being DOSed

[meimi]

I have found some IPs are opening 10 HTTP connection. Their IPs are changing
and all IPs are from different ISP network.
What should I do next?
Thanks
Meimi


----- Original Message ----- 
From: "Tuc" <tuc at ttsg.com>
To: "meimi" <meimi_1 at hotmail.com>
Sent: Thursday, April 22, 2004 7:29 AM
Subject: Re: being DOSed


> >
> > Hello,
> >   The bandwidth usage for my server is tripled for 3 hours. When I run
> > "top", I find many httpd process in sbwait status. So, I think someone
is
> > DOSing my server.
> >   How can I check who is DOSing me? and how can I solve it?
> > Thanks
> > Meimi
>
> Quickly :
>
> netstat -an | sort | grep tcp4|more
>
> Look for an IP with alot of connections. (We have a script that
> actually will count this for us, but its not just for FreeBSD so its
> long)
>
> Tuc/TTSG Internet Services, Inc.
>