So did I. But webalizer says around 13GB of traffic from 360,000 hits, and 0 
(zero) visits.

More stats I have picked up:

1. 97% of file requests are JPEGs
2. There are 3 images, all realated to a listing in the system, that have been 
hit evenly around 48,000 times and equate to a total of around 4GB each.
3. These three images account for 95% of all traffic.

So I guess that's the culprit there. Something hitting those images over and 
over again. But they aren't the sort of images anyone would want to hotlink. 
And neither IP resolves to a website.

I have blocked the IPs for now, and sent an email to Xtra's abuse team to see 
what they say.

  ----- Original Message ----- 
  From: Stu Meads 
  To: [email protected] 
  Sent: Friday, February 05, 2010 2:51 PM
  Subject: Re: [phpug] [OT] Xtra eating bandwidth


  That sounds weird, I always thought that webalizer stats were generated from 
the Apache logs


  On Fri, Feb 5, 2010 at 11:42 AM, Aaron Cooper <[email protected]> wrote:

    The interesting thing is that both IP's appear in Webalizer stats, but not 
in either FTP or Apache raw logs.
      ----- Original Message ----- 
      From: gizmoguy 
      To: [email protected] 
      Sent: Friday, February 05, 2010 10:41 AM
      Subject: Re: [phpug] [OT] Xtra eating bandwidth


      On 5 February 2010 10:26, Aaron Cooper <[email protected]> wrote:

        Howdy, I was wondering if anyone else has strange log entries for these 
two IPs recently:

        219.89.117.251
        210.54.90.144

      Not those IPs but we've had a lot of traffic from 146.171.254.96 which is 
another Telecom IP address which has done 256.33 MB of bandwidth so far this 
month from one of our webapps which is proportionally a lot of bandwidth for us.

      We identified the problem with this particular IP address using a lot of 
bandwidth due to a lack of gzip support, we suspect it is a 
coroprate/enterprise proxy/filtering server that ignores gzip to make it less 
CPU heavy when it comes to filtering which results in us sending out the 
uncompressed version of all our pages and JS/CSS which turns out to be quite a 
lot.

      Haven't attempted to make contact with them yet but if you report back 
with your dealings with Telecom and we may also get in contact with them.

      Brad


      -- 
      NZ PHP Users Group: http://groups.google.com/group/nzphpug
      To post, send email to [email protected]
      To unsubscribe, send email to
      [email protected]

    -- 
    NZ PHP Users Group: http://groups.google.com/group/nzphpug
    To post, send email to [email protected]
    To unsubscribe, send email to
    [email protected]



  -- 
  NZ PHP Users Group: http://groups.google.com/group/nzphpug
  To post, send email to [email protected]
  To unsubscribe, send email to
  [email protected]

-- 
NZ PHP Users Group: http://groups.google.com/group/nzphpug
To post, send email to [email protected]
To unsubscribe, send email to
[email protected]

Reply via email to