Re: Proxy server (and proxy users) receiving HTTP 403 when accessing www.php.net

Gents, Thanks for your assistance on this: we only have 20 or so users sitting behind the proxy so I agree that the traffic seems excessive. I have passed the word to our development teams to take a look at what might be going on to generate so much traffic and to correct the situation. Any chance we could get off the black list? Thanks /JP ------------------------------------ James Plouffe, CISSP Network Communications Development & Support Toyota Motor Engineering and Manufacturing North America Ph: 734.695.3607 james.plouffe@tema.toyota.com Hannes Magnusson <bjori@php.net> Sent by: hannes.magnusson@gmail.com 08/15/2012 05:50 PM To james.plouffe@tema.toyota.com cc Daniel Brown <danbrown@php.net>, daniel.jackson@tema.toyota.com, dave.watenpool@tema.toyota.com, parasane@gmail.com, php-webmaster@lists.php.net, Rasmus Lerdorf <rasmus@lerdorf.com>, PHP Systems <systems@php.net> Subject Re: [PHP-WEBMASTER] Proxy server (and proxy users) receiving HTTP 403 when accessing www.php.net On Wed, Aug 15, 2012 at 10:45 PM, Systems <systems@php.net> wrote: > On 08/15/2012 01:47 PM, james.plouffe@tema.toyota.com wrote: >> >> Rasmus, >> Do you have any background information on the nature of the traffic? >> What volume of traffic or what type of requests would result in being >> blocked? > > I had a quick look at the logs. I think this ip may have gone into the > Deny rule along with 2 others under a particular heavy attack from some > weird site crawlers out there. I remember sorting the log file by the > most requests and blocking the top 3. Looking at the logs now, the > traffic from your ip doesn't seem abusive, although there is a hell of a > lot of it. How many users behind this proxy. > > For example, for a 1 second window in July I see: > > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime.formats HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/datetime.formats.atom HTTP/1.1" 200 1542 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/feeds/book.datetime.atom HTTP/1.1" 200 2912 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime.formats.time HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/intro.datetime.php HTTP/1.1" 200 11649 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.php HTTP/1.1" 200 11880 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.time.php HTTP/1.1" 200 14996 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/refs.calendar.php HTTP/1.1" 200 12901 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /datetime HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-version-get.php HTTP/1.1" 200 18606 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/book.datetime.php HTTP/1.1" 200 32734 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/datetime.formats.date.php HTTP/1.1" 200 23639 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /timezone-version-get HTTP/1.1" 302 5 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.unixtojd.php HTTP/1.1" 200 21487 > www.access_log.1341273600.gz:63.238.139.239 - - [03/Jul/2012:07:45:33 > -0700] "GET /manual/en/function.timezone-transitions-get.php HTTP/1.1" > 200 18974 > > And why is it hitting the atom feeds? IDE out of control maybe? For a > random 1-second snapshot this points to some serious traffic from you guys. > The Atom feeds are probably Firefox users still using the Live bookmark feature. (and you are replying from systems@ again :)) -Hannes