This is a job for IPtables or whatever the Windows equivalent is. Look up ssh throttling and find some code but change the ssh port to the http port. One example here http://blog.poucet.org/2009/11/setting-up-iptables-to-throttle-incoming-ssh/ I have not used that example code myself but it contains a time and connection count and is monitored in an ongoing fashion. There are other more simple examples that Google may reveal to you.
A slightly different approach that completely restrict an IP over all ports (we use this) scanning http logs (every few hours) to identify IPs that makes repeated errors, come from known suspicious sites or don't have IPs that resolve to a prover domain name. Run the IPtables command changing the real time port filtering and block (or throttle) recalcitrant IPs. If someone inadvertantly gets targeted that's okay they are reprieved after a while because the tables are refreshed every few hours. If you are not Windows, I have a Unix script that you could use as a template for your needs . This code was mostly meant to block our harvesting friends in Russia. If you are interested I can email you the script and you can use it as a template. On Wed, 2013-12-04 at 10:17 +0800, dtpalmer wrote: > Our instance of DSpace occasionally gets hammered with excessive requests for > downloads of the same item, in a very short time, say 8,000 in one hour. No > idea why. Perhaps the bogey was testing his software against our server? > > Is there any way to detect, and set a limit of x downloads in y amount of > time, after which the server blocks that IP ? > It skews our stats, and may eventually create more serious problems. > > DSpace 1.8.3 > Windows Server 2.0.8R2 > > David T Palmer > Associate University Librarian & Digital Strategist > The University of Hong Kong Libraries > 10/F Kennedy Town Centre > 23 Belcher's Street > Kennedy Town > Hong Kong SAR > Tel. +852 3921 2921 > http://hub.hku.hk/rp/rp00001 > http://orcid.org/0000-0001-5616-4635 > > > > > ------------------------------------------------------------------------------ > Sponsored by Intel(R) XDK > Develop, test and display web and hybrid apps with a single code base. > Download it for free now! > http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk > _______________________________________________ > DSpace-tech mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/dspace-tech > List Etiquette: > https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette ------------------------------------------------------------------------------ Sponsored by Intel(R) XDK Develop, test and display web and hybrid apps with a single code base. Download it for free now! http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk _______________________________________________ DSpace-tech mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dspace-tech List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette
