Re: Proxy server (and proxy users) receiving HTTP 403 when accessing www.php.net

On Wed, Aug 15, 2012 at 10:45 PM, Systems <systems@php.net> wrote: > On 08/15/2012 01:47 PM, james.plouffe@tema.toyota.com wrote: >> >> Rasmus, >> Do you have any background information on the nature of the traffic? >> What volume of traffic or what type of requests would result in being >> blocked? > > I had a quick look at the logs. I think this ip may have gone into the > Deny rule along with 2 others under a particular heavy attack from some > weird site crawlers out there. I remember sorting the log file by the > most requests and blocking the top 3. Looking at the logs now, the > traffic from your ip doesn't seem abusive, although there is a hell of a > lot of it. How many users behind this proxy. > > For example, for a 1 second window in July I see: > > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime.formats HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/book.datetime.atom HTTP/1.1" 200 2912 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime.formats.time HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/intro.datetime.php HTTP/1.1" 200 11649 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/refs.calendar.php HTTP/1.1" 200 12901 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.date.php HTTP/1.1" 200 23639 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /timezone-version-get HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.unixtojd.php HTTP/1.1" 200 21487 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-transitions-get.php HTTP/1.1" > 200 18974 > > And why is it hitting the atom feeds? IDE out of control maybe? For a > random 1-second snapshot this points to some serious traffic from you guys. > The Atom feeds are probably Firefox users still using the Live bookmark feature. (and you are replying from systems@ again :)) -Hannes