Well lately I have a big problem and only today managed to identify the problem. In some times of day consumption of the CPU reaches 100% after 20% back to normal!
Everything is totally inaccessible, now able to list the processes and saw that the Glinkd was the cause of consumption of 100%.
But because he was consuming 100% if he does not even appear in the list of most active processes? It would be a hack as DDOS attack?
Maybe you should give some infos what CPU is on 100% ...
Oh i see in mah magical glas-ball that you use a virtual server with 2 CPU and your Host PC also has only 2 CPU ... you understand what i want to say ?
We need at least the Info what kind of CPU. One of my cores whould also run to 100% if i just give the server 1 core ...
Sorry:
Intel Core 2 Quad Q9300 2.5GHZ 1333FSB (6MB CACHE)
8GB DDR2
---------- Post added at 12:10 PM ---------- Previous post was at 12:10 PM ----------
Server is dedicated.
Ok, so its not a problem of a CPU setting. Have you checked the log of Glinkd when it reaches 100% ?Originally Posted by lotus55
Whould be nice to know what its doing at this moment. Maybe it will also be nice to know when its doing that, every hour, only at a specific time, random ...
The log Glinkd he is not writing log, I thought it was normal.
Well, it happens at a random moment, I looked in managing the absurd increase bandwidth consumption with the consumption of CPU time of these anomalies.
Soon I am seeking services from attack.
---------- Post added at 01:40 PM ---------- Previous post was at 01:23 PM ----------
its syn flood / dos attack, cause glinkd port 29000, pw server only open port 29000.
So it really is a DDOS attack?
Looks like that. You should check the traffic in such moments and see from where the connections came from. Sniffing pakets should be you job now and see who is doing what.
use firewall.
Not ddos no.
A DDOS would be from more than 1 computer (usualy infected systems) which is quite unlikely in the private server community really. A dos is from 1 person who you can just ip block.
Sometimes however they can hide their IP with ip Spoofing to stop you blocking the right source.
also where does it say 29000?
i think its botnet, botnet have zombie with much ip and controling from 1 person, i have see graphic, its not a big botnet, its small botnet, if got attack from big botnet, ur server will shutingdown for 1 week or 2 weeks
In the graph there, spent two hours to get to the login server and shut it down thereby closing the access. I'm hiring a DDOS protection server-level, I hope that solves the problem.
The first thing you should ask yourself is: "Why is someone doing that to ME ?"
the second thing is: "What can i do against this ?"
and the third thing: "Who is that ***** ****** ***** ****** ( censored words) that is doing this ****** ***** ****** ( again ... )"
if its a botnet it decreases the chances of it happening again, since the infected user will proberly notice it and fix it. You have to let the botnet amount go back up again.
if its a single user then you need to ip block them before they do it again.
firewalls have varius ways to blocking mass syn flooding (syn is a small peice of data sent to start a tcp connection and makes the server use as much cpu as possible for the smallest data sent). Look into ip tables --limit and --hash-limit functions, they work to block it.
A good way to reduce a constant ddos attack is to inform your server hoster, who will then work to remove other servers from your internet line so they are not affected, giving you more room to breath. ofc this only works on shared lines (which are 90% of them).
The service counter will cause any abnormality is temporarily blocked. Example it will examine all connections for a certain period if something abnormal occurs it blocks the same. Any connection to the server will go through a review of network analysis before.
It's normal in Brazil.
Cursed be those fuckers that attack because he is afraid of losing players on their servers. --'
Reply With Quote
