Multiple Connections - DOS attack

[ukbaz]

Hi Our site was not working this morning, and Hosting company suggested a DOS attack was in progress - have added ofenind IP address to Firewall rules on server - but... Am wondering how may requests are legitimate via normal Web request. When first connected to website own IP address has lots of entries on different ports - see below - is thsi normal?

Thanks - Baz

[root@s15351841 ~]# netstat -lan | grep :80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 217.160.239.207:80 213.83.88.238:51178 SYN_RECV
tcp 0 0 217.160.239.207:80 213.83.88.238:51057 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51121 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51120 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51187 FIN_WAIT2
tcp 0 0 217.160.239.207:80 213.83.88.238:51123 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51122 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51061 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51125 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51124 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51127 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51126 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51129 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51128 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51131 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51066 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51130 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51069 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51133 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51068 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51132 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51135 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51070 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51134 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51105 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51168 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51104 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51107 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51108 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51177 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51179 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51115 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51114 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51117 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51180 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51116 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51183 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51119 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51182 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51118 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51153 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51089 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51152 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51155 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51091 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51154 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51090 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51157 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51093 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51156 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51159 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51095 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51158 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51094 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51161 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51097 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51160 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51096 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51163 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51099 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51162 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51098 TIME_WAIT
tcp 0 0 217.160.239.207:80 213.83.88.238:51165 TIME_WAIT