C
counteam
Guest
Hallöchen,
ich arbeite derzeit an einer Seite auf unserem Server. Seid einigen Tagen aber dauert das laden aller Seiten die den Server besetzen sehr lange.
Gut, habe mal einen reboot durchgeführt. Immer noch keine Besserung.
Durch prüfung von Netstats habe ich aber gesehen, dass jemand dauernd connected und waiting-connections hinzufügt. Halt ein kleines Zombie-Network oder was weiß ich:
Wie kann ich nun gezielt alle WAITING-Connections mit iptables herauswerfen/Blocken?
ich arbeite derzeit an einer Seite auf unserem Server. Seid einigen Tagen aber dauert das laden aller Seiten die den Server besetzen sehr lange.
Gut, habe mal einen reboot durchgeführt. Immer noch keine Besserung.
Durch prüfung von Netstats habe ich aber gesehen, dass jemand dauernd connected und waiting-connections hinzufügt. Halt ein kleines Zombie-Network oder was weiß ich:
Debian:~# netstat -s
Ip:
4785714 total packets received
0 forwarded
0 incoming packets discarded
4784322 incoming packets delivered
3145650 requests sent out
1 fragments dropped after timeout
4 reassemblies required
1 packet reassembles failed
Icmp:
3658 ICMP messages received
172 input ICMP message failed.
ICMP-Eingabehistogramm:
destination unreachable: 2965
timeout in transit: 8
redirects: 3
echo requests: 524
echo replies: 1
timestamp request: 1
1239 ICMP messages sent
0 ICMP messages failed
ICMP-Ausgabehistogramm:
destination unreachable: 714
echo replies: 524
timestamp replies: 1
IcmpMsg:
InType0: 1
InType3: 2965
InType5: 3
InType8: 524
InType11: 8
InType13: 1
OutType0: 524
OutType3: 714
OutType14: 1
Tcp:
4325 active connections openings
153193 passive connection openings
944 failed connection attempts
26525 connection resets received
33 connections established
4666437 segments received
3053931 segments send out
73758 segments retransmited
2158 bad segments received.
17615 resets sent
Udp:
16712 packets received
714 packets to unknown port received.
0 packet receive errors
16722 packets sent
UdpLite:
TcpExt:
863 resets received for embryonic SYN_RECV sockets
180 ICMP packets dropped because they were out-of-window
40322 TCP sockets finished time wait in fast timer
439 packets rejects in established connections because of timestamp
101428 delayed acks sent
94 delayed acks further delayed because of locked socket
Quick ack mode was activated 8027 times
49083 packets directly queued to recvmsg prequeue.
86 bytes directly in process context from backlog
7963 bytes directly received in process context from prequeue
592447 packet headers predicted
1 packets header predicted and directly queued to user
1574785 acknowledgments not containing data payload received
1403271 predicted acknowledgments
12 times recovered from packet loss due to fast retransmit
5927 times recovered from packet loss by selective acknowledgements
12 bad SACK blocks received
Detected reordering 46 times using FACK
Detected reordering 31 times using SACK
Detected reordering 59 times using time stamp
80 congestion windows fully recovered without slow start
994 congestion windows partially recovered using Hoe heuristic
6937 congestion windows recovered without slow start by DSACK
1515 congestion windows recovered without slow start after partial ack
17774 TCP data loss events
TCPLostRetransmit: 310
12 timeouts after reno fast retransmit
1293 timeouts after SACK recovery
651 timeouts in loss state
21020 fast retransmits
1971 forward retransmits
6863 retransmits in slow start
20258 other TCP timeouts
9 classic Reno fast retransmits failed
426 SACK retransmits failed
8011 DSACKs sent for old packets
16 DSACKs sent for out of order packets
11742 DSACKs received
18 DSACKs for out of order packets received
1149 connections reset due to unexpected data
251 connections reset due to early user close
2786 connections aborted due to timeout
TCPDSACKIgnoredOld: 4379
TCPDSACKIgnoredNoUndo: 865
TCPSpuriousRTOs: 405
TCPSackShifted: 48280
TCPSackMerged: 30715
TCPSackShiftFallback: 30476
IpExt:
InBcastPkts: 96799
InOctets: 809187381
OutOctets: -1458773930
InBcastOctets: 13677978
Wie kann ich nun gezielt alle WAITING-Connections mit iptables herauswerfen/Blocken?