT 27401/httpd tcp 809 0 212.95.59.57:80 209.121.11.201:64821 ESTABLISHED - tcp 0 0 212.95.59.57:80 190.139.229.13:27703 CLOSE_WAIT 27849/httpd tcp 737 0 212.95.59.57:80 220.109.180.8:2334 ESTABLISHED - tcp 0 0 212.95.59.57:80 87.11.121.247:2043 ESTABLISHED 27732/httpd tcp 485 0 212.95.59.57:80 85.241.227.72:50206 ESTABLISHED - tcp 650 0 212.95.59.57:80 95.95.138.94:58232 ESTABLISHED - tcp 750 0 212.95.59.57:80 187.41.181.16:3645 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 75.81.2.181:52338 CLOSE_WAIT 27284/httpd tcp 1 0 212.95.59.57:80 66.64.14.242:3638 CLOSE_WAIT 27596/httpd tcp 0 0 212.95.59.57:80 189.236.170.204:59959 ESTABLISHED 27951/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18136 CLOSE_WAIT 27491/httpd tcp 0 0 212.95.59.58:80 71.227.166.249:54454 CLOSE_WAIT 27426/httpd tcp 1 0 212.95.59.58:80 190.205.53.132:50304 CLOSE_WAIT 27687/httpd tcp 0 0 212.95.59.57:80 187.60.254.78:16702 ESTABLISHED 27456/httpd tcp 1 0 212.95.59.57:80 71.121.112.234:4177 CLOSE_WAIT 27902/httpd tcp 457 0 212.95.59.58:80 82.181.113.108:51544 CLOSE_WAIT - tcp 1 0 212.95.59.58:80 67.84.93.29:61963 CLOSE_WAIT 27480/httpd tcp 0 0 212.95.59.57:8233 151.23.190.159:1652 ESTABLISHED 27137/vsftpd tcp 1 0 212.95.59.58:80 74.102.192.148:50601 CLOSE_WAIT 27261/httpd tcp 1 0 212.95.59.58:80 24.158.161.27:1075 CLOSE_WAIT 27288/httpd tcp 1 0 212.95.59.57:80 67.195.111.181:44836 CLOSE_WAIT 27878/httpd tcp 0 0 212.95.59.57:80 210.205.46.84:5903 ESTABLISHED 26965/httpd tcp 1 0 212.95.59.57:80 221.223.130.240:35167 CLOSE_WAIT 27560/httpd tcp 1 0 212.95.59.57:80 70.53.181.84:2383 CLOSE_WAIT 27395/httpd tcp 1 0 212.95.59.57:80 88.110.83.138:62316 CLOSE_WAIT 27932/httpd tcp 0 0 212.95.59.57:80 121.121.158.225:2722 ESTABLISHED 27157/httpd tcp 0 0 212.95.59.57:80 99.168.95.43:52188 CLOSE_WAIT 27877/httpd tcp 1 0 212.95.59.57:80 217.82.41.165:50806 CLOSE_WAIT 27707/httpd tcp 1 0 212.95.59.57:80 187.41.181.16:3622 CLOSE_WAIT 27597/httpd tcp 1 0 212.95.59.57:80 125.60.241.247:2331 CLOSE_WAIT 27896/httpd tcp 1 0 212.95.59.57:80 71.31.184.191:2858 CLOSE_WAIT 27862/httpd tcp 1 0 212.95.59.57:80 67.84.93.29:61961 CLOSE_WAIT 27450/httpd tcp 749 0 212.95.59.57:80 201.69.191.93:51301 ESTABLISHED - tcp 0 0 212.95.59.57:80 67.43.77.78:18146 CLOSE_WAIT 27913/httpd tcp 1 0 212.95.59.58:80 24.23.52.218:33550 CLOSE_WAIT 27355/httpd tcp 0 0 212.95.59.57:80 71.234.252.191:51561 CLOSE_WAIT 27380/httpd tcp 800 0 212.95.59.57:80 75.159.9.36:61417 CLOSE_WAIT - tcp 0 0 78.159.102.64:2706 121.229.164.236:3992 ESTABLISHED 12917/ctorrent tcp 0 0 212.95.59.58:80 87.11.121.247:2069 ESTABLISHED 27821/httpd tcp 0 0 212.95.59.57:80 97.102.210.42:60452 CLOSE_WAIT 