Easy. netstat is a command line tool to show you live/real network traffic happening in real-time. But when you say access_log and point to the full path like this:
/var/www/vhosts/domain.com/statistics/logs/access_log
That log is generated by the web service on the server. My best guess is it would be Apache generating those logs. And the reason you are seeing a log with less data in access_log versus Apache comes directly from Apache’s ability to handle those connections.
In Apache there is an option to keep a connection alive if it’s coming from the same browser on the same IP address I believe. So if you are setting 32 items connecting to port 80, it could be “keep alive” logic is in place.
Or—more likely—the attack is a classic DDoS attack where a flood of connection requests are made, but they are dropped before the connection even happens. This works in a DDoS sense since Apache needs to be able to respond to those requests, but if the attackers flood of connections “hangs up” before the connections are made… Then no connections would be logged.
So—using your sample data as an example—9 connections are actually being made to Apache. But the remaining 23 requests are just dropping before Apache can do anything.
