Detect which IPs are attacking with netstat

[intellivision]

My host tells me my virtual private server (CentOS w/ Plesk) is slowing because it's getting hammered by DOS-style attacks. He told me to use netstat to find the IP addresses that are overloading the server with requests, then block them in the firewall.

The firewall works, but I don't know how to find out which IPs to block.

Here's a small example, in which the IPs have been changed:

[root ~]# netstat ¦ grep tcp
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55479 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55478 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55477 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55487 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55486 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55485 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55485 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55484 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55483 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55482 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55481 TIME_WAIT
tcp 0 0 mydomain.com:http pool-1.1.1.1.ph:55480 TIME_WAIT
tcp 0 0 mydomain.com:http 1.1.1.2:4276 TIME_WAIT
tcp 0 0 mydomain.com:http 1.1.in-addr.arpa:1493 TIME_WAIT
tcp 0 0 mydomain.com:http 1.1.in-addr.arpa:1495 TIME_WAIT

Should I block requests from 1.1.1.1? Is that the bad guy? Should I look for patterns like that?

[LifeinAsia]

Try netstat -n to get the IP addresses.

[lammert]

Don't block all IPs you see in netstat. If you block your own, you won't be able to access your server again. Furthermore some browsers and legitimate proxies access your site with 10 or more concurrent connections, which may look suspicious but in reality isn't. Blocking these IPs may block legitimate visitors.

You should repeatedly call netstat -n and look for patterns. Often DOS attacks don't complete the synchronization phase and let the connection stay in a state called SYNC_WAIT. The goal is to fill your TCP connections buffer which will make new connections impossible. If you see more than one connection from a specific IP which stay in this state, it is probably an attacker.

You should still be careful, because SYNC_WAIT is a legitimate state for all TCP connections which lasts for a period of about 100 msec before the real connection is established, so you may see once in a while normal connections in this state.

[intellivision]

SYNC_WAIT == TIME_WAIT?

I haven't seen any SYNC_WAIT but many (many) TIME_WAITs.

But then again I haven't caught the attacks "live" since I posted this, so the netstat results haven't come -- I don't think -- at the right moments.

Guys, thanks.

[eeek]

SYNC_WAIT == TIME_WAIT?

TIME_WAIT is closed connections. You would normally see those and there can be quite a few.

[intellivision]

Thanks eeek. I ran netstat just now (server is sluggish) and 559 of 582 connections are TIME_WAIT.