Portal Home > Knowledgebase > Articles Database > help me with DDOS??????
help me with DDOS??????
| Posted by tttggg0101, 05-14-2014, 02:03 PM |
| Dear sir,
Recently my website is loading very slowly except the index page.
When we click to any links inside, it loads very slowly, including a page for testing, just echo a message.
The site is based on cakephp 1.3
I tail -f the access file while I am trying to request to the http://mysite.com/users/add, it gives me 2 requests as below:
##############
42.112.90.28 - - [15/May/2014:01:22:16 +0800] "GET /users/login HTTP/1.1" 200 5180 "http://mysite.com/users/add" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"
123.125.71.46 - - [15/May/2014:01:22:45 +0800] "GET / HTTP/1.1" 200 10924 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
########################
42.112.90.28 - - [15/May/2014:01:22:16 +0800] "GET /users/login HTTP/1.1" 200 5180 "http://mysite.com/users/add" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36" : this is from my server.
But the second request is not from my server.
123.125.71.46 - - [15/May/2014:01:22:45 +0800] "GET / HTTP/1.1" 200 10924 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
Is this request ddos? How can I find it and how to solve this problem. The second is not unique, it is random and different at sometimes
Thanks and Regards,
|
| Posted by unmatchedvps, 05-14-2014, 02:08 PM |
| You need to contact your host.
|
| Posted by dedinet_servers, 05-14-2014, 02:10 PM |
| It doesn't seems like a ddos. But I have lots of questions.
Are you on shared hosting or dedicated server or VPS?
Do you know how much bandwidth you're using? What's current memory usage? What's server load?
I guess that's what I'd look at first.
It appears your server might be making a request externally and loading after it receives a response?
Hope this helps a little.
|
| Posted by tttggg0101, 05-14-2014, 02:11 PM |
| Thanks for your reply.
I have contacted them, but I am taking a role as a webmaster, but I dont have experiences about this, So I hope you can help me.
|
| Posted by bear, 05-14-2014, 02:14 PM |
| No, it's a Chinese bot hitting your server at around the same time (updates a search index at baidu). Nothing unusual there, and not related to your request in the logs.
|
| Posted by tttggg0101, 05-14-2014, 02:16 PM |
| Thanks for your reply.
The previous install directadmin in the server, It is a dedicated server and I have the root rights.
This is bandwidth :
Server Stats
Setting Current Usage Allocated
Bandwidth 61.0 MB 0.000 MB
Disk Usage 701.0 MB 0.000 MB
# of Users 0
# of Resellers 0
# of Domains 1 0
# of SubDomains 1 0
POP Email Accounts 3 0
Email Forwarders 0 0
Mailing Lists 0 0
AutoResponders 0 0
Sent Emails 72
Received Emails 0
# of MySQL DBs 0 0
Domain Pointers 0 0
Ftp Accounts 2 0
Load Average 0.00, 0.00, 0.00
This is memory:
Processor Name Intel(R) Xeon(R) CPU E3110 @ 3.00GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 2000.000
Processor Name Intel(R) Xeon(R) CPU E3110 @ 3.00GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 3000.000
Total Memory 4014232 kB
Free Memory 3748912 kB
Total Swap Memory 8387568 kB
Free Swap Memory 8387568 kB
What do you mean with server load?
|
| Posted by tttggg0101, 05-14-2014, 02:31 PM |
| Thanks for your information, But the index page is loading normally, i mean when i go to www.mysite.com, it loads fastly, normally. But when I access any links such as www.mysite.com/users/add or www.mysite.com/aboutus , it loads very slowly, it needs around 10-30 seconds to road,
When checking the apache log, sometimes I see the SIGNUP received. Attemting to restart or UCAUGHT Shutting down,
Do you have any ideas? I think the apache is restarted when I click to any links in my site
|
| Posted by kevincheri, 05-14-2014, 03:08 PM |
| it looks the site needs to be optimized, or its the server. You can ask your host why the site is slow and they will give you with some information.
|
| Posted by bear, 05-14-2014, 03:11 PM |
| Aside from checking the loads as you access things, you can see the headers as it loads using Firefox and the Live HTTP Headers addon. If one page loads fast but not others, you need to see what's on those pages and what it's being asked to do.
Database calls? Scripts running? Remote file calls? Bad coding?
All of these and more could be to blame, and not any DDoS attack. If it was that, it would more likely be all pages.
|
| Posted by dedinet_servers, 05-14-2014, 05:08 PM |
| Based on the information you've given, it looks like the website has some configuration or programming issue that you need to look into. The server looks fast enough with 4G of memory and while old, that Xeon cpu should work just fine still. Load is 0, disk usage is low, bandwidth is very, very low. Another member asked about the database. Where is the database? Another server or localhost?
|
| Posted by tttggg0101, 05-14-2014, 11:08 PM |
| Thanks for your helps.
When I tried to inspect element in chrome,
At the local host, it needs 1-2 seconds to load homepage and around 4 seconds to load the users/add. At the live website, it needs around 3 seconds to load homepage and around 20 seconds to load the users/add.
I tried to create another controller ( MVC, cakephp 1.3) without accessing to the database, that print a message, it is similar, it loads slowly, around 19 seconds.
In the config file, the developer use memcached. But when I remove the connecting to the memcache, it is still similar, nothing changes.
Is it because of rewrite?
The website is located at /home/admin/domains/public_html
and the httpd.conf is located in the directadmin, not /etc/httpd/
The site is using SSL too.
Thanks for your help
|
Add to Favourites 
Print this Article
Also Read
