Mailing-List: contact mirrors-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: mirrors@apache.org
Received-SPF: pass (asf.osuosl.org: local policy)
Message-ID: <001101c5ba96$b5d2d0c0$0101010a@DESKTOP>
From: "Shane Goulden" <shane@matrixau.net>
To: <mirrors@apache.org>
References: <005701c5ba05$916782d0$4d01a8c0@ehharms.de>
 <4329A745.9070503@gdi-tech.com> <200509151317.47822.gespinosa@inca.gob.mx>
 <000601c5ba24$04145ec0$18b2a8c0@ehharms.de>
 <62b214239516a595fba946ff0e66a469@publicshout.org>
Subject: Re: Mirrors under attack?
Date: Fri, 16 Sep 2005 18:14:48 +1000
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="iso-8859-1";
	reply-type=response
Content-Transfer-Encoding: 7bit

Yeah. I get people trying to fetch the entire repos. I just block them.

Pushes to about 80 Mbps from that IP alone.

- Shane.

----- Original Message ----- 
From: "michele" <hostmaster@publicshout.org>
To: <mirrors@apache.org>
Sent: Friday, September 16, 2005 5:24 AM
Subject: Re: Mirrors under attack?


>I experienced that behavior several times. The solution I chose is
> to throttle connections from the same ip.
> 
> Mind that he could just be some guy trying to fetch the whole repos
> before asking to be subscribed. This isn't the right way to do it, but I
> guess they simply find master sources slower.
> 
> bye
> 
> 
> On 15/set/05, at 20:33, Thorsten Neckel wrote:
> 
>> Hi!
>>> I usually block the
>>> offending class C via iptables/pf and go from there.  (Flushing blocks
>>> every 6 months).
>> Currently I use Order Deny,Allow via .htaccess to block such subnets.
>>
>>> I have the same problem here, but looks like is a spybot, just like 
>>> the google
>>> or altavista uses to search pages.
>> Not in my case. They download the whole file.
>>
>>> looks like it does not consume a lot of resources,
>> No, about 1 GByte every 30 minutes. At time writing the only solution 
>> is to block these guys.
>>
>> regards
>> thorsten
>>
> 
> 
> 
>