Re: htdig and sources.redhat.com loadavg

[Ian Lance Taylor <ian@wasabisystems.com>]

Jonathan Larmour <jifl@eCosCentric.com> writes:

>  From a brief poke myself (and I'm no overseer) I'd hazard a guess it
> may be more to do with the 17 simultaneous cvs checkouts as well as 2
> rsyncs and a couple of ftps. netstat also seems to be reporting a TCP
> SYN attack from tproxy1.NTCU.net (62 sockets in SYN_RECV state).
> 
> I don't know about the "supervise" thingy but I know xinetd has a
> "max_load" parameter that could be used to e.g. deny anonymous (not
> logged in) cvs over a certain load (since having 10 cvs operations
> complete two times is better than 20 cvs operations taking nearly
> forever).

We only permit 10 simultaneous anonymous CVS connections.  However,
there is no limit on the number of CVS operations performed via ssh,
and there are several hundred people with ssh access.

The number of connections from 211.76.240.245 is interesting.  I count
39 connections at the moment, all to port 80.  Looking at the HTTP
logs, though, I don't think it is a TCP_SYN attack.  I think somebody
is downloading the cygwin.com web site, including all the mailing list
messages.

Ian