27806/httpd tcp 1 0 212.95.59.58:80 125.163.42.201:3709 CLOSE_WAIT 27396/httpd tcp 0 0 212.95.59.58:80 118.172.243.122:17388 ESTABLISHED 27705/httpd tcp 0 0 212.95.59.57:80 121.121.140.96:2781 ESTABLISHED 27893/httpd tcp 0 0 78.159.102.64:2706 91.197.130.15:2088 ESTABLISHED 12917/ctorrent tcp 450 0 212.95.59.57:80 190.167.45.149:51648 CLOSE_WAIT - tcp 0 0 212.95.59.58:80 189.119.208.66:62408 ESTABLISHED 27285/httpd tcp 422 0 212.95.59.57:80 68.47.99.207:2953 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 82.37.159.5:1440 CLOSE_WAIT 27575/httpd tcp 1 0 212.95.59.57:80 187.41.181.16:3608 CLOSE_WAIT 27430/httpd tcp 1 0 212.95.59.57:80 124.176.58.46:1514 CLOSE_WAIT 27402/httpd tcp 0 0 212.95.59.57:80 220.109.180.8:2317 ESTABLISHED 27615/httpd tcp 0 0 212.95.59.57:80 79.223.156.195:2019 CLOSE_WAIT 27944/httpd tcp 1 0 212.95.59.57:80 125.60.252.164:52667 CLOSE_WAIT 27875/httpd tcp 1 0 212.95.59.57:80 220.253.174.226:34607 CLOSE_WAIT 27495/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18131 CLOSE_WAIT 27048/httpd tcp 0 0 212.95.59.58:80 87.11.121.247:2067 ESTABLISHED 27752/httpd tcp 0 0 212.95.59.57:80 60.242.244.8:4040 ESTABLISHED 27763/httpd tcp 0 181500 212.95.59.57:35361 79.72.29.93:4051 ESTABLISHED 26677/vsftpd tcp 729 0 212.95.59.57:80 41.5.216.207:50656 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 201.69.191.93:51258 ESTABLISHED 27313/httpd tcp 1 0 212.95.59.58:80 195.239.178.214:40586 CLOSE_WAIT 27259/httpd tcp 1 0 212.95.59.57:80 68.226.155.50:48241 CLOSE_WAIT 27483/httpd tcp 0 0 78.159.102.64:41621 81.132.143.246:54921 ESTABLISHED 12917/ctorrent tcp 780 0 212.95.59.57:80 85.247.206.124:64879 CLOSE_WAIT - tcp 658 0 212.95.59.57:80 125.60.252.164:52944 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 82.37.159.5:1463 CLOSE_WAIT 27965/httpd tcp 489 0 212.95.59.57:80 64.111.54.68:35836 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 118.96.214.9:18636 CLOSE_WAIT 27968/httpd tcp 0 0 212.95.59.57:80 87.207.53.7:56223 CLOSE_WAIT 27934/httpd tcp 0 208684 212.95.59.57:35230 202.233.37.251:50359 ESTABLISHED 25924/vsftpd tcp 0 221920 212.95.59.57:35481 74.210.157.136:34287 ESTABLISHED 25928/vsftpd tcp 1 0 212.95.59.58:80 67.87.38.96:53688 CLOSE_WAIT 27407/httpd tcp 1 0 212.95.59.58:80 82.232.60.90:2146 CLOSE_WAIT 27897/httpd tcp 1 0 212.95.59.57:80 216.80.113.24:53339 CLOSE_WAIT 27342/httpd tcp 701 0 212.95.59.57:80 80.42.94.197:3268 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 66.249.65.219:47519 CLOSE_WAIT 27460/httpd tcp 1 0 212.95.59.57:80 67.43.77.78:18132 CLOSE_WAIT 27360/httpd tcp 1 0 212.95.59.57:80 190.88.53.69:53524 CLOSE_WAIT 27605/httpd tcp 1 0 212.95.59.57:80 