問(wèn)：http://www.diygw.com被惡意攻擊造成負(fù)荷很高   同樣是本環(huán)境下的更外一個(gè)域名http://www.html580.com 是不會(huì)的 都是JAVA程序 請(qǐng)幫忙排除并給出解決方案,http:www.diygw.com被惡意攻擊造成負(fù)荷很高

答：您好，目前使用top命令查看服務(wù)器負(fù)載相對(duì)較低,但查看有執(zhí)行sh命令,請(qǐng)核實(shí)您是否在做一些任務(wù)計(jì)劃,如非必要的任務(wù)計(jì)劃,請(qǐng)先停止此任務(wù)計(jì)劃腳本執(zhí)行后再觀察下,非常感謝您長(zhǎng)期對(duì)我司的支持!

問(wèn)：不是此定時(shí)任務(wù)的原因 ，我已經(jīng)關(guān)閉了 但還是訪問(wèn)不了 是有惡意攻擊來(lái)源 一直占用域名 

問(wèn)：我把程序全部重啟了 發(fā)現(xiàn)了大量的close_wait。 現(xiàn)又恢復(fù)了 能看出從哪里來(lái)的攻擊嗎

答：您好，

您好，核實(shí)停止了任務(wù)計(jì)劃后,cpu負(fù)載降下來(lái)了,通過(guò)服務(wù)器里抓包顯示如下,并沒(méi)有固定的ip對(duì)您服務(wù)器發(fā)起連接請(qǐng)求,當(dāng)前訪問(wèn)www.diygw.com 提示無(wú)法獲取源站數(shù)據(jù),但如把域名直接hosts指向到 127.0.0.1,測(cè)試是可以訪問(wèn)的,并且在服務(wù)器內(nèi)部使用127.0.0.1獲取您站點(diǎn)數(shù)據(jù)也是正常的,當(dāng)前請(qǐng)檢查下您的百度云加速回源地址是否設(shè)置的是127.0.0.1這個(gè)ip,非常感謝您長(zhǎng)期對(duì)我司的支持!

[@ebs-34987 ~]# tcpdump  -i eth0  tcp port 80

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

09:56:28.606857 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:28.606957 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:28.898003 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:28.898086 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [P.], seq 1:494, ack 1, win 29, length 493: HTTP: GET /upload/image/2013/06/resizemybrowser.jpg HTTP/1.1

09:56:28.898108 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], ack 494, win 123, length 0

09:56:28.913122 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 1:2921, ack 494, win 123, length 2920: HTTP: HTTP/1.1 200 OK

09:56:28.913378 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 2921:5841, ack 494, win 123, length 2920: HTTP

09:56:28.913543 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 5841:8761, ack 494, win 123, length 2920: HTTP

09:56:28.913789 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 8761:11681, ack 494, win 123, length 2920: HTTP

09:56:28.914093 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 11681:14601, ack 494, win 123, length 2920: HTTP

09:56:29.201175 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 1461, win 32, length 0

09:56:29.201274 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [P.], seq 14601:17521, ack 494, win 123, length 2920: HTTP

09:56:29.201356 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 2921, win 35, length 0

09:56:29.201378 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 4381, win 38, length 0

09:56:29.201384 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 5841, win 40, length 0

09:56:29.201391 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 7301, win 43, length 0

09:56:29.201396 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 8761, win 46, length 0

09:56:29.201687 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 10221, win 49, length 0

09:56:29.201717 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 11681, win 52, length 0

09:56:29.202276 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 17521:20441, ack 494, win 123, length 2920: HTTP

09:56:29.202351 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 20441:23361, ack 494, win 123, length 2920: HTTP

09:56:29.202404 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 23361:26281, ack 494, win 123, length 2920: HTTP

09:56:29.202466 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 26281:29201, ack 494, win 123, length 2920: HTTP

09:56:29.202541 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 29201:32121, ack 494, win 123, length 2920: HTTP

09:56:29.202776 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 13141, win 55, length 0

09:56:29.202793 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 32121:35041, ack 494, win 123, length 2920: HTTP

09:56:29.202847 IP 127.0.0.1.48360 > 127.0.0.1.http: Flags [.], ack 14601, win 58, length 0

09:56:29.202858 IP 127.0.0.1.http > 127.0.0.1.48360: Flags [.], seq 35041:37961, ack 494, win 123, length 2920: HTTP

09:56:29.231028 IP 127.0.0.1.45190 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.231125 IP 127.0.0.1.http > 127.0.0.1.45190: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.257595 IP 127.0.0.1.62980 > 127.0.0.1.http: Flags [.], ack , win 58, length 0

09:56:29.257671 IP 127.0.0.1.http > 127.0.0.1.62980: Flags [.], ack 1, win 123, length 0

