Page 1 of 1

My server is being attacked.

Posted: Sat May 12, 2018 7:31 pm
by sharma
My server is having high load on it. I think my server is being attacked by someone.. How can I check the attack? Could you help me?

Re: My server is being attacked.

Posted: Sat May 12, 2018 7:33 pm
by Nadal N
Hello Sharma,

You can check attack from IP’s using the netstat command.

#netstat -tn

This will show the connections from IP’s and ports

You can sort the connections to port 80 and 443 by using the below command.

#netstat -tn 2>/dev/null | grep ':80\|:443' | awk '{print $5}' | cut -f1 -d: | sort | uniq -c | sort -rn | head

This will show the number of connections to port 80 and 443. Block that IP if you find it suspicious.

Nadal N
Linux Support Engineer.
Nixtree Solutions
Managed Full Server Backups
https://www.nixtree.com/managed-backups.php
Follow us on https://twitter.com/nixtree

Re: My server is being attacked.

Posted: Sat May 12, 2018 7:44 pm
by sharma
Haa I got some IP. Thanks man.