Re: Proxy server (and proxy users) receiving HTTP 403 when accessing www.php.net
| From: | Systems | Date: | Wed, 15 Aug 2012 21:45:45 +0000 |
| Subject: | Re: Proxy server (and proxy users) receiving HTTP 403 when accessing www.php.net | ||
| References: | 1 | Groups: | php.webmaster |
| Request: | Send a blank email to php-webmaster+get-14513@lists.php.net to get a copy of this message | ||
On 08/15/2012 01:47 PM, james.plouffe@tema.toyota.com wrote:
>
> Rasmus,
> Do you have any background information on the nature of the traffic?
> What volume of traffic or what type of requests would result in being
> blocked?
I had a quick look at the logs. I think this ip may have gone into the
Deny rule along with 2 others under a particular heavy attack from some
weird site crawlers out there. I remember sorting the log file by the
most requests and blocking the top 3. Looking at the logs now, the
traffic from your ip doesn't seem abusive, although there is a hell of a
lot of it. How many users behind this proxy.
For example, for a 1 second window in July I see:
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /datetime.formats HTTP/1.1" 302 5
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/feeds/book.datetime.atom HTTP/1.1" 200 2912
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /datetime.formats.time HTTP/1.1" 302 5
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/intro.datetime.php HTTP/1.1" 200 11649
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/refs.calendar.php HTTP/1.1" 200 12901
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /datetime HTTP/1.1" 302 5
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/datetime.formats.date.php HTTP/1.1" 200 23639
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /timezone-version-get HTTP/1.1" 302 5
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/function.unixtojd.php HTTP/1.1" 200 21487
www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33
-0700] "GET /manual/en/function.timezone-transitions-get.php HTTP/1.1"
200 18974
And why is it hitting the atom feeds? IDE out of control maybe? For a
random 1-second snapshot this points to some serious traffic from you guys.
-Rasmus