09:56:29.343088 IP 127.0.0.1.38982 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.343176 IP 127.0.0.1.http > 127.0.0.1.38982: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.343251 IP 127.0.0.1.20490 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.343274 IP 127.0.0.1.http > 127.0.0.1.20490: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.343637 IP 127.0.0.1.31838 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.343660 IP 127.0.0.1.http > 127.0.0.1.31838: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.347085 IP 127.0.0.1.16784 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.347125 IP 127.0.0.1.http > 127.0.0.1.16784: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.348862 IP 127.0.0.1.12850 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.348903 IP 127.0.0.1.http > 127.0.0.1.12850: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.351217 IP 127.0.0.1.38988 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:56:29.351262 IP 127.0.0.1.http > 127.0.0.1.38988: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:56:29.367887 IP 127.0.0.1.20490 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.367980 IP 127.0.0.1.20490 > 127.0.0.1.http: Flags [P.], seq 1:557, ack 1, win 29, length 556: HTTP: GET /wp-content/uploads/2013/03/jquery-plugin-zoho-pdf-viewer-5.jpg HTTP/1.1

09:56:29.368010 IP 127.0.0.1.http > 127.0.0.1.20490: Flags [.], ack 557, win 123, length 0

09:56:29.368089 IP 127.0.0.1.31838 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.368108 IP 127.0.0.1.31838 > 127.0.0.1.http: Flags [P.], seq 1:565, ack 1, win 29, length 564: HTTP: GET /wp-content/uploads/2013/03/javascript-embed-pdf-reader-pdfobject-3.jpg HTTP/1.1

09:56:29.368118 IP 127.0.0.1.http > 127.0.0.1.31838: Flags [.], ack 565, win 123, length 0

09:56:29.368396 IP 127.0.0.1.http > 127.0.0.1.20490: Flags [P.], seq 1:728, ack 557, win 123, length 727: HTTP: HTTP/1.1 404 Not Found

09:56:29.368644 IP 127.0.0.1.http > 127.0.0.1.31838: Flags [P.], seq 1:728, ack 565, win 123, length 727: HTTP: HTTP/1.1 404 Not Found

09:56:29.369383 IP 127.0.0.1.12850 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.369422 IP 127.0.0.1.12850 > 127.0.0.1.http: Flags [P.], seq 1:551, ack 1, win 29, length 550: HTTP: GET /wp-content/uploads/2013/03/jquery-media-plugin-pdf-2.jpg HTTP/1.1

09:56:29.369437 IP 127.0.0.1.http > 127.0.0.1.12850: Flags [.], ack 551, win 123, length 0

09:56:29.370009 IP 127.0.0.1.38982 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.370238 IP 127.0.0.1.38982 > 127.0.0.1.http: Flags [P.], seq 1:556, ack 1, win 29, length 555: HTTP: GET /wp-content/uploads/2013/03/javascript-pdf-reader-pdf-js-1.jpg HTTP/1.1

09:56:29.370255 IP 127.0.0.1.http > 127.0.0.1.38982: Flags [.], ack 556, win 123, length 0

09:56:29.370931 IP 127.0.0.1.16784 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.370955 IP 127.0.0.1.16784 > 127.0.0.1.http: Flags [P.], seq 1:569, ack 1, win 29, length 568: HTTP: GET /wp-content/uploads/2013/03/jate-pdf-file-reader-jspdf-6.jpg HTTP/1.1

09:56:29.370965 IP 127.0.0.1.http > 127.0.0.1.16784: Flags [.], ack 569, win 123, length 0

09:56:29.374683 IP 127.0.0.1.38988 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:56:29.374756 IP 127.0.0.1.38988 > 127.0.0.1.http: Flags [P.], seq 1:556, ack 1, win 29, length 555: HTTP: GET /wp-content/uploads/2013/03/jquery-google-pdf-doc-viewer-4.jpg HTTP/1.1

09:56:39.063173 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [.], seq :, ack , win 130, length 2920: HTTP: HTTP/1.1 200

09:56:39.063472 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [.], seq 2920:5840, ack 1, win 130, length 2920: HTTP

09:56:39.063708 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [.], seq 5840:8760, ack 1, win 130, length 2920: HTTP

09:56:39.063879 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [.], seq 8760:11680, ack 1, win 130, length 2920: HTTP

09:56:39.064036 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [.], seq 11680:14600, ack 1, win 130, length 2920: HTTP

09:56:39.087200 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 2920, win 35, length 0

09:56:39.087281 IP 127.0.0.1.http > 127.0.0.1.51102: Flags [P.], seq 14600:14984, ack 1, win 130, length 384: HTTP

09:56:39.087446 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 4380, win 38, length 0

09:56:39.087472 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 5840, win 40, length 0

09:56:39.087482 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 8760, win 46, length 0

09:56:39.087490 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 10220, win 49, length 0

09:56:39.087585 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 11680, win 52, length 0

09:56:39.087827 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 13140, win 55, length 0

09:56:39.087839 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 14600, win 58, length 0

09:56:39.111801 IP 127.0.0.1.51102 > 127.0.0.1.http: Flags [.], ack 14984, win 60, length 0

09:56:39.207108 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [.], ack , win 29, length 0

09:56:39.207193 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [P.], seq 0:687, ack 1, win 29, length 687: HTTP: GET /9674 HTTP/1.1

