Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a web developer and have this server that's being used as a development machine of sorts. So, my experience with Apache is that I can fiddle around and get basic stuff done / google stuff to get the answers I need.

Over the weekend, we had a lot of load on the server to the order of 1000 times the average bandwidth usage. My Apache access logs has lines and lines that look similar to below.

81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/f.jpg HTTP/1.0" 200 446529 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/g.jpg HTTP/1.0" 200 2727018 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/h.jpg HTTP/1.0" 200 2504361 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/i.jpg HTTP/1.0" 200 520036 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/j.jpg HTTP/1.0" 200 2589152 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/j.jpg HTTP/1.0" 200 4665478 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/k.jpg HTTP/1.0" 200 1936692 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/l.jpg HTTP/1.0" 200 2777877 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/eels.jpg HTTP/1.0" 200 2451371 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/cows91.jpg HTTP/1.0" 200 1297337 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/m.jpg HTTP/1.0" 200 2551047 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/n.jpg HTTP/1.0" 200 2977841 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/o.jpg HTTP/1.0" 200 1999738 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/p.jpg HTTP/1.0" 200 1994689 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"

The same set of images are being requested over and over again by my own server! Also, yes the user agent is just a dash.

  • This downloading of files starts again as soon as I restart the server.
  • I found a couple of lines in access log where /feed is being requested by the user agent "-" "Apple-PubSub/65.28". I checked the user agent and this seems to be someone asking their Mac OS to manage their feeds.
  • The site has been built using WordPress. However, there are no plugins etc. installed.
  • I am using the functions getimagesize and the library timthumb (Php). Could any of those be causing these issues?
share|improve this question
    
81.12.34.56 is the only source ? iptables -A INPUT -s 81.12.34.56 -j DROP –  Adrien P. Oct 31 '11 at 14:48
    
But, 81.12.34.56 is also my server's IP address - the server on which this app is hosted. Adding it to IP tables will block the requests - but not solve the problem I'm having. –  Adhip Gupta Oct 31 '11 at 14:52
    
Ok, show me the output of ps auxf please. –  Adrien P. Oct 31 '11 at 15:04
    
Here it is: pastebin.com/V5t5Bp01 –  Adhip Gupta Oct 31 '11 at 15:19
    
Very strange ! Don't know what appending, but be careful with timthumb library, look here: wpcandy.com/reports/timthumb-security-vulnerability-discovered –  Adrien P. Oct 31 '11 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.