Unresponsive Server Mystery

Portal Home > Knowledgebase > Articles Database > Unresponsive Server Mystery

Posted by Mechromancer, 12-23-2007, 09:24 PM
I've been having this problem for the past week: everyday in the afternoon my dedicated server goes unresponsive for about an hour or so--you can FTP into it (upload and download work fine) and access the control panel, but it refuses to serve up any webpages / files through the browser (no one can access my site). Meanwhile the CPU / RAM seems to be just sitting there being completely unused. This problem just starts by itself and then goes away by itself somewhat regularly. Restarting the server has no effect on this. I'm puzzled as to what the problem could possibly be or how I can fix it--any ideas? My server's running Fedora 6 / GoDaddy control panel if it helps. Thanks guys, bye.
Posted by sirius, 12-23-2007, 11:37 PM
Moved to Technical and Security Issues.... Sirius
Posted by bizness, 01-09-2008, 11:45 PM
what does netstat show.... This sounds like it could be a DDOS attack on port 80 using sync floods.
Posted by Mechromancer, 01-10-2008, 12:46 AM
I don't know much about linux / netstat and such, but typing netstat gets a long list of results like: unix 2 [ ] STREAM CONNECTED 60814 unix 2 [ ] STREAM CONNECTED 60798 unix 2 [ ] STREAM CONNECTED 60711 unix 2 [ ] STREAM CONNECTED 18268 unix 3 [ ] STREAM CONNECTED 15808 /var/run/dbus/system_bus_socket unix 3 [ ] STREAM CONNECTED 15807 unix 3 [ ] STREAM CONNECTED 15640 @/var/run/hald/dbus-E3q2BlZHJH I've attached a text-file containing as much of netstat's output as I can. Thanks. Attached Files netstat.txt (12.7 KB, 51 views)
Posted by bitserve, 01-10-2008, 01:41 AM
The part at the top probably would have been more helpful. Try netstat -tupan. However, it seems likely that just looking at your web server's logs or doing an strace on the web server daemon would help you find out what was going on.
Posted by Mechromancer, 01-10-2008, 02:20 AM
Ok, I did netstat -tupan and attached the results in a text-file below. It's most stuff like: tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:218.6.150.77:2333 TIME _WAIT - tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:12.217.91.159:63913 TIME _WAIT - tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:65.78.94.103:3731 TIME _WAIT - tcp 0 0 ::ffff:72.167.43.95:80 ::ffff:76.246.47.167:4187 TIME _WAIT - Attached Files netstat 2.txt (9.8 KB, 51 views)
Posted by psyxakias, 01-13-2008, 04:43 AM
During the problem, use tcpdump to check if your server actually receives any web traffic and try to surf the site to check if your IP will appear on the list: - If it does but it doesn't respond back, then you may have to check server-related issues (firewall, daemon or even an incoming attack) - If it doesn't, then your provider may be blocking the IP/port for some reason (i.e incoming attack or different issue)