09:56:39.207218 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], ack 687, win 125, length 0

09:56:39.325925 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], seq 1:2921, ack 687, win 125, length 2920: HTTP: HTTP/1.1 200

09:56:39.326129 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], seq 2921:5841, ack 687, win 125, length 2920: HTTP

09:56:39.326233 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], seq 5841:8761, ack 687, win 125, length 2920: HTTP

09:56:39.326371 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], seq 8761:11681, ack 687, win 125, length 2920: HTTP

09:56:39.326438 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [.], seq 11681:14601, ack 687, win 125, length 2920: HTTP

09:56:39.530448 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [.], ack 1461, win 32, length 0

09:56:39.530529 IP 127.0.0.1.http > 127.0.0.1.39850: Flags [P.], seq 14601:15365, ack 687, win 125, length 764: HTTP

09:56:39.530604 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [.], ack 2921, win 35, length 0

09:56:39.530629 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [.], ack 5841, win 40, length 0

09:56:39.530637 IP 127.0.0.1.39850 > 127.0.0.1.http: Flags [.], ack 5841, win 43, options [nop,nop,sack 1 {8761:10221}], length 0

09:56:44.185515 IP 127.0.0.1.11342 > 127.0.0.1.http: Flags [.], ack , win 60, length 0

09:56:44.185539 IP 127.0.0.1.11342 > 127.0.0.1.http: Flags [.], ack 1461, win 63, length 0

09:57:04.300555 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [S], seq , win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0

09:57:04.300619 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [S.], seq , ack , win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0

09:57:04.319124 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 1, win 29, length 0

09:57:04.319223 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [P.], seq 1:800, ack 1, win 29, length 799: HTTP: GET /upload/image/2012/09/2753.jpg HTTP/1.1

09:57:04.319250 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], ack 800, win 127, length 0

09:57:04.340154 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 1:2921, ack 800, win 127, length 2920: HTTP: HTTP/1.1 200 OK

09:57:04.340288 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 2921:5841, ack 800, win 127, length 2920: HTTP

09:57:04.340363 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 5841:8761, ack 800, win 127, length 2920: HTTP

09:57:04.340427 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 8761:11681, ack 800, win 127, length 2920: HTTP

09:57:04.340576 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 11681:14601, ack 800, win 127, length 2920: HTTP

09:57:04.376799 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 16061, win 60, length 0

09:57:04.376857 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [.], seq 33581:35041, ack 800, win 127, length 1460: HTTP

09:57:04.376914 IP 127.0.0.1.http > hn.kd.ny.adsl.43766: Flags [P.], seq 35041:35263, ack 800, win 127, length 222: HTTP

09:57:04.376945 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 17521, win 63, length 0

09:57:04.383670 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 20441, win 69, length 0

09:57:04.383992 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 21901, win 72, length 0

09:57:04.384009 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 23361, win 75, length 0

09:57:04.384019 IP hn.kd.ny.adsl.43766 > 127.0.0.1.http: Flags [.], ack 24821, win 77, length 0





猜你還會(huì)喜歡下面的內(nèi)容

• 強(qiáng)制https網(wǎng)站無(wú)法打開(kāi)
• 更改服務(wù)器登陸密碼失敗-云服務(wù)器問(wèn)題
• 服務(wù)器IP多地屏蔽-云服務(wù)器問(wèn)題
• 幫掛載一下磁盤-云服務(wù)器問(wèn)題
• 昨天重裝升級(jí)到2012的系統(tǒng) 昨晚又中勒索病毒了
• 升級(jí)到云主機(jī)后網(wǎng)站打不開(kāi)了
• 80端口無(wú)法打開(kāi)-云服務(wù)器問(wèn)題
• 我問(wèn)一下，我在上可以裝虛擬機(jī)么
• cc防護(hù)無(wú)法查看日志-云服務(wù)器問(wèn)題
• 服務(wù)器響應(yīng)慢-云服務(wù)器問(wèn)題
• sql數(shù)據(jù)庫(kù)服務(wù)管理器無(wú)法打開(kāi)
• 為什么啟動(dòng)程序一會(huì)就掛了
• 網(wǎng)站發(fā)布出現(xiàn)問(wèn)題 -云服務(wù)器問(wèn)題
• webar是否需要開(kāi)啟那些web配置？
• 服務(wù)器因受到DDOS攻擊，現(xiàn)在已經(jīng)購(gòu)買了高防服務(wù)了，但是服務(wù)
• 網(wǎng)站后臺(tái)打開(kāi)沒(méi)有內(nèi)容了，查看數(shù)據(jù)庫(kù)也空了，是什么原因呢，還能

熱門標(biāo)簽

其他問(wèn)題云服務(wù)器問(wèn)題域名及賬戶問(wèn)題企業(yè)郵局市場(chǎng)咨詢云服務(wù)器云建站/云站群/小程序虛擬主機(jī)企業(yè)郵箱網(wǎng)絡(luò)知識(shí)域名注冊(cè)域名備案域名商標(biāo)注冊(cè)云主機(jī)更多標(biāo)簽...