big trafice surge today

The 2.0.x discussion forum has been locked; this will remain read-only. The 3.0.x discussion forum has been renamed phpBB Discussion.
Locked
User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

big trafice surge today

Post by mdbusa »

getting tons of users on line now at 258 when it normally is less than 20
page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on.

Any insight??

User avatar
Nephrus
Former Team Member
Posts: 1178
Joined: Sat Oct 19, 2002 4:05 am
Location: Vancouver, Canada
Contact:

Post by Nephrus »

Search engine bots most likely. Do a look up on them through the admin panel.
[ Zelda Planet - nephrus.net - phpBB Userguide - phpBB Knowledge Base - phpBB.com Forum Rules ]
ABSOLUTELY NO support via PM/IM/email or I'll get a cow to sit on you

User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

Post by mdbusa »

over 350 now
they are mostly unique ips --i.e not many duplicates.

I just installed the static pages mod about a week ago--wonder if that has anything to do with it

Ms Givings
Registered User
Posts: 17
Joined: Tue Feb 22, 2005 10:44 pm

Re: big trafice surge today

Post by Ms Givings »

mdbusa wrote: getting tons of users on line now at 258 when it normally is less than 20 page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on. Any insight??

Snap - same here on UK-based board. Same pattern. In fact that's the reason I logged in - to see if there was anything odd going down like another security vulnerability. ;-)

We peaked at 40 users ten minutes ago. It's now down to 17. The usual number is 2 or 3. The flood started at 3.45 BST (10.45am EST) and is still going on now at 17.00 BST. Most of the IP's trace to ISP's in the US, but several to German, Russian and Chinese souces. Ring any alarm bells!??!

Our board's at 2.0.15 and the ACP is locked down tighter than an Ohio virgin's drawers, so we should be OK if this is an attacker looking for vulnerabilities. I've just checked phpMyadmin and there are no new admin users nor any tampering with the structure or content of our d/b that I can see. I suggest you check your d/b too just to be safe.

It's not SE bots. I recognise all the usual IP's we get and they're not involved in this flood.

Hope that's of some help.

Best wishes,
Miranda
a fool and his honey are soon parted

Quinn1981
Registered User
Posts: 38
Joined: Tue Nov 26, 2002 2:19 am
Location: Lyons, GA, USA
Contact:

Post by Quinn1981 »

I constantly have to work around heavy traffic vs DoS type attacks it seems... as long as your server is hanging in there and performing like you want, I wouldn't worry about it.

I do notice slow network performance today though. I did some traces on a few IPs while monitoring packets and found a few hops to time out here and there. Seems to be a surge to traffic everywhere. I only think this to be true because my server seems to be running fine ATM. Although, I must admit I was having apache take poos on me a week ago.

User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

Re: big trafice surge today

Post by mdbusa »

Ms Givings wrote:
mdbusa wrote:getting tons of users on line now at 258 when it normally is less than 20 page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on. Any insight??

Snap - same here on UK-based board. Same pattern. In fact that's the reason I logged in - to see if there was anything odd going down like another security vulnerability. ;-)

We peaked at 40 users ten minutes ago. It's now down to 17. The usual number is 2 or 3. The flood started at 3.45 BST (10.45am EST) and is still going on now at 17.00 BST. Most of the IP's trace to ISP's in the US, but several to German, Russian and Chinese souces. Ring any alarm bells!??!

Our board's at 2.0.15 and the ACP is locked down tighter than an Ohio virgin's drawers, so we should be OK if this is an attacker looking for vulnerabilities. I've just checked phpMyadmin and there are no new admin users nor any tampering with the structure or content of our d/b that I can see. I suggest you check your d/b too just to be safe.

It's not SE bots. I recognise all the usual IP's we get and they're not involved in this flood.

Hope that's of some help.

Best wishes,


Yes seems to be same pattern-mine started about 12:30 PM bangkok time

I have 2.015 but thats about it--i will check on admins-but how do i check??

Ms Givings
Registered User
Posts: 17
Joined: Tue Feb 22, 2005 10:44 pm

Re: big trafice surge today

Post by Ms Givings »

mdbusa wrote: i will check on admins-but how do i check??

You need access to phpMyAdmin on your server. That will show you your database structure and table data.
You need to find the table called 'php_users' and browse for any users with the user_level of 1. 1 = admin rights. Only you and anyone else you have given Admin rights to should show up in that table with that user level. All the others should be either 2 (= moderators) or 0 (registered users).

Hope that helps.

FWIW, guests are down to 17 now.. Which suggest that someone's getting bored. Just as well because I'd like to bugger off and enjoy our short Summer (I'm in London) rather than watching a bloody forum! ;-)
Miranda
a fool and his honey are soon parted

User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

Post by mdbusa »

Thanks--i did not find any other admins--

Ms Givings
Registered User
Posts: 17
Joined: Tue Feb 22, 2005 10:44 pm

Post by Ms Givings »

mdbusa wrote: Thanks--i did not find any other admins--

I'm glad to hear it. Like 'Quinn1981' said, if your board is bang up to date, you back up your DB daily and have no insecure mods you should be OK.

I'm off to enjoy the sunshine now!
Best wishes,
Miranda
a fool and his honey are soon parted

User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

Post by mdbusa »

Ms Givings wrote:
mdbusa wrote:Thanks--i did not find any other admins--

I'm glad to hear it. Like 'Quinn1981' said, if your board is bang up to date, you back up your DB daily and have no insecure mods you should be OK.

I'm off to enjoy the sunshine now!
Best wishes,


How do you automate your backup to do it every day??

I have been using export function from MyPHP admin

geocator
Registered User
Posts: 16242
Joined: Fri Jan 09, 2004 11:56 pm
Location: On dry land
Contact:

Post by geocator »

There are several way, if you can set up cron jobs that is teh easiest. If not you can write a script that does a psedo cron thing. And last is to write a script on your own home computer that runs at a specified time and grabs it.

User avatar
mdbusa
Registered User
Posts: 103
Joined: Tue Sep 14, 2004 1:44 am
Location: Thailand
Contact:

Post by mdbusa »

geocator wrote: There are several way, if you can set up cron jobs that is teh easiest. If not you can write a script that does a psedo cron thing. And last is to write a script on your own home computer that runs at a specified time and grabs it.


Thanks-Ill see if I can find the time to figure out how that works

Locked

Return to “2.0.x Discussion”