Tomcat6、Lambda Probe、来自“未知”的大量会话
我正在运行一个经常“崩溃”的电子商务网站。通常，我会看到打开的会话数量惊人（正常情况下为 600-900 个，崩溃时为 5000-20000 个）。我想确定这些会话的起源。
我正在尝试使用 Lambda Probe，但似乎没有帮助。大多数会话都在会话视图中列出，并带有未知的“最后一个 IP”。
这种情况要么是 DoS 攻击，要么是应用程序内部的某些逻辑问题，我想确定是哪一种。有没有比 Lambda Probe 会话视图更准确地确定会话来源的方法？或者是否有参数可以修复这个“未知”的显示？毕竟，如果打开会话，某处必定存在 SYN 数据包，并且该数据包将具有 IP 地址。
最后，我有一个自写的过滤器来将活动会话存储在内存中以便在程序中显示，但是当发生这种情况时，服务器没有足够的资源来显示此列表。
任何帮助将不胜感激。
I'm running an e-Commerce site which "crashes" regularily. Usually, I'm seeing an insane number of sessions open (600-900 on normal days, 5000-20000 on crashes). I would like to determine where these sessions originate.
I'm trying to use Lambda Probe, but it doesn't seem to help. Most sessions there are listed in the sessions view with an unknwon "Last IP".
This occurence is either a DoS attack or some logic problem inside the application, and I would like to determine which it is. Is there any way to more accurately determine the origin of a session than the Lambda Probe session view? Or are there parameters to fix this "unknown" display? After all, if a session is opened, there had to be a SYN packet somewhere, and this would have had an IP address.
Lastly, I have a self-written filter to store the active sessions in memory for display in the program, but when this happens, the server does not have enough resources left to display this list.
Any help will be greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果有人对此仍然感兴趣：这实际上是一次 DoS 攻击。由于几乎没有任何好的方法来阻止为尚未见过的请求创建会话（当然，cookie 和会话 ID 会从请求中删除），因此我们最终通过为此目的使用专用的防火墙规则来解决此问题。
If anybody's interested in this still: It actually was a DoS attack. As there's hardly any good way to prevent the creation of a session for a request that hasn't been seen yet (cookies and session-ids are stripped from the requests of course), we finally solved this by using dedicated firewall rules for this purpose.