87.221.193.97:2661 CLOSE_WAIT 26128/httpd tcp 1 0 212.95.59.57:80 71.234.252.191:51560 CLOSE_WAIT 27359/httpd tcp 0 0 212.95.59.57:80 67.175.105.49:59775 ESTABLISHED 27891/httpd tcp 844 0 212.95.59.57:80 64.238.164.98:4279 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 84.215.48.50:49371 ESTABLISHED 27448/httpd tcp 0 0 212.95.59.57:80 58.174.68.134:51121 ESTABLISHED 27349/httpd tcp 0 0 212.95.59.57:80 97.102.210.42:60457 CLOSE_WAIT 27808/httpd tcp 1 0 212.95.59.58:80 67.195.112.26:36342 CLOSE_WAIT 27865/httpd tcp 1 0 212.95.59.58:80 82.47.211.185:1191 CLOSE_WAIT 27405/httpd tcp 567 0 212.95.59.58:80 97.89.172.228:49231 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 201.66.212.214:3720 CLOSE_WAIT 27762/httpd tcp 0 0 212.95.59.57:80 69.63.61.26:58787 CLOSE_WAIT 27818/httpd tcp 692 0 212.95.59.57:80 71.244.238.148:50098 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 64.238.164.98:4274 CLOSE_WAIT 27701/httpd tcp 1 0 212.95.59.58:80 195.239.178.214:60338 CLOSE_WAIT 27330/httpd tcp 1 0 212.95.59.57:80 187.41.181.16:3637 CLOSE_WAIT 27839/httpd tcp 1 0 212.95.59.58:80 67.195.112.26:36135 CLOSE_WAIT 27848/httpd tcp 1 0 212.95.59.57:80 190.88.53.69:53512 CLOSE_WAIT 27175/httpd tcp 1 0 212.95.59.57:80 90.225.89.103:53005 CLOSE_WAIT 27365/httpd tcp 846 0 212.95.59.57:80 75.159.9.36:61421 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 88.110.83.138:62314 CLOSE_WAIT 27833/httpd tcp 1 0 212.95.59.58:80 222.139.154.20:55509 CLOSE_WAIT 27706/httpd tcp 0 0 212.95.59.57:80 97.102.210.42:60456 CLOSE_WAIT 27810/httpd tcp 0 189800 212.95.59.57:36227 70.179.121.85:49685 ESTABLISHED 26247/vsftpd tcp 517 0 212.95.59.57:80 68.9.97.58:54996 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 98.30.156.107:52777 ESTABLISHED 27270/httpd tcp 1 0 212.95.59.57:80 221.223.130.240:35160 CLOSE_WAIT 27302/httpd tcp 1 0 212.95.59.57:80 41.5.216.207:50653 CLOSE_WAIT 27697/httpd tcp 1 0 212.95.59.57:80 64.111.54.68:35834 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 201.4.89.88:4332 CLOSE_WAIT 27317/httpd tcp 1 0 212.95.59.57:80 92.105.111.228:64732 CLOSE_WAIT 27289/httpd tcp 564 0 212.95.59.57:80 201.42.173.155:2646 CLOSE_WAIT - tcp 0 0 212.95.59.57:80 187.41.181.16:3633 CLOSE_WAIT 27817/httpd tcp 1 0 212.95.59.57:80 99.168.95.43:52186 CLOSE_WAIT 27609/httpd tcp 1 0 212.95.59.57:80 24.10.176.170:49438 CLOSE_WAIT 27400/httpd tcp 1 0 212.95.59.58:80 189.187.145.232:2328 CLOSE_WAIT 25740/httpd tcp 0 0 212.95.59.58:80 217.93.0.77:59437 ESTABLISHED 27387/httpd tcp 0 0 212.95.59.57:8233 202.233.37.251:50357 ESTABLISHED 25920/vsftpd tcp 0 0 212.95.59.57:8233 74.210.157.136:41894 ESTABLISHED 25926/vsftpd tcp 0 0 