[Resolved] weird behavior

[Alborz]

Hi guys,
I'm working with LSWS for 5 years,recently I moved one of my servers to new one with this specs:

CPU: Intel® Xeon® E5-2620 Hexa Core
RAM: 64GB
disk: 6x 600GB SSD with RAID 10 array.
OS: centos 6.4
lsws: 4.2.6
php: 5.4.22

everything was good but from 3 days ago I got very slow and connection time out on port 80.just port 80.
this problem is in specific hours.starting about 13 and will be fixed about 22-23 without any reason.

load is normal,everything is normal,if you don't open some websites you ever be noticed that server has problem.

problem is not mysql or php. maybe they need more tuning but they didn't cause this.because I check some txt file had timeout problem.

Can I someone give my advise?

Thanks

 

[NiteWave]

please capture screen shot of lsws real-time stats and "top -c" output during that time frame

 

[Alborz]

the problem was net.ipv4.tcp_syncookies=0

 

[NiteWave]

so small scale syn flooding attack caused the issue.

since http/tcp connection not established yet, lsws know nothing happened, so no log in log files.

Thanks for update.