[vpsFree.cz: community-list] mnoho spojení SYN_RECV - DDOS botnet?

Fri Nov 1 07:52:18 CET 2019

Ahoj,

ono by pomohlo i zkontrolovat výpis (32 cpu? 4x víc než přiděleno?) od
conntrack-tools  ... např.

# conntrack -S
cpu=0           entries=253 searched=6477 found=1922571 new=216594
invalid=125749 ignore=56794 delete=294449 delete_list=176172
insert=98317 insert_failed=0 drop=0 early_drop=0 icmp_error=125377
expect_new=0 expect_create=0 expect_delete=0
cpu=1           entries=253 searched=1393 found=530132 new=18124
invalid=31 ignore=17394 delete=111863 delete_list=111852 insert=18113
insert_failed=0 drop=0 early_drop=0 icmp_error=4 expect_new=0
expect_create=0 expect_delete=0
cpu=2           entries=253 searched=10696 found=1767389 new=330110
invalid=126079 ignore=30864 delete=339137 delete_list=144911
insert=135884 insert_failed=0 drop=0 early_drop=0 icmp_error=125536
expect_new=0 expect_create=0 expect_delete=0
cpu=3           entries=253 searched=15116 found=3554646 new=338689
invalid=126828 ignore=148946 delete=380967 delete_list=184474
insert=142196 insert_failed=0 drop=0 early_drop=0 icmp_error=125521
expect_new=0 expect_create=0 expect_delete=0
cpu=4           entries=253 searched=10035 found=1548869 new=342939
invalid=126380 ignore=27917 delete=297105 delete_list=101731
insert=147565 insert_failed=0 drop=0 early_drop=0 icmp_error=125763
expect_new=0 expect_create=0 expect_delete=0
cpu=5           entries=253 searched=5346 found=257153 new=135449
invalid=188 ignore=11431 delete=112532 delete_list=34915 insert=57832
insert_failed=0 drop=0 early_drop=0 icmp_error=13 expect_new=0
expect_create=0 expect_delete=0
cpu=6           entries=253 searched=408 found=108223 new=3179
invalid=27 ignore=4626 delete=23704 delete_list=23691 insert=3166
insert_failed=0 drop=0 early_drop=0 icmp_error=1 expect_new=0
expect_create=0 expect_delete=0
cpu=7           entries=253 searched=4468 found=983602 new=188071
invalid=125103 ignore=17795 delete=168153 delete_list=51847 insert=71765
insert_failed=0 drop=0 early_drop=0 icmp_error=124705 expect_new=0
expect_create=0 expect_delete=0
cpu=8           entries=253 searched=1049 found=277266 new=7887
invalid=3 ignore=14849 delete=9600 delete_list=9600 insert=7887
insert_failed=0 drop=0 early_drop=0 icmp_error=0 expect_new=0
expect_create=0 expect_delete=0
cpu=9           entries=253 searched=929 found=197947 new=7437 invalid=3
ignore=10731 delete=8287 delete_list=8287 insert=7437 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=10          entries=253 searched=231 found=75693 new=3558 invalid=3
ignore=7000 delete=5247 delete_list=5247 insert=3558 insert_failed=0
drop=0 early_drop=0 icmp_error=1 expect_new=0 expect_create=0
expect_delete=0
cpu=11          entries=253 searched=496 found=97357 new=4107 invalid=9
ignore=5501 delete=4421 delete_list=4421 insert=4107 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=12          entries=253 searched=310 found=35788 new=2183 invalid=5
ignore=4102 delete=2843 delete_list=2843 insert=2183 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=13          entries=253 searched=82 found=21521 new=1490 invalid=2
ignore=2653 delete=1992 delete_list=1992 insert=1490 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=14          entries=253 searched=137 found=23261 new=1490 invalid=2
ignore=1784 delete=1625 delete_list=1625 insert=1490 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=15          entries=253 searched=55 found=9952 new=857 invalid=0
ignore=1680 delete=1185 delete_list=1185 insert=857 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=16          entries=253 searched=5826 found=351693 new=138139
invalid=147 ignore=17533 delete=100788 delete_list=23756 insert=61107
insert_failed=1 drop=0 early_drop=0 icmp_error=9 expect_new=0
expect_create=0 expect_delete=0
cpu=17          entries=253 searched=10345 found=1172446 new=327121
invalid=125891 ignore=29652 delete=228624 delete_list=34736
