Apache webserver outage - need help with forensics

Bob Brennan rbrennan96 at gmail.com
Thu Apr 14 14:57:18 UTC 2005


> Bob Brennan wrote:
> | I have a server which went completely unresponsive today on port 80
> | for 20 minutes and would appreciate any pointers as to what might have
> | happened.
> 
> You don't say where or how the box is connected to the Internet... if
> via a hosting / rackspace company then I think the first move would be a
> polite email enquiring if they changed any of their routing,
> firewalling, proxying, etc arrangements or settings at that time yesterday.

Hi Andy - my connection is through a static IP leased from Demon,
which is a major ISP in the UK. It is ADSL through a Thompson router,
the default inbound server is set to my server's internal IP. At the
server I use Firestarter with only HTTP, HTTPS, FTP, SMTP, and POP3
ports open. The setup has been working for a few months like that.

Curiously, and I can't believe this has anything to do with it, I had
to put in a whitelist request that morning because my mailserver IP
was being rejected as "residential". The whitelist change has not yet
taken effect.

Unfortunately at the time it was down I was away from the machine and
could only test it from 3 separate outside locations, all of which
showed mail and ftp working as normal and http just plain not there.
Strange...

bob




More information about the users mailing list