服务器被攻击

Question

117.80.44.38 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
118.182.92.126 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 284
58.213.163.162 - - [03/Mar/2010:09:02:45 -0800] "GET /jiangyou1.txt HTTP/1.1" 404 286
119.112.121.138 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 284
219.159.103.42 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
125.37.186.182 - - [03/Mar/2010:09:02:45 -0800] "GET /jiangyou10.txt HTTP/1.1" 404 287
112.82.37.206 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
118.122.119.89 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
118.122.119.89 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
119.0.94.153 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
61.185.221.180 - - [03/Mar/2010:09:02:45 -0800] "GET /jiangyou5.txt HTTP/1.1" 404 286
111.73.4.168 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
218.1.102.118 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
218.25.78.162 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
218.66.162.132 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
222.74.58.222 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 284
125.75.232.32 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 284
222.218.209.141 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 285
121.228.84.179 - - [03/Mar/2010:09:02:43 -0800] "GET / HTTP/1.1" 200 17402
59.52.122.86 - - [03/Mar/2010:09:02:45 -0800] "GET /2.txt HTTP/1.1" 404 284
58.213.163.162 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou1.txt HTTP/1.1" 404 286
113.13.118.130 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
112.82.37.206 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
218.108.69.246 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
220.176.35.239 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
218.1.102.118 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
218.72.232.241 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
116.238.106.124 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
218.61.128.210 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
125.75.232.32 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
59.41.141.58 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
218.25.78.162 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
125.167.179.181 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
121.229.135.119 - - [03/Mar/2010:09:05:03 -0800] "GET / HTTP/1.1" 200 17401
58.117.144.225 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou10.txt HTTP/1.1" 404 287
59.33.45.151 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
220.187.52.116 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
218.104.134.50 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.0" 404 285
202.100.121.78 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
222.42.116.22 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
222.133.92.235 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
220.173.141.150 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
222.66.6.18 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou5.txt HTTP/1.1" 404 286
122.5.127.187 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
115.57.133.94 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou5.txt HTTP/1.1" 404 286
125.72.208.150 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
125.211.123.123 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
58.50.111.122 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou10.txt HTTP/1.1" 404 287
120.1.7.83 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
117.32.129.214 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
61.163.38.64 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
119.60.84.136 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
116.30.218.252 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
124.165.147.41 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
123.133.253.221 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou10.txt HTTP/1.1" 404 287
113.83.210.179 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou9.txt HTTP/1.1" 404 286
222.91.146.126 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
95.14.50.82 - - [03/Mar/2010:09:05:05 -0800] "GET /jiangyou3.txt HTTP/1.1" 404 286
222.218.209.141 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 285
113.240.239.74 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.1" 404 284
219.159.103.42 - - [03/Mar/2010:09:05:05 -0800] "GET /2.txt HTTP/1.

系统负载很大。
apache log 大量的这种信息，如何用iptables封

Answer 1

前一段也有个这样的帖子。能统计出来单位时间内有多少Get请求吗

Answer 2

本帖最后由 liang3391 于 2010-03-03 18:32 编辑

很多，给系统的负载非常大，iptables怎么封比较好，攻击ip太多了。

Answer 3

在 .htaccess 里面把 .txt 全部丢掉？

Answer 4

CC ?

maybe you need more servers .

Answer 5

很多，给系统的负载非常大，iptables怎么封比较好，攻击ip太多了。
liang3391 发表于 2010-03-03 18:30

能否有一个大致的数值，另外你的server单位时间内可以接受多少Get请求，也最好有个数值。先从这个角度看一下强度有多大。

如果不同的IP同时发起过多的GET请求，基本上可以理解为CC攻击。对待这种攻击，估计单靠iptables现有的功能未必有效而合理的解决该问题。

Answer 6

能否有一个大致的数值，另外你的server单位时间内可以接受多少Get请求，也最好有个数值。先从这个角度看一 ...
Godbach 发表于 2010-03-05 00:58

    如果是CC，通常会请求一个动态页面，增加对web服务端的负载。 我倒是怀疑是 一些下载工具或错误的盗链之类的，建议LZ注意观察一下来源的 user agent

Answer 7

跟换ip解决了。