httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bob Mahan" <bob.ma...@sbcglobal.net>
Subject RE: [users@httpd] DDOS ATTACK IS IT !!!!!
Date Thu, 31 Jul 2003 19:30:49 GMT
Well the access_log records that you sent for 7/30 didn't show any of
the requests from that IP.  218.104.129.24 appears to be from China from
what I could gather.  As was suggested from another, you could block
that IP at the firewall, but unless that is a static IP on the far end,
they will just grab another IP and start over again.  If your not
interested in people from China getting to your site you could block it
at a higher level (ie. 218.104.129.0/24).  Here's a couple of things I
would also do:

1.) If you don't have any kind of web management/analysis tools like
Webalizer get one

2.) Do some quick and dirty counts on your access log:

cut -d" " -f1 /etc/httpd/logs/access_log* | sort | uniq -c | sort -bnr |
more

3.) scan the access_log(s) for that specific IP address (or others
depending on what you find from the counts) to see what activity they
have been doing

grep "^218.104.129.24" /etc/httpd/logs/access_log* | more

The access_log you showed from a couple of days ago did have some
penetration attempts in it.  I see those same exact URLs all the time on
my sites.  It isn't necessarily FROM a Windoz clients, but attempting to
break INTO a Windoz server.  And yes, the last line (default.ida) is
Code Red, no biggie.

GOOD LUCK!  Hope this helps ;)

Bob Mahan
Network Security Operations 
Phone: (847) 571-5525
mailto:bmahan@nsoco.com
http://www.nsoco.com