212.95.59.57:80 121.121.140.96:2742 ESTABLISHED 27263/httpd tcp 438 0 212.95.59.57:80 174.58.39.64:1498 CLOSE_WAIT - tcp 1 0 212.95.59.57:80 75.159.9.36:61406 CLOSE_WAIT 27443/httpd tcp 0 0 212.95.59.58:80 66.188.192.57:1705 ESTABLISHED 27933/httpd tcp 0 0 ::ffff:212.95.59.57:22 ::ffff:91.72.241.222:50139 ESTABLISHED 4552/0 Active UNIX domain sockets (w/o servers) Proto RefCnt Flags Type State I-Node PID/Program name Path unix 33 [ ] DGRAM 5187 2686/syslogd /dev/log unix 2 [ ] DGRAM 653 505/udevd @/org/kernel/udev/udevd unix 2 [ ] DGRAM 7979 3353/hald @/org/freedesktop/hal/udev_event unix 3 [ ] STREAM CONNECTED 276409793 27979/vsftpd unix 3 [ ] STREAM CONNECTED 276409792 27979/vsftpd unix 2 [ ] DGRAM 276409791 27979/vsftpd unix 3 [ ] STREAM CONNECTED 276405699 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276405698 26951/httpd unix 3 [ ] STREAM CONNECTED 276405693 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276405692 27049/httpd unix 3 [ ] STREAM CONNECTED 276405631 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276405630 26864/httpd unix 3 [ ] STREAM CONNECTED 276403547 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276403546 26878/httpd unix 3 [ ] STREAM CONNECTED 276401055 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276401054 26971/httpd unix 3 [ ] STREAM CONNECTED 276400717 27137/vsftpd unix 3 [ ] STREAM CONNECTED 276400716 27137/vsftpd unix 2 [ ] DGRAM 276400715 27137/vsftpd unix 3 [ ] STREAM CONNECTED 276396474 2408/mysqld /var/lib/mysql/mysql.sock unix 3 [ ] STREAM CONNECTED 276396473 26973/httpd unix 3 [ ] STREAM CONNECTED 276384798 26694/vsftpd unix 3 [ ] STREAM CONNECTED 276384797 26694/vsftpd unix 2 [ ] DGRAM 276384796 26694/vsftpd unix 3 [ ] STREAM CONNECTED 276384366 26675/vsftpd unix 3 [ ] STREAM CONNECTED 276384365 26675/vsftpd unix 2 [ ] DGRAM 276384364 26675/vsftpd unix 2 [ ] STREAM CONNECTED 276381444 6642/tailwatchd unix 3 [ ] STREAM CONNECTED 276373335 26245/vsftpd unix 3 [ ] STREAM CONNECTED 276373334 26245/vsftpd unix 2 [ ] DGRAM 276373333 26245/vsftpd unix 3 [ ] STREAM CONNECTED 276361389 25926/vsftpd unix 3 [ ] STREAM CONNECTED 276361388 25926/vsftpd unix 2 [ ] DGRAM 276361387 25926/vsftpd unix 3 [ ] STREAM CONNECTED 276361251 25920/vsftpd unix 3 [ ] STREAM CONNECTED 276361250 25920/vsftpd unix 2 [ ] DGRAM 276361249 25920/vsftpd unix 3 [ ] STREAM CONNECTED 276344430 25318/vsftpd unix 3 [ ] STREAM CONNECTED 276344429 25318/vsftpd unix 2 [ ] DGRAM 276344428 25318/vsftpd unix 3 [ ] STREAM CONNECTED 276339472 25158/vsftpd unix 3 [ ] STREAM CONNECTED 276339471 25158/vsftpd unix 2 [ ] DGRAM 276339470 25158/vsftpd unix 3 [ ] STREAM CONNECTED 276282541 23517/vsftpd