[ic] mod_interchange and Apache MaxClients

[Ron Phipps]

> From: interchange-users-bounces at icdevgroup.org
[mailto:interchange-users-
> bounces at icdevgroup.org] On Behalf Of Ron Phipps
> Sent: Wednesday, November 30, 2005 4:38 PM
> 
> > From: interchange-users-bounces at icdevgroup.org
> [mailto:interchange-users-
> > bounces at icdevgroup.org] On Behalf Of Jeff Fearn
> > Sent: Tuesday, November 29, 2005 11:07 PM
> > To: interchange-users at icdevgroup.org
> > Subject: Re: [ic] mod_interchange and Apache MaxClients
> >
> > On 11/30/05, Ron Phipps <rphipps at reliant-solutions.com> wrote:
> > > Does anyone have a copy of the worm?  I'll do some searching and
see
> > > what I can turn up.
> >
> > http://www.frsirt.com/exploits/20050124.awexpl.c.php
> >
> > Jeff
> 
> Thanks Jeff,
> 
> It looks like the worm that I need is the Slapper v2.0 worm:
> 
> http://www.lurhq.com/slapperv2.html
> 
> This would then give me the exact code that is hitting our site when
it
> goes down.  I'm going to continue searching for it.
> 
> -Ron
> 

We were visited this morning again by this worm and my script noticed
the site was not responding so IC was restarted.  It's definitely
something in this worm that is causing Apache/mod_interchange/ic to hang
up.  I'm setting up a test domain today with the cgi-bin access method,
I'll modify my script to then check this test domain when it notices the
main domain is not responding to see if IC can still serve pages
properly.  This will then narrow it down whether it's an issue with IC
or Apache/mod_interchange.

Thanks,
-Ron