> -----Original Message-----
> From: System [mailto:system@eluminoustechnologies.com] 
> Sent: Thursday, July 31, 2003 1:20 AM
> To: users@httpd.apache.org; bmahan@nsoco.com
> Subject: Re: [users@httpd] DDOS ATTACK IS IT !!!!!
> 
> 
> 127.0.0.1 - - [30/Jul/2003:20:40:05 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 46271
> 127.0.0.1 - - [30/Jul/2003:20:58:55 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8335
> 127.0.0.1 - - [30/Jul/2003:21:35:47 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8331
> 216.118.116.105 - - [30/Jul/2003:21:35:52 -0700] "GET / 
> HTTP/1.0" 200 2673
> 127.0.0.1 - - [30/Jul/2003:21:40:12 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 7274
> 127.0.0.1 - - [30/Jul/2003:21:45:24 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 47617
> 127.0.0.1 - - [30/Jul/2003:22:20:36 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8333
> 127.0.0.1 - - [30/Jul/2003:22:25:03 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 35746
> 127.0.0.1 - - [30/Jul/2003:22:30:04 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 47029
> 127.0.0.1 - - [30/Jul/2003:23:10:25 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 38808
> 
> > Does your web sight have any emailing forms?  This could be spammers
> > leveraging your site to do mass mailings.  Go look in your
> > /etc/httpd/logs/access_log and see whats up.
> I am having only one domain which has got a Forum.
> This is the Access_Log which is current:
> 
> 127.0.0.1 - - [30/Jul/2003:20:40:05 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 46271
> 127.0.0.1 - - [30/Jul/2003:20:58:55 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8335
> 127.0.0.1 - - [30/Jul/2003:21:35:47 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8331
> 216.118.116.105 - - [30/Jul/2003:21:35:52 -0700] "GET / 
> HTTP/1.0" 200 2673
> 127.0.0.1 - - [30/Jul/2003:21:40:12 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 7274
> 127.0.0.1 - - [30/Jul/2003:21:45:24 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 47617
> 127.0.0.1 - - [30/Jul/2003:22:20:36 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 8333
> 127.0.0.1 - - [30/Jul/2003:22:25:03 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 35746
> 127.0.0.1 - - [30/Jul/2003:22:30:04 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 47029
> 127.0.0.1 - - [30/Jul/2003:23:10:25 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 38808
> 
> When i checked the log two day before:
> 61.180.119.253 - - [28/Jul/2003:14:43:35 -0700] "GET
> /scripts/root.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:36 -0700] "GET 
> /MSADC/root.exe?/c+dir
> HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:37 -0700] "GET
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:41 -0700] "GET
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:43 -0700] "GET
> /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:44 -0700] "GET
> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:45 -0700] "GET
> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:46 -0700] "GET
> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1
> %1c../winnt/sy
> stem32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:47 -0700] "GET
> /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:48 -0700] "GET
> /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:49 -0700] "GET
> /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:50 -0700] "GET
> /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:51 -0700] "GET
> /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 -
> 61.180.119.253 - - [28/Jul/2003:14:43:53 -0700] "GET
> /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 -
> 61.180.119.253 - - [28/Jul/2003:14:43:54 -0700] "GET
> /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 61.180.119.253 - - [28/Jul/2003:14:43:56 -0700] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
> 127.0.0.1 - - [28/Jul/2003:14:45:01 -0700] "GET 
> /whm-server-status HTTP/1.0"
> 200 94770
> 65.60.187.135 - - [28/Jul/2003:14:46:16 -0700] "GET
> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXX
> XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u909
> 0%u6858%ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0
> 000%u00=a
> HTTP/1.0" 404 -
> 
> But all of this above is I suppose some Virus like 
> Nimda,Code-Red who are
> accessing my webserver from windows machine which is 
> afftected with these
> Viruses Right?
> 
> Help Me to Clear out this problem.
> 
> Regards,
> Tina.
> 
> 
> 
> 
> 
> 5525
> > mailto:bmahan@nsoco.com
> > http://www.nsoco.com
> >
> >
> >
> > > -----Original Message-----
> > > From: System [mailto:system@eluminoustechnologies.com]
> > > Sent: Thursday, July 31, 2003 12:00 AM
> > > To: Apache
> > > Subject: [users@httpd] DDOS ATTACK IS IT !!!!!
> > >
> > >
> > > Hello All,
> > >
> > > The Apache goes up and down and everytime the error remains
> > > the same. Maxclients, I increase the the MaxClients and again
> > > the samething and this has been from quite few days.Why the
> > > hell my Apache says the Following.I have only one domain on
> > > the server which uses a Forum.No other domain. I have also
> > > pasted the netstat result here all requests are from one 
> single ip.
> > >
> > > m I under DDOS ATTACK !
> > >
> > > My Apologizes for long posting :(
> > >
> > > Red Hat Linux release 8.0 (Psyche)
> > >
> > > [Wed Jul 30 21:48:43 2003] [notice] Apache/1.3.28 (Unix)
> > > mod_log_bytes/1.2 mod_bwlimited/1.0 PHP/4.3.2
> > > FrontPage/5.0.2.2634 mod_ssl/2.8.15 OpenSSL/0.9.6b configured
> > > -- resuming normal operations [Wed Jul 30 21:48:43 2003]
> > > [notice] suEXEC mechanism enabled (wrapper:
> > > /usr/local/apache/bin/suexec)
> > > [Wed Jul 30 21:48:43 2003] [notice] Accept mutex: sysvsem
> > > (Default: sysvsem) [Wed Jul 30 21:48:57 2003] [error] server
> > > reached MaxClients setting, consider raising the 
> MaxClients setting
> > >
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38812
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38780
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38808
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         211.144.19.65:26636
> > >  SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38745
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.13.128.163:3286
> > >  SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38757
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38739
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.13.128.163:3296
> > >  SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         61.185.63.21:3597
> > >    SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38811
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38741
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38763
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         220.173.172.243:1520
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.5.84.234:3433
> > >    SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38751
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38790
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38740
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38805
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38756
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38809
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.66.32.99:1090
> > >    SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38776
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38762
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38820
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         61.150.18.211:1341
> > >   SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         220.173.233.254:10073
> > > YN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38806
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38738
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38781
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38760
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38777
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38766
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38817
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38753
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38746
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         61.232.17.146:38664
> > >  SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38785
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38752
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         202.103.33.60:2213
> > >   SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         61.52.78.166:1386
> > >    SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38788
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38742
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38758
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38783
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38786
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.4.198.34:1096
