460 Attacks from 127.0.0.1
460 Attacks from 127.0.0.1
Hello,
Please how can I ban attacks from 127.0.0.1 :
76 68.180.230.41
9 105.108.88.176
10 196.46.249.218
15 109.239.235.247
16 105.102.88.44
18 105.101.27.145
8 2400
460 127.0.0.1
Thank you
Please how can I ban attacks from 127.0.0.1 :
76 68.180.230.41
9 105.108.88.176
10 196.46.249.218
15 109.239.235.247
16 105.102.88.44
18 105.101.27.145
8 2400
460 127.0.0.1
Thank you
Re: 460 Attacks from 127.0.0.1
If you really are being attacked from 127.0.0.1, then it is too late -- your machine is already compromised. 127.0.0.1 is the "loopback" interface: your own machine.hafied1 wrote:Hello,
Please how can I ban attacks from 127.0.0.1 :
76 68.180.230.41
9 105.108.88.176
10 196.46.249.218
15 109.239.235.247
16 105.102.88.44
18 105.101.27.145
8 2400
460 127.0.0.1
Thank you
Why do you think that you are being attacked from 127.0.0.1? Perhaps you are mis-reading some logs?
Re: 460 Attacks from 127.0.0.1
When I use this command :
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
11 109.239.235.247
18 105.102.88.44
19 105.101.27.145
9 2400
331 127.0.0.1
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
11 109.239.235.247
18 105.102.88.44
19 105.101.27.145
9 2400
331 127.0.0.1
Re: 460 Attacks from 127.0.0.1
Those are open connections, not attacks.
Re: 460 Attacks from 127.0.0.1
Comment les bloquer car des fois j'ai plus de 600 connections ce qui bloque le serveuravij wrote:Those are open connections, not attacks.
Re: 460 Attacks from 127.0.0.1
How about the output of this?
Code: Select all
sudo netstat -tupn | grep 127.0.0.1 | gawk '{print $NF}' | uniq -c
-- Jeremy --
Re: 460 Attacks from 127.0.0.1
1 23841/php-fpm
1 -
1 23828/php-fpm
1 3089/memcached
1 -
1 23826/php-fpm
1 -
1 23850/php-fpm
1 -
1 23839/php-fpm
1 23829/php-fpm
2 -
1 3089/memcached
2 -
1 23840/php-fpm
4 3089/memcached
1 23838/php-fpm
5 -
1 23834/php-fpm
1 23836/php-fpm
1 -
1 3089/memcached
1 -
3 3089/memcached
1 -
1 3916/varnishd
1 3089/memcached
2 -
1 23835/php-fpm
1 -
1 3089/memcached
1 3916/varnishd
1 17920/nginx
2 -
1 23843/php-fpm
1 -
1 3089/memcached
1 23842/php-fpm
1 -
3 3089/memcached
1 -
1 3089/memcached
2 -
1 17922/nginx
1 3916/varnishd
1 23833/php-fpm
1 3089/memcached
1 -
1 3916/varnishd
1 -
1 23847/php-fpm
1 3089/memcached
1 23830/php-fpm
1 17922/nginx
2 -
1 3089/memcached
1 -
1 23837/php-fpm
4 -
1 17922/nginx
1 -
1 3089/memcached
1 -
1 23832/php-fpm
1 -
1 23849/php-fpm
1 3089/memcached
3 -
2 3916/varnishd
1 17920/nginx
1 -
1 3089/memcached
1 23845/php-fpm
2 3916/varnishd
1 -
1 23844/php-fpm
1 3089/memcached
1 -
1 23827/php-fpm
1 23831/php-fpm
1 17920/nginx
4 -
1 3089/memcached
1 -
1 17922/nginx
1 -
1 23848/php-fpm
2 -
1 23846/php-fpm
1 -
1 -
1 23828/php-fpm
1 3089/memcached
1 -
1 23826/php-fpm
1 -
1 23850/php-fpm
1 -
1 23839/php-fpm
1 23829/php-fpm
2 -
1 3089/memcached
2 -
1 23840/php-fpm
4 3089/memcached
1 23838/php-fpm
5 -
1 23834/php-fpm
1 23836/php-fpm
1 -
1 3089/memcached
1 -
3 3089/memcached
1 -
1 3916/varnishd
1 3089/memcached
2 -
1 23835/php-fpm
1 -
1 3089/memcached
1 3916/varnishd
1 17920/nginx
2 -
1 23843/php-fpm
1 -
1 3089/memcached
1 23842/php-fpm
1 -
3 3089/memcached
1 -
1 3089/memcached
2 -
1 17922/nginx
1 3916/varnishd
1 23833/php-fpm
1 3089/memcached
1 -
1 3916/varnishd
1 -
1 23847/php-fpm
1 3089/memcached
1 23830/php-fpm
1 17922/nginx
2 -
1 3089/memcached
1 -
1 23837/php-fpm
4 -
1 17922/nginx
1 -
1 3089/memcached
1 -
1 23832/php-fpm
1 -
1 23849/php-fpm
1 3089/memcached
3 -
2 3916/varnishd
1 17920/nginx
1 -
1 3089/memcached
1 23845/php-fpm
2 3916/varnishd
1 -
1 23844/php-fpm
1 3089/memcached
1 -
1 23827/php-fpm
1 23831/php-fpm
1 17920/nginx
4 -
1 3089/memcached
1 -
1 17922/nginx
1 -
1 23848/php-fpm
2 -
1 23846/php-fpm
1 -
Re: 460 Attacks from 127.0.0.1
Looks like we're just talking about a busy web server...
-- Jeremy --
Re: 460 Attacks from 127.0.0.1
I have strong dedicated server.jyoung wrote:Looks like we're just talking about a busy web server...
Re: 460 Attacks from 127.0.0.1
That's not my point. You're running nginx, php-fpm and memcached on your dedicated server. With the information that you've provided, the number of connections to your loopback address doesn't seem abnormal.
-- Jeremy --