<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
Amos Shapira wrote:
<blockquote
cite="mid:9c2cca270906090442y5a3aff8ai36f66e56cf2ce7fa@mail.gmail.com"
type="cite"><br>
<pre wrap="">Maybe a clever iptables rule can count incoming SYN packets on the
relevant ports (we listen on about 4-5 different ports) and then I can
compare it against Apache access log for same period.
</pre>
</blockquote>
No need for anything special. Just do "iptables -L -v" to see how many
hits on each rule. iptables even has command option that give you the
stats and atomically zero the counters. All you need in addition is
grep, and you're almost set.<br>
<blockquote
cite="mid:9c2cca270906090442y5a3aff8ai36f66e56cf2ce7fa@mail.gmail.com"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">while apache log should be easily achievable by grep
</pre>
</blockquote>
<pre wrap=""><!---->
If the TCP-level connection is dropped before an HTTP request is
received then I'm not sure Apache's log will show it (just tried this
on a Ubuntu desktop, don't know how much it indicates for CentOS 5).
</pre>
</blockquote>
Do you count that as a successful connection? It sounds to me like it
is not, which means that apache not listing it is actually a good thing.<br>
<br>
What I would be worried about (not very, mind you) is SYN floods and
other stuff. Some failed TCP connections should not be counted (SYN is
invalid, three way handshake did not complete due to client
considerations, retransmitted SYNs etc.). The only way I can think of
to find those is a sniffer (I don't know of any tcpdump rules that can
match those, and I wouldn't trust its performance anyway, so I think a
dedicated one would work best).<br>
<br>
Shachar<br>
<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>