Hello,
I have a linux server running a video streaming site. My server is equipped with a firewall software and that is it. Recently it is under some attacks that make the load average spike to 30 or more, which makes all video streaming become very slow. I use command to track the IP which has the most connection but it give me a weird result. Like
netstat -atpn |grep :80 |grep -v 8080| awk ‘{print $5}’|awk -F: ‘{print $1}’|sort -n |uniq -c|awk ‘{if ($1 > 10) {print }}’
23 24.17.245.xx
42 24.193.106.xx
75 24.237.178.xx
17 70.161.36.xx
28 72.27.160.xx
18 80.251.207.xx
52 91.22.77.xx
51 91.50.121.xx
54 97.97.220.xx
32 123.19.175.xx
So my IP is 97.97.220.xx and it has 51 connections to the server even though I only watch one video right now.
As soon as I restart Apache, the load average drop to around 1.00 only but after a while when it spikes to 30 again.
What I did before was I just ban all IP which have connection over 60 to the servers but I don’t think it is accurate anymore since my IP (which only stream one video) still has 51 connections.
So I would like a professional help to to strengthen the server, install some more security mods, fixing the current issue of load average and show me how to do the same if I have another server. I am using Cpanel 11.
Be open and bid. I am willing to pay so I need a real professional. Do not bid unless you believe you can enhance a linux and cpanel security.