Bandwidth Attack?

[yvelle]

A few months ago, I was helping to manage a New Orleans community website, c3nola.org . Since Katrina, the site has been unused and nobody has been maintaining it. Yesterday, I received an email from the woman who purchased the site saying that she received an email saying her bandwidth had almost reached its limit. At first I had thought this was just a hoax, but (after I finally remembered the password!) i checked the site and the bandwidth use on the site in the last month claims to 9.45 GB! This seems incredible and I can't imagine why anyone would be using that much. The site does have drupal installed on it, perhaps someone is using an exploit? From the site stats, it looks like whoever is sucking up all the bandwidth is changing their browser and IP address fairly regularly (I assume a script could do this.) A sample of the raw stats looks like:

 

85.178.109.233 - - [25/Apr/2006:14:26:34 -0400] "GET /?PHPSESSID=1afc4d03ada0e78cf273d339c057cdbf HTTP/1.0" 200 38174 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"

85.178.109.233 - - [25/Apr/2006:14:26:36 -0400] "POST /trackback/4 HTTP/1.0" 302 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"

85.178.109.233 - - [25/Apr/2006:14:26:42 -0400] "GET /?PHPSESSID=2df1ef4bf0356ffa8e75e4b5c780d645 HTTP/1.0" 200 38174 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"

85.178.109.233 - - [25/Apr/2006:14:26:45 -0400] "POST /trackback/52 HTTP/1.0" 200 79 "-" "Mozilla/5.0

 

I have about 62000 lines of this, if it would help someone figure out what is going on. Has anyone heard of anything like this? Can TCH do something about this wasted bandwidth?

 

Brian Walters

[abinidi]

I'd say it is time for a trip to the ever friendly help desk. They can help you analyze where the problem is coming from, and then can help you with a solution.

 

Link to the help desk is at the top of the page.

 

Good luck. Keep us updated on what happens.

[TCH-Tim]

I'd say it is time for a trip to the ever friendly help desk.

That's a good idea. Someone here may be able to offer general adivce, but you will have to go through the Help Desk for account specific questions.

[charle97]

looks like someone is exploiting trackback. there should be a trackback throttle that can be activated to stop floods.

[yvelle]

Not exactly sure what the problem was, but we decided to upgrade Drupal and turn off the trackback feature, and it seemed to fix the problem. Once we get more time, we will turn on the upgraded trackback feature and see if the problem reoccurs. Thanks for the prompt replies!

[TCH-JimE]

Glad you have a fix, I hope it works for you, let us know how it goes!

 

JimE