Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. We checked the logs and found a responsible IP and banned it, but when we opened the site the attack continued. This time it was from multiple IPs from different countries, they visited different pages of our website thousands of times.

What should we do?

EDIT This might be important: The robot or hacker or whatever seems to stick to one webpage and visit it over and over again (like our forum membership page) but when we restrict that page's permissions it just goes and finds other places. Weird.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Don't block the robot completely, but slow it down with QoS rules (in linux, check out the "tc" command). Also, read this. This is how the people running this very website solved the problems using Haproxy.

share|improve this answer
    
Thanks, We are using a normal linux host, can we do that without directly having access to the servers or should we contact our providers? –  Auxiliary May 16 '11 at 19:22
1  
If you don't have command line access, you won't be able to install haproxy. So you can't. For QoS, you need root access since it affect the processing of networks packets in the kernel. –  Julien Vehent May 16 '11 at 20:06
add comment

I would like to suggest PHREL. Very small and simple tool that makes dynamically blocking abusive IPs a breeze. I deployed it on some caching nameservers with immediate results. Test it out a bit and figure out what your thresholds should be and let it rip!

http://www.digitalgenesis.com/software/phrel/

share|improve this answer
add comment

Playing whack-a-mole is usually a fruitless effort, but it may be the only option here.

You could possibly automate the identification of your bandwidth hogs. I would look at monitoring the web logs and identifying anomalous behavior such as the same IP looking at the same page more than once a second over a defined period of time, or some other similar metric. You don't mention which platform this is, but it would be a bit easier to implement in Linux than Windows.

share|improve this answer
    
Thanks, it's a linux host with the CPanel, we've got wordpress and MyBB installed on it. –  Auxiliary May 16 '11 at 19:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.