Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server was running on 100% CPU and looking at the Apache logs I saw hundreds of thousands of connections that looked like this:

10.190.45.31 - - [13/Mar/2014:15:29:02 +0000] "GET SOMETHING HTTP/1.1" 200 2261 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 (via ggpht.com GoogleImageProxy)"

The IP is that of my load balancer, which unfortunately I hadn't setup with logging, so I can't identify the true source of this requests.

Does anyone know what kind of traffic is this?

share|improve this question
    
Hi, you have included the ddos tag, mentioned 100% CPU usage and mentioned hundreds of thousands of log lines (which you call connections). I can't see any connection between those three things. I've answered your question but I suspect you really want to know why your server went down and what you can do to prevent it happening again. For that you probably need to know what was using the CPU. Did you run top while it was happening? Do you have a monitoring system such as Cacti, Nagios, munin, Observium, Zabbix, etc? –  Ladadadada Mar 13 at 17:49

1 Answer 1

up vote 1 down vote accepted

I see traffic like this too.

  • The IP addresses are always in the 66.249.64.0/19 range, which is owned by Google.
  • The User-Agents I see are always the same one you have there.
  • The URLs being requested are mostly images but sometimes not.
  • Most image URLs are requested multiple times. The top two most requested images (which, incidentally, we only include in emails our platform sends) were 2/3rds of the total requests.

I'm pretty sure it's related to the recent change they made to Gmail to automatically load images in emails but to do so through a proxy so the recipient couldn't be identified.

This blog post backs me up and includes the same User-Agent.

You could probably test this by sending yourself an HTML email to your Gmail address that included a tag like this (substituting your domain in for example.com of course):

<img src="http://example.com/this_probably_doesnt_exist.jpg">

If you see the same kind of hit from this User-Agent for that URL then I am right in my guess.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.