unix 3 [ ] STREAM CONNECTED 276282540 23517/vsftpd unix 2 [ ] DGRAM 276282539 23517/vsftpd unix 3 [ ] STREAM CONNECTED 276246673 22342/vsftpd unix 3 [ ] STREAM CONNECTED 276246672 22342/vsftpd unix 2 [ ] DGRAM 276246671 22342/vsftpd unix 3 [ ] STREAM CONNECTED 276212918 21326/vsftpd unix 3 [ ] STREAM CONNECTED 276212917 21326/vsftpd unix 2 [ ] DGRAM 276212916 21326/vsftpd unix 3 [ ] STREAM CONNECTED 276152333 19482/vsftpd unix 3 [ ] STREAM CONNECTED 276152332 19482/vsftpd unix 2 [ ] DGRAM 276152331 19482/vsftpd unix 3 [ ] STREAM CONNECTED 275989756 14544/vsftpd unix 3 [ ] STREAM CONNECTED 275989755 14544/vsftpd unix 2 [ ] DGRAM 275989754 14544/vsftpd unix 3 [ ] STREAM CONNECTED 275966563 13538/vsftpd unix 3 [ ] STREAM CONNECTED 275966562 13538/vsftpd unix 2 [ ] DGRAM 275966561 13538/vsftpd unix 2 [ ] STREAM CONNECTED 274989192 7354/vsftpd unix 2 [ ] DGRAM 274989190 7354/vsftpd unix 2 [ ] DGRAM 274889641 4552/0 unix 3 [ ] STREAM CONNECTED 274102575 11409/spamd child unix 3 [ ] STREAM CONNECTED 274102574 16706/spamd.pid --m unix 3 [ ] STREAM CONNECTED 269218006 16842/spamd child unix 3 [ ] STREAM CONNECTED 269218005 11409/spamd child unix 2 [ ] STREAM CONNECTED 269218003 16842/spamd child unix 2 [ ] DGRAM 269216317 11409/spamd child unix 2 [ ] DGRAM 264236085 16223/crond unix 2 [ ] DGRAM 222373656 13093/named unix 2 [ ] DGRAM 216561693 6871/courierlogger unix 2 [ ] DGRAM 216561680 6865/courierlogger unix 2 [ ] DGRAM 216561670 6859/courierlogger unix 2 [ ] DGRAM 216561658 6853/courierlogger unix 2 [ ] DGRAM 216561645 6846/courierlogger unix 2
Posted by TurkReno, 12-26-2009, 10:26 PM
Glad that CSF worked out for you. You really should do a server security check and make sure that you can take care of most of the problems that it addresses. If you want to immediately flush your cache, try running these commands in the following order: echo 2 > /proc/sys/vm/drop_caches echo 100 > /proc/sys/vm/nr_hugepages echo 0 > /proc/sys/vm/nr_hugepages This should flush your disk cache and your memory buffers....at least long enough to move around on your system and take care of some problems.
Posted by brianoz, 12-26-2009, 11:32 PM
I'm not actually sure that Turk's commands do anything, though well intentioned. They flush the buffer cache, though that memory was already available for use. http://www.webhostingtalk.com/showth...=1#post6563513
Posted by TurkReno, 12-26-2009, 11:36 PM
Please run a top and slabtop and you will see the difference after running the commands. It will gain him enough time to execute commands on the server before the httpd processes start consuming all of the free memory again because they're cached.