|
<<
^
>>
Date: 2000-07-28
Cryptome wieder up & running
-.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
allerdings funktionieren die Nameservices noch nicht,
schreibt John.
http://216.167.120.50/
Hinweise auf DDoS Attacken liegen keine vor. Was sein ISP
sonst noch schreibt, steht weiter unten.
-.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
Date sent: Thu, 27 Jul 2000 19:14:07 -0400 To:
"q/depesche" <depesche@quintessenz.at> From: John
Young <jya@pipeline.com> Subject: Cryptome Up
JYA and Cryptome are fully loaded and running under their IP
addresses, awaiting hostname switchover. The twin pages:
JYA 216.167.120.49/crypto.htm
Cryptome 216.167.120.50
Bookmarks using hostnames will not work just yet.
There's a brief account of what seems to have caused the
outage on the opening page -- from the viewpoint of Digital
Nation and Verio, our ISP.
-.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
27 July 2000 -- Beginning Friday night, July 21, until now,
Cryptome has been nearly inaccessible. Our ISP, Digital
Nation, claims it was due to overloading and that a more
powerful server was needed, which was ordered on July 24
and is now purring quietly. Here is a quote from an
anonymous person inside the ISP:
When this issue was originally investigated over the weekend
of the 22nd, there were were no indications of a DOS attack.
Shutting down Apache brought the machine to almost no
load, and an investigation of the web server logs indicated
that the machine was being hammered by hits from various
news sites. All of the referrer URLs checked out - this site
was on international news sites before it showed up here (i.e.
www.donga.com)
Netstat output was normal for as long as it was visible after
starting the web server, and distribution of client IP
addresses for requests in the last 20000 lines of the access
log were normal. This, and the referrer information was
reported to the technician working with the customer by me.
The 404s ["file not available"] should take up less resources
than people actually browsing the site.
The machine is a 300MHz AMD with 32M of RAM - it's not
going to handle what's being thrown at it currently. All of the
error messages generated are normal for a machine under
extremely heavy load.
The Cobalt RAQ 3s weren't built for sites that receive the
andover-effect. :)
-.- -.-. --.-
- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
edited by Harkank
published on: 2000-07-28
comments to office@quintessenz.at
subscribe Newsletter
- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
<<
^
>>
|
|
|
|