Detect SYN flood slowing down server with netstat
If the web server is slow, detect a SYN flood by netstat -ant | grep :443 | grep SYN_RECV to show the IP addresses leaving it hanging. Hint: If you're behind a reverse proxy, and that shows IP addresses that aren't the proxy's, then your IP is being hit directly. To find out how many IPs are hanging, do netstat -ant | grep :443 | grep SYN_RECV | wc -l. If you do it a few times and the number is increasing, you may be under attack. If it's over 100, that's suspicious, but manageable and the server can usually handle it, especially if you have SYN cookies activated. If it's over 1000, you're under attack.
So, I had a crazy problem. You'll notice that there's various draggable elements on this site... such as the "Kupietools" plugin tabs seen at left, the occasional "the site is being worked on right now" notices that pop up, etc. You can drag them around with your mouse.
