Page 1 of 1

big trafice surge today

Posted: Sat Jun 18, 2005 2:38 pm
by mdbusa
getting tons of users on line now at 258 when it normally is less than 20
page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on.

Any insight??

Posted: Sat Jun 18, 2005 3:15 pm
by Nephrus
Search engine bots most likely. Do a look up on them through the admin panel.

Posted: Sat Jun 18, 2005 3:20 pm
by mdbusa
over 350 now
they are mostly unique ips --i.e not many duplicates.

I just installed the static pages mod about a week ago--wonder if that has anything to do with it

Re: big trafice surge today

Posted: Sat Jun 18, 2005 4:02 pm
by Ms Givings
mdbusa wrote: getting tons of users on line now at 258 when it normally is less than 20 page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on. Any insight??

Snap - same here on UK-based board. Same pattern. In fact that's the reason I logged in - to see if there was anything odd going down like another security vulnerability. ;-)

We peaked at 40 users ten minutes ago. It's now down to 17. The usual number is 2 or 3. The flood started at 3.45 BST (10.45am EST) and is still going on now at 17.00 BST. Most of the IP's trace to ISP's in the US, but several to German, Russian and Chinese souces. Ring any alarm bells!??!

Our board's at 2.0.15 and the ACP is locked down tighter than an Ohio virgin's drawers, so we should be OK if this is an attacker looking for vulnerabilities. I've just checked phpMyadmin and there are no new admin users nor any tampering with the structure or content of our d/b that I can see. I suggest you check your d/b too just to be safe.

It's not SE bots. I recognise all the usual IP's we get and they're not involved in this flood.

Hope that's of some help.

Best wishes,

Posted: Sat Jun 18, 2005 4:06 pm
by Quinn1981
I constantly have to work around heavy traffic vs DoS type attacks it seems... as long as your server is hanging in there and performing like you want, I wouldn't worry about it.

I do notice slow network performance today though. I did some traces on a few IPs while monitoring packets and found a few hops to time out here and there. Seems to be a surge to traffic everywhere. I only think this to be true because my server seems to be running fine ATM. Although, I must admit I was having apache take poos on me a week ago.

Re: big trafice surge today

Posted: Sat Jun 18, 2005 4:07 pm
by mdbusa
Ms Givings wrote:
mdbusa wrote:getting tons of users on line now at 258 when it normally is less than 20 page views are normal--seems like moslty unique ips connecting-traced several to various hostsing sites and a few other web sites--dont know whats going on. Any insight??

Snap - same here on UK-based board. Same pattern. In fact that's the reason I logged in - to see if there was anything odd going down like another security vulnerability. ;-)

We peaked at 40 users ten minutes ago. It's now down to 17. The usual number is 2 or 3. The flood started at 3.45 BST (10.45am EST) and is still going on now at 17.00 BST. Most of the IP's trace to ISP's in the US, but several to German, Russian and Chinese souces. Ring any alarm bells!??!

Our board's at 2.0.15 and the ACP is locked down tighter than an Ohio virgin's drawers, so we should be OK if this is an attacker looking for vulnerabilities. I've just checked phpMyadmin and there are no new admin users nor any tampering with the structure or content of our d/b that I can see. I suggest you check your d/b too just to be safe.

It's not SE bots. I recognise all the usual IP's we get and they're not involved in this flood.

Hope that's of some help.

Best wishes,


Yes seems to be same pattern-mine started about 12:30 PM bangkok time

I have 2.015 but thats about it--i will check on admins-but how do i check??

Re: big trafice surge today

Posted: Sat Jun 18, 2005 4:35 pm
by Ms Givings
mdbusa wrote: i will check on admins-but how do i check??

You need access to phpMyAdmin on your server. That will show you your database structure and table data.
You need to find the table called 'php_users' and browse for any users with the user_level of 1. 1 = admin rights. Only you and anyone else you have given Admin rights to should show up in that table with that user level. All the others should be either 2 (= moderators) or 0 (registered users).

Hope that helps.

FWIW, guests are down to 17 now.. Which suggest that someone's getting bored. Just as well because I'd like to bugger off and enjoy our short Summer (I'm in London) rather than watching a bloody forum! ;-)

Posted: Sat Jun 18, 2005 4:41 pm
by mdbusa
Thanks--i did not find any other admins--

Posted: Sat Jun 18, 2005 4:46 pm
by Ms Givings
mdbusa wrote: Thanks--i did not find any other admins--

I'm glad to hear it. Like 'Quinn1981' said, if your board is bang up to date, you back up your DB daily and have no insecure mods you should be OK.

I'm off to enjoy the sunshine now!
Best wishes,

Posted: Sat Jun 18, 2005 4:50 pm
by mdbusa
Ms Givings wrote:
mdbusa wrote:Thanks--i did not find any other admins--

I'm glad to hear it. Like 'Quinn1981' said, if your board is bang up to date, you back up your DB daily and have no insecure mods you should be OK.

I'm off to enjoy the sunshine now!
Best wishes,


How do you automate your backup to do it every day??

I have been using export function from MyPHP admin

Posted: Sat Jun 18, 2005 7:25 pm
by geocator
There are several way, if you can set up cron jobs that is teh easiest. If not you can write a script that does a psedo cron thing. And last is to write a script on your own home computer that runs at a specified time and grabs it.

Posted: Sun Jun 19, 2005 1:24 am
by mdbusa
geocator wrote: There are several way, if you can set up cron jobs that is teh easiest. If not you can write a script that does a psedo cron thing. And last is to write a script on your own home computer that runs at a specified time and grabs it.


Thanks-Ill see if I can find the time to figure out how that works