Hello!
For last two days I had trouble with squid performance. It turns out
that some kind of virus was heavily flooding with SYN packets which
reduced availible numer of file descriptors and degraded performance
I used menu Process Filedescriptor Allocation to finally find that guy.
But it would be much easier if there was:
a) option to detect IP with most accesses (those SYN do not show in
access.log so cachemgr is the only way or using tcpdump)
b) at least a way to sort that menu in cachemgr by IP address
Maybe you have any other ideas? I know that simples approach would be to
limit SYN packets per second but I have no idea of proper limit :)
--
Michał Margula, alchemyx@xxxxxxxxxxxx, http://alchemyx.uznam.net.pl/
"W życiu piękne są tylko chwile" [Ryszard Riedel]
