nf_conntrack table full dropping packet flood

Discussion in 'ISPConfig 3 Priority Support' started by Jeff Usher, May 21, 2014.

  1. Jeff Usher

    Jeff Usher New Member

    For the last 2 nights my servers has shown services as being offline and the system log is full of the following:-

    nf_conntrack: table full, dropping packet


    Now I understand this may be a DOS or DDOS attack on the server.

    A reboot cures the problem but I can't reboot the server every night as that's impracticable.

    I should add that although the services are showing as offline - they are in fact online. i.e. the www service is showing as offline but all my sites are up.


    Any help in curing this would be appreciated. This never happened before the upgrade to and

    Many thanks

  2. Jeff Usher

    Jeff Usher New Member



    It looks like my server is being attacked nightly by some kind of stress attack. Here are the list of connections:-


    So it does look like some kind of dos attack and putting the system under loads of stress.

    Any recommendations for counter defence ?

  3. srijan

    srijan New Member HowtoForge Supporter


    Refer the thread here
  4. Croydon

    Croydon ISPConfig Developer ISPConfig Developer

    @Jeff: For me it looks more like your server is spamming (if the list of commands you posted is from your server).
    Have you checked the "lsof -p xxxx" for the open processes? You might be able to find out which web is the source with this. e. g. lsof -p 30415
  5. Jeff Usher

    Jeff Usher New Member

    Think I've managed to pinpoint the problem.

    I ran a grep for the originators domain name and all the results were from a string in one script on one of my sites. There must have been a backdoor with this script. I have completely removed the site from my server and the attacks have stopped.

    I also added a "pkill xmlrpc" cron job to run every minute to kill any process that starts up with xmlrpc, which was the way the attackers were getting in.

    So far so good.

    Apologies as this was not specifically an ISPconfig problem in the end.


Share This Page