-1

I'm currently under an Apache DDoS attack and have 13 websites shared under one server. I can use the netstat command to see the # of connections per IP, but not what website they're actually on. I want to sign up with CloudFlare to stop the attack, but I don't know what specific site is being attacked. As one precaution, I've moved the 4 sites I think it could be to different IP's on my server.

I'm using this command to get the IP's and # of occurances:

netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':' '{print $1}' | sort | uniq -c | sort -n

So, is there any way to show what specific website they're on?

Graham
  • 103
  • 2

1 Answers1

2

No, netstat can't tell you that; it works on a level below Apache.

Apache will have to tell you which sites are being hit, generally through the logging mechanism.

sysadmin1138
  • 133,124
  • 18
  • 176
  • 300