cancel
Showing results for 
Search instead for 
Did you mean: 

Curious Networking issue on home web server

Piddles
Hooked
Posts: 9
Thanks: 2
Registered: ‎03-08-2016

Curious Networking issue on home web server

I have a small web server that has been running flawlessly for years on a 80/20 fibre connection with a static IP address, until midday today when the response time for external inbound connections has gone from a reliable 280 milliseconds (I monitor it on www.uptimerobot.com) to 5+ seconds (but sometimes normal), making the site more or less unusable.

The web server response times are normal speeds on the internal network. 

Broadband speed test show download/upload working at normal speeds

Nothing has been changed, beyond turning off everything except my desktop (on which the web server resides), the router and the BT fibre modem.

Server and router rebooted.

Everything is normal except the external inbound connection response times.

Plusnet support are seeing everything as normal. No restrictions.

Plusnet support says you guys are cleverer than them... so here goes: Any ideas?

 PS The static IP address externally produces the same symptoms, so it's not DNS.

10 REPLIES 10
VileReynard
Hero
Posts: 12,613
Thanks: 630
Fixes: 20
Registered: ‎01-09-2007

Re: Curious Networking issue on home web server

And the site is called?

Who provides your DNS servers?

"In The Beginning Was The Word, And The Word Was Aardvark."

Piddles
Hooked
Posts: 9
Thanks: 2
Registered: ‎03-08-2016

Re: Curious Networking issue on home web server

To cut out the DNS layer, the ip address is 212.159.68.138

That will default to error_page.html that just contains the text "Not Found".

Refresh that a couple of times and you should see the problem.

 

VileReynard
Hero
Posts: 12,613
Thanks: 630
Fixes: 20
Registered: ‎01-09-2007

Re: Curious Networking issue on home web server

I tried a rapid download Linux command:-

wget 212.159.68.138
--2018-10-01 17:20:45--  http://212.159.68.138/
Connecting to 212.159.68.138:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://212.159.68.138/error_page.html [following]
--2018-10-01 17:20:52--  http://212.159.68.138/error_page.html
Reusing existing connection to 212.159.68.138:80.
HTTP request sent, awaiting response... 200 OK
Length: 18 [text/html]
Saving to: ‘index.html’

index.html                  100%[=========================================>]      18  --.-KB/s    in 0s      

2018-10-01 17:20:52 (1.09 MB/s) - ‘index.html’ saved [18/18]

Note that it took 7 seconds to download virtually nothing - just 18 bytes on a 70/20 Mbit/sec connection.

BTW Your DNS address reveals what looks like:- 'username.plus.com'

"In The Beginning Was The Word, And The Word Was Aardvark."

Piddles
Hooked
Posts: 9
Thanks: 2
Registered: ‎03-08-2016

Re: Curious Networking issue on home web server

Mmmm, but why so slow on just inbound connections?

Re username.plus.net. Hilarious isn't it. Plusnet wouldn't change it... Anyway I have other domains that point here (I didn't want to promote them here and it's all password protected anyway).

 

picbits
Rising Star
Posts: 3,428
Thanks: 22
Registered: ‎18-01-2013

Re: Curious Networking issue on home web server

Have you tried temporarily disabling your Windows Firewall ?

 

* edit - assuming you're on a Windows machine and it has the firewall enabled of course *

Piddles
Hooked
Posts: 9
Thanks: 2
Registered: ‎03-08-2016

Re: Curious Networking issue on home web server

It's Fedora, and yes it does have a firewall(! Cheesy). It's got to the point that I'll try anything!

picbits
Rising Star
Posts: 3,428
Thanks: 22
Registered: ‎18-01-2013

Re: Curious Networking issue on home web server

Maybe also run a tail -f /var/log/apache/whateveritscalled.log  to see if you can see in real time what is coming through as a request - maybe the request is hitting quickly but the reply is taking time.

picbits
Rising Star
Posts: 3,428
Thanks: 22
Registered: ‎18-01-2013

Re: Curious Networking issue on home web server

I also find iptraf useful on my Ubuntu servers to see what is hitting my machine and when. Not sure on other flavours of Linux but maybe worth a look.

 

Piddles
Hooked
Posts: 9
Thanks: 2
Registered: ‎03-08-2016

Re: Curious Networking issue on home web server

Update: Thanks for those suggestions. It looks like it might be a type of Slowloris DDOS attack, with IP addresses around the world (hosting companies and VPNs) generating about 50 connections each that didn't do much. The command line I used to get the connection info is at the end of the post, should someone find it useful. I'm going to install a Draytek router that I have lying about to try and filter out the problematic IP addresses (probably a thankless task as there are so many of them) and then disable firewalld and use iptables to drop anything with more than 20 connections. Unless anyone has a better idea...?

netstat -ntu -4 -6 |  awk '/^tcp/{ print $5 }' | sed -r 's/:[0-9]+$//' |  sort | uniq -c | sort -n
picbits
Rising Star
Posts: 3,428
Thanks: 22
Registered: ‎18-01-2013

Re: Curious Networking issue on home web server

I get the same - port scans, probes, email hacking attempts etc etc.

I can't stop people getting past the router but I use fail2ban for any services I'm running - if anybody tries more than 3-4 times to access something they shouldn't, it puts an automatic ban on using iptables.