On my site, I serve a zip file which is about 65MB. I currently have an Apache rule setup to allow only 2 simultaneous downloads, showing a 503 error if you try to download more. Lately, after looking through the access logs, some IPs are getting the 503 error at about 3 requests per second. Once the download finishes, however, they can download it again. After further investigation, the IP seems to be simply downloading for the heck of it. This is a waste of bandwidth and I was wondering how I would temporarily ban an IP that causes a certain error code too often within a given time range.
I'd like to be able to ban it at the iptables level. The server is running Ubuntu LTS (8.04)