Java Mailing List Archive

http://www.junlu.com/

Home » Home (12/2007) » Tomcat Users »

Tomcat 4.1.24 stops responding due to attack

Kedar

2004-06-22


Hi,
I am facing following problem :

Problem : After working properly for a day or 2, I cannot access my website.
Only way to restart is kill the process and again run "startup.sh". I
cannot stop normally
using "shutdown.sh"

Configuration : Red Hat Linux release 9 (Shrike), Tomcat 4.1.24, Postgres 7.3.4

Points Checked -
1. The tomcat is not down, I can see process by "ps -ef"
2. However, as a result of "netstat -tcp" I am getting some unknown users
accessing my "mysqld".
Under normal working conditions I can recognise the IP address and accessed
processes listed under "netstat -tcp"
Actually I am not using "mysql" at all.
No other application on server is using mysqld.
3. The default Apache 80 port can be accessed normally(Tomcat is running on
8080).
4. I have changed the port to 8081, but problem persists.

Is it that someone is making lot of fake connections to slow down my
tomcat, or am I infected by virus?

Any hint or pointer will be appreciated.
Regards,
Kedar


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@(protected)
For additional commands, e-mail: tomcat-user-help@(protected)

©2008 junlu.com - Jax Systems, LLC, U.S.A.