Connections suddenly increase

From: moritz gartenmeister (moritz_at_uplink-verein.ch)
Date: 09/25/04 

Date: 25 Sep 2004 07:21:28 -0700

I run a Linux Bridge and run a script, which reads every minute
/proc/sys/net/ipv4/netfilter/ip_conntrack_count and puts this number
in a file.
Now I have some 'strange' data:

Numbers Wed Sep 22 13:59:11 CEST 2004 12098
Numbers Wed Sep 22 14:00:11 CEST 2004 12137
Numbers Wed Sep 22 14:01:11 CEST 2004 12215
Numbers Wed Sep 22 14:02:11 CEST 2004 9990
Numbers Wed Sep 22 14:03:11 CEST 2004 5518
Numbers Wed Sep 22 14:04:11 CEST 2004 3262
Numbers Wed Sep 22 14:05:11 CEST 2004 3215

A really fast decrease of connections.

Numbers Wed Sep 22 14:11:11 CEST 2004 4752
Numbers Wed Sep 22 14:12:11 CEST 2004 11603
Numbers Wed Sep 22 14:13:11 CEST 2004 17646

And vice-versa...

I think about a virus, bot, worm etc. But I am not sure about it. I
have no rational explanation, why normal use of Internet would give
such data.

BTW: This connections are from a students dorm with about 500
students/computers.

Can anyone give me some light?

thanks
moritz

Relevant Pages

  • Re: Connections suddenly increase
    ... > I run a Linux Bridge and run a script, ... This connections are from a students dorm with about 500 ... are many even without an internet outbound. ...
    (comp.security.misc)
  • force reload of application from asp.net
    ... We have an ASP.net application that sporadically fails with a strange ... problem regarding the Max number of pooled connections being reached for the ... connections to the database can be made, and as such no pages can be served, ... notifications setup so that we can restart the application, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Connection Problems
    ... ports are just accepting 10kbps connections and not 100. ... Strange though? ... >After disconnectig a couple of my notebooks they get the ...
    (microsoft.public.windows.server.networking)
  • Re: Connections suddenly increase
    ... >A really fast decrease of connections. ... >I think about a virus, bot, worm etc. ... This connections are from a students dorm with about 500 ...
    (comp.security.misc)
  • Re: ucsm newsreader choices
    ... All their documentation says you *must* turn off SSL. ... How very strange, especially given the need to pass credentials that ...
    (uk.comp.sys.mac)