apache port 80 respond slow or not respond

[f5b]

apache port 80 respond slow or not respond

Software: apache installed using ports with default config / FreeBSD 8.1 release AMD64
hardware: 2 Quad-Core AMD Processor 2300.10-MHz /8G memory/
the server run mainly apache and Mysql
------

netstat -tan | grep 80

found hundreds lines as follows, connected from the same ip.
are there DDOS to my server? what should I do to tune my Apache? hosts.allow? firewall? or other things

tcp4       0      0 my.server.ip.80       same.bad.guy.ip.48613   SYN_RCVD
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.48614   SYN_RCVD
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.48612   SYN_RCVD
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.48600   SYN_RCVD
tcp4     359      0 my.server.ip.80       same.bad.guy.ip.18465   ESTABLISHED
tcp4     359      0 my.server.ip.80       same.bad.guy.ip.56694   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.56699   ESTABLISHED
tcp4       0  30408 my.server.ip.80       same.bad.guy.ip.47762   CLOSE_WAIT
tcp4       0  26312 my.server.ip.80       same.bad.guy.ip.47761   ESTABLISHED
tcp4       0  19320 my.server.ip.80       same.bad.guy.ip.26009   ESTABLISHED
tcp4       0  30408 my.server.ip.80       same.bad.guy.ip.22406   ESTABLISHED
tcp4       0  30408 my.server.ip.80       same.bad.guy.ip.26704   FIN_WAIT_1
tcp4       0  26064 my.server.ip.80       same.bad.guy.ip.26702   FIN_WAIT_1
tcp4       0  23664 my.server.ip.80       same.bad.guy.ip.21048   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.59696   FIN_WAIT_1
tcp4       0  27760 my.server.ip.80       same.bad.guy.ip.25618   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.25617   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.26659   FIN_WAIT_1
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.26658   ESTABLISHED
tcp4       0  24864 my.server.ip.80       same.bad.guy.ip.26653   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.13762   FIN_WAIT_1
tcp4       0  19320 my.server.ip.80       same.bad.guy.ip.13750   ESTABLISHED
tcp4       0  26064 my.server.ip.80       same.bad.guy.ip.35046   FIN_WAIT_1
tcp4       0  31608 my.server.ip.80       same.bad.guy.ip.35040   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.35033   FIN_WAIT_1
tcp4       0  22216 my.server.ip.80       same.bad.guy.ip.35031   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.31318   ESTABLISHED
tcp4       0  26312 my.server.ip.80       same.bad.guy.ip.31322   FIN_WAIT_1
tcp4       0  19320 my.server.ip.80       same.bad.guy.ip.48231   FIN_WAIT_1
tcp4       0  24864 my.server.ip.80       same.bad.guy.ip.48229   FIN_WAIT_1
tcp4       0  23664 my.server.ip.80       same.bad.guy.ip.40405   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.12544   FIN_WAIT_1
tcp4       0  27512 my.server.ip.80       same.bad.guy.ip.12536   FIN_WAIT_1
tcp4       0  17872 my.server.ip.80       same.bad.guy.ip.12535   ESTABLISHED
tcp4       0  25112 my.server.ip.80       same.bad.guy.ip.12549   FIN_WAIT_1
tcp4       0  28960 my.server.ip.80       same.bad.guy.ip.23845   FIN_WAIT_1
tcp4       0  26312 my.server.ip.80       same.bad.guy.ip.29460   ESTABLISHED
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.29479   FIN_WAIT_1
tcp4       0  27760 my.server.ip.80       same.bad.guy.ip.29454   FIN_WAIT_1
tcp4       0  31856 my.server.ip.80       same.bad.guy.ip.40782   FIN_WAIT_1
tcp4       0  22216 my.server.ip.80       same.bad.guy.ip.40780   ESTABLISHED
tcp4       0  31856 my.server.ip.80       same.bad.guy.ip.23508   FIN_WAIT_1
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.23500   FIN_WAIT_1
tcp4       0  26312 my.server.ip.80       same.bad.guy.ip.23499   FIN_WAIT_1
tcp4       0  29208 my.server.ip.80       same.bad.guy.ip.20578   FIN_WAIT_1
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.38040   FIN_WAIT_1
tcp4       0  31856 my.server.ip.80       same.bad.guy.ip.38051   FIN_WAIT_1
tcp4       0  30408 my.server.ip.80       same.bad.guy.ip.22893   FIN_WAIT_1
tcp4       0  33304 my.server.ip.80       same.bad.guy.ip.22913   ESTABLISHED
tcp4       0      0 my.server.ip.80       same.bad.guy.ip.32770   FIN_WAIT_1
tcp4       0  26312 my.server.ip.80       same.bad.guy.ip.32769   FIN_WAIT_1

 

[anomie]

For host-level firewall (PF in this case) ideas, see:

• http://www.daemonforums.org/showthread.php?t=1672
• http://www.openbsd.org/faq/pf/filter.html

For Apache web server module ideas, see here:

• http://stackoverflow.com/questions/131681/apache-rate-limiting-options

If you get it sorted, post your solution here for the next guy.