> > >    SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38744
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38775
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38793
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38759
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38774
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         220.170.100.100:3273
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38792
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.4.171.153:2557
> > >   SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38822
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.86.65.107:1325
> > >   SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38770
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         149.99.173.79:3264
> > >   SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38814
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38787
> > > SYN_RECV    -
> > > tcp        0      0 127.0.0.1:80            127.0.0.1:33702
> > >      SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.13.128.163:3294
> > >  SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38778
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38782
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38815
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38789
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38807
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38747
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38810
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38754
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         61.179.125.226:39572
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38755
> > > SYN_RECV    -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38462
> > > ESTABLISHED 4955/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38526
> > > ESTABLISHED 5029/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38334
> > > ESTABLISHED 4880/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38590
> > > ESTABLISHED 5002/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38398
> > > ESTABLISHED 4893/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38654
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38463
> > > ESTABLISHED 4954/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38527
> > > ESTABLISHED 5030/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38591
> > > ESTABLISHED 5003/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38399
> > > ESTABLISHED 4895/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38655
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38460
> > > ESTABLISHED 4952/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38524
> > > ESTABLISHED 5026/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38588
> > > ESTABLISHED 4843/httpd
> > > tcp        0   3808 65.60.37.166:22         61.11.23.226:10435
> > > ESTABLISHED 4774/sshd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38652
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38396
> > > ESTABLISHED 4892/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38461
> > > ESTABLISHED 4953/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38525
> > > ESTABLISHED 5025/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38589
> > > ESTABLISHED 4983/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38653
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38397
> > > ESTABLISHED 4894/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38458
> > > ESTABLISHED 4950/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38522
> > > ESTABLISHED 5023/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38586
> > > ESTABLISHED 5095/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38394
> > > ESTABLISHED 4890/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38650
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38459
> > > ESTABLISHED 4951/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38523
> > > ESTABLISHED 5024/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38587
> > > ESTABLISHED 5096/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38395
> > > ESTABLISHED 4891/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38651
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38456
> > > ESTABLISHED 4948/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38520
> > > ESTABLISHED 5021/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38584
> > > ESTABLISHED 5093/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38328
> > > ESTABLISHED 4835/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38648
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38392
> > > ESTABLISHED 4888/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38457
> > > ESTABLISHED 4949/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38521
> > > ESTABLISHED 5022/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38585
> > > ESTABLISHED 5094/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38649
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38393
> > > ESTABLISHED 4889/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38454
> > > ESTABLISHED 4945/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38710
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38518
> > > ESTABLISHED 5020/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38582
> > > ESTABLISHED 5091/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38390
> > > ESTABLISHED 4886/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38646
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38711
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38455
> > > ESTABLISHED 4947/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38519
> > > ESTABLISHED 5019/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38583
> > > ESTABLISHED 5092/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38391
> > > ESTABLISHED 4887/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38647
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38452
> > > ESTABLISHED 4943/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38708
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38516
> > > ESTABLISHED 5017/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38580
> > > ESTABLISHED 5089/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38644
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38388
> > > ESTABLISHED 4883/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38709
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38453
> > > ESTABLISHED 4946/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38517
> > > ESTABLISHED 5018/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38581
> > > ESTABLISHED 5090/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38645
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38389
> > > ESTABLISHED 4885/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38450
> > > ESTABLISHED 4942/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38706
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38514
> > > ESTABLISHED 5015/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38578
> > > ESTABLISHED 5088/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38386
> > > ESTABLISHED 4882/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38642
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38707
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38451
> > > ESTABLISHED 4944/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38515
> > > ESTABLISHED 5014/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38579
> > > ESTABLISHED 5087/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38387
> > > ESTABLISHED 4884/httpd
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38643
> > > ESTABLISHED -
> > > tcp        0      0 xx.xx.xx.169:80         218.104.129.24:38448
> > > ESTABLISHED 4940/httpd
> > >
> > > Regards,
> > > Tina.
> > >
> > >
> > >
> > > 
> ---------------------------------------------------------------------
> > > The official User-To-User support forum of the Apache HTTP
> > > Server Project. See
> > > <URL:http://httpd.apache.org/userslist.html> for more info.
> > > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> > >    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> > > For additional commands, e-mail: users-help@httpd.apache.org
> > >
> >
> >
> >
> > 
> ---------------------------------------------------------------------
> > The official User-To-User support forum of the Apache HTTP 
> Server Project.
> > See <URL:http://httpd.apache.org/userslist.html> for more info.
> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> >    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> > For additional commands, e-mail: users-help@httpd.apache.org
> >
> >
> >
> >
> 
> 
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> 
> 
> 



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message