Question Poss DDos attack?

[Coopsy]

I would someone please shed any light into this?

I have 100+ domains on my server and 90% off the day, all runs fine. CPU and RAM are very low however, occasionaly, my server just flares to 100% and ALL the domains are somehow being accessed. (attached is a screen shot)

Ive recently installed Juggernaught Firewall and since then, its banned over 1000 IP`s in a few days - so i can see thats working but for some reason this is still happening?

can anyone help?

 

[Bitpalast]

Looks like someone is addressing many domains on your system at the same time. Maybe you can find out more about it by looking into the domains' log files?

 

[Coopsy]

I look through the logs but checking 100+ domains is a very slow and painful process. Is there a way to limit something as legitamatly all 100+ domains are not being accessed at the same time by genuine customers....?

 

[Bitpalast]

Please research online with "iptables rate limiting".

 

[Coopsy]

Please research online with "iptables rate limiting".

THanks. The Juggernaught extension has IP tables and you can set the number of connections per IP. Jugernaught say that its recomended 250 connections - whats your thoughts personally? why would an IP address need more than lets say 50 connections?