How to see if a VPS is being attacked

There are a lot of ways to limit the user's browsing rate, but the effect of restricting IP is there, the site will still be intermittent open, view the use of resources, the CPU is not too high, the bandwidth is not very large, that is, I/O will be a short time rise, such as suddenly jump to a few 10 trillion/second, it seems not to collect the reason

Then check the next VPS connection, with the Xshell connection, enter the command

Netstat-ntu | awk ' {print $} ' | Cut-d:-f1 | Sort | uniq-c | Sort-n

Look at the number of IP threads, if you find that there are high number of IP threads, such as a short time hundreds of of the thread, you can decisively block the IP

But I looked at, and did not appear this kind of situation, what reason?

Here we recommend that you install the iftop, you can monitor the site's traffic situation in real time, found that a short time traffic can be decisively blocked IP

Installation steps look down here, Linux system, Windows cannot install: http://www.66mo.com/article_304.html

Continue every few seconds to a few minutes, enter the above command, observe these IP, probably watched for half an hour, found some clues

There's an IP that's been connected, although the number of threads on the 5 on the line, but continued to go on, there is also a problem, of course, is not entirely, so Baidu under this IP, sometimes online will also have records, I found this IP some bad history, so decisively blocked the ipiptables-i Input-s 219.232.254.**-j DROP

The last one day to see the effect, it is true, the site stabilized