Determining IP number from php-cgi process

3 posts / 0 new
Topic locked
Last post
#1 Wed, 11/12/2014 - 12:51
edwardsmarkf

Determining IP number from php-cgi process

hello - last week eric was kind enough to explain that each php-cgi process is somebody accessing a website

https://www.virtualmin.com/node/35106

is there any way to determine an IP number for each php-cgi process running? i didnt see anything in the log files that would tie a logfile entry to a php-cgi process.

thank you very much.

Wed, 11/12/2014 - 13:48
andreychek

Howdy,

You'd probably need to do that from within the application. PHP itself knows it's own process ID, as well as the IP address connected to it. But I don't know of a way to do that outside of the app.

Using netstat can give you a some insight there, but I'm not sure it's exactly what you're looking for. But if you run "netstat -anlp", you can see a list of all open connections, and what IP address is associated with them.

You can also use this command to get a list of every IP address connected to your server, sorted by how many open connections they have:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

Wed, 11/12/2014 - 20:59
edwardsmarkf

for the truly ignorant (like me) what he meant to say was:

netstat  --all --numeric   --listening --programs   ;  ## instead of -anlp
netstat --numeric  --tcp  --udp    ;      ##  instead of -ntu

that way newbies can translate from the terse CLI into something more friendly to read. I'm not sure it's exactly what you're looking for. the problem is once or twice a day i will have one website have a couple dozen php-cgi processes started up. its usually some overseas hacker. i have the firewall blocks in place (supposedly) but it does not seem to be foolproof. i have this set in my csf.conf file:

SYNFLOOD = "1"
SYNFLOOD_RATE = "20/s"
SYNFLOOD_BURST = "60"

i also have httpd.conf MaxClients set lower on Eric's recommendation in httpd.conf and this seems to be helping:

<IfModule prefork.c>
StartServers       8
MinSpareServers    5
MaxSpareServers   20
ServerLimit      256
MaxClients       50
MaxRequestsPerChild  4000
</IfModule>
 
<IfModule worker.c>
StartServers         4
MaxClients         50
MinSpareThreads     25
MaxSpareThreads     75
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>
Topic locked