insert=133233 insert_failed=0 drop=0 early_drop=0 icmp_error=125288
expect_new=0 expect_create=0 expect_delete=0
cpu=18          entries=253 searched=5489 found=1309259 new=196508
invalid=125754 ignore=22188 delete=165059 delete_list=47384 insert=78833
insert_failed=0 drop=0 early_drop=0 icmp_error=125368 expect_new=0
expect_create=0 expect_delete=0
cpu=19          entries=253 searched=4695 found=1117231 new=195003
invalid=126420 ignore=21675 delete=286973 delete_list=168990
insert=77020 insert_failed=0 drop=0 early_drop=0 icmp_error=126071
expect_new=0 expect_create=0 expect_delete=0
cpu=20          entries=253 searched=430 found=91305 new=3728 invalid=3
ignore=4396 delete=11207 delete_list=11205 insert=3726 insert_failed=0
drop=0 early_drop=0 icmp_error=1 expect_new=0 expect_create=0
expect_delete=0
cpu=21          entries=253 searched=98 found=30599 new=2038 invalid=5
ignore=3166 delete=5839 delete_list=5839 insert=2038 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=22          entries=253 searched=5146 found=398966 new=133045
invalid=147 ignore=8667 delete=84267 delete_list=6735 insert=55513
insert_failed=1 drop=0 early_drop=0 icmp_error=7 expect_new=0
expect_create=0 expect_delete=0
cpu=23          entries=253 searched=5892 found=312510 new=132864
invalid=136 ignore=8578 delete=83717 delete_list=6423 insert=55570
insert_failed=1 drop=0 early_drop=0 icmp_error=9 expect_new=0
expect_create=0 expect_delete=0
cpu=24          entries=253 searched=701 found=109546 new=2616 invalid=2
ignore=5716 delete=2698 delete_list=2698 insert=2616 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=25          entries=253 searched=311 found=65923 new=2144 invalid=5
ignore=7936 delete=2544 delete_list=2544 insert=2144 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=26          entries=253 searched=213 found=39709 new=1665 invalid=20
ignore=4651 delete=1712 delete_list=1712 insert=1665 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=27          entries=253 searched=62 found=32462 new=2139 invalid=5
ignore=4790 delete=2349 delete_list=2349 insert=2139 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=28          entries=253 searched=77 found=19951 new=1579 invalid=12
ignore=3399 delete=1619 delete_list=1619 insert=1579 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=29          entries=253 searched=60 found=15739 new=1353 invalid=2
ignore=2175 delete=1323 delete_list=1323 insert=1353 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=30          entries=253 searched=40 found=9898 new=999 invalid=4
ignore=1401 delete=1066 delete_list=1066 insert=999 insert_failed=0
drop=0 early_drop=0 icmp_error=0 expect_new=0 expect_create=0
expect_delete=0
cpu=31          entries=253 searched=33 found=9472 new=942 invalid=9
ignore=1322 delete=899 delete_list=899 insert=942 insert_failed=0 drop=0
early_drop=0 icmp_error=0 expect_new=0 expect_create=0 expect_delete=0
conntrack v1.4.5 (conntrack-tools): Operation failed: Invalid argument

Přičemž

man conntrack

       -S, --stats
              Show the in-kernel connection tracking system statistics.

A aktuální kernel je:

# uname -a
Linux hostname 3.16.6-042stab139.44 #1 SMP Sat Aug 17 02:58:37 CEST 2019
x86_64 Intel(R) Xeon(R) CPU E5-2630 v3 @ 2.40GHz GenuineIntel GNU/Linux

S pozdravem

Vencour

On 29. 10. 19 15:28, Petr Parolek wrote:
> Ahoj,
>
> už několik dnů na mé VPS pozoruju mnoho spojení se stavem SYN_RECV
>
> viz: netstat -anp |grep 'SYN_RECV' | awk '{print $5}' | cut -d: -f1 |
> sort | uniq -c | sort -n
>      23 xxx.xxx.xxx.xxx
>      23 xxx.xxx.xxx.xxx
> ...
>
> okolo 20 IP adres.
>
> Mám se tím znepokojovat nebo je vše ok a vše by se mělo řešit na infrastruktuře?
>
> Díky moc za postřehy a rady
>
>
> Petr
> _______________________________________________
> Community-list mailing list
> Community-list at lists.vpsfree.cz
> http://lists.vpsfree.cz/listinfo/community-list