[Fabian Wenk <fabian@we...>]

Hello Aniyan

On 03.07.2013 03:05, Aniyan Rajan wrote:
> I am getting the following in the logwatch email today. This is the first
> time I'm getting this in the logwatch email. I got 364 "drop open request"
> lines, but I'm showing a sample below.

Check out this search results from Google [42], this will give 
you some hints what could have happen.

   [42] 
https://www.google.com/search?q=%22TCP%3A%20drop%20open%20request%20from%22

> I don't know what this means. Is this a DDos attack ? I have checked the
> iptables and fail2ban didn't ban that IP under any jail.

As all (or most) requests were from the same IP address, it is 
only a DoS (Denial of Service) attack and not a DDoS (Distributed 
Denial of Service) attack.

> Please help. Thanks.

Check out all your log files for the mention IP address. Even 
e.g. the Apache logs for all websites. Probably this IP address 
was just causing some "overload" on your server, but did not try 
to brute force any user accounts. So there was no reason for 
fail2ban to ban anything. Just find out what was going on and 
then decide what to do, e.g. tuning your server or eventually 
creating a custom filter and jail for this, if it does abuse your 
system.


bye
Fabian