0

I've been having a problem with my server, and the host is refusing to look into the issue.

It's a dedicated Cent OS machine with DirectAdmin, nothing out of the ordinary, with a PHP/MySQL site running on it.

So I ran a netstat command on the box, and got this (xs in place to mask live data)

netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

1 xx.xx.xx.xx
1 xx.xx.xx.xx
1 xx.xx.xx.xx
109
163 xx.xx.xx.xx
344 xx.xx.xx.xx

The 163, for some reason, is coming from Facebook Ireland. The 344 is from my own server itself - am not sure why, but can't get to the root of the problem either - at times it can balloon up to 500,600 connections.

Any ideas? Am not sure if I should block the Facebook one as not sure why it would need to crawl the site with that many connections.

Thanks a lot!

Jorge B
  • 53
  • 5
  • It might be some application (or your site) is connected with facebook server. use `lsof -i` command to see which app is connected to facebook server. – rakib_ Apr 06 '14 at 08:37
  • Note that "grep :80" can find ports like 8000, which is not what you want. use `grep ":80 "` or `egrep ":80\b"`. Look at the raw data to verify that the requests are coming *FROM* the FB IP, instead of going *TO* the FB IP. – BraveNewCurrency Apr 06 '14 at 22:57

0 Answers0