[racket-dev] DOS attack on planet?

2013-09-22 Thread Andrei Mikhailov
Sorry if I am rising a false alarm. I noticed that there is a massive
download of my package
called bystroTeX :
http://planet.racket-lang.org/display.ss?package=bystroTeX.pltowner=amkhlv
All the downloads are of the (old) version 1.6

What is going on?
Is it possible to figure out who downloads it?

Andrei
_
  Racket Developers list:
  http://lists.racket-lang.org/dev


Re: [racket-dev] DOS attack on planet?

2013-09-22 Thread Robby Findler
I don't think that the planet server itself doesn't keep enough information
to say much about this, but the requests come via apache so there might be
more information in a log file at that level that Eli might be able to tell
us about.

I do see lots of requests coming in for packages, tho. In addition to
yours, dracula.plt fasttest.plt, drocaml.plt, and xmlrpc.plt seem to be
being continuously asked for.

Robby


On Sun, Sep 22, 2013 at 12:40 PM, Andrei Mikhailov a.mk...@gmail.comwrote:

 Sorry if I am rising a false alarm. I noticed that there is a massive
 download of my package
 called bystroTeX :
 http://planet.racket-lang.org/display.ss?package=bystroTeX.pltowner=amkhlv
 All the downloads are of the (old) version 1.6

 What is going on?
 Is it possible to figure out who downloads it?

 Andrei


 _
   Racket Developers list:
   http://lists.racket-lang.org/dev


_
  Racket Developers list:
  http://lists.racket-lang.org/dev


Re: [racket-dev] DOS attack on planet?

2013-09-22 Thread Eli Barzilay
I just looked into that, and it seems that there's something bad going
on with some machine at BYU which started yesterday.  (Ping: Jay.)

The offending traffic comes from fltr5.byu.edu, at a very high rate.
The new log file for the week had started at 2013-09-22 03:40 local
time (about 12.5 hours ago) with 92000 queries for this period, and
85% of this traffic (about 78k, about a 100 hits per second) is coming
from this BYU IP.  Looking back, it seems that it's something recent
that had started just yesterday, so whatever it is, it's new.  Most of
the traffic is basically a repeating loop of these 8 lines, shown below.

(I will restart the server now, in an attempt to get whatever it is
that causes this mess to crash.)

128.187.97.22 - - [22/Sep/2013:03:49:17 -0400] GET /servlets/pkg-info.ss 
HTTP/1.1 200 5650 - -
128.187.97.22 - - [22/Sep/2013:03:49:18 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22dracula.plt%22maj=1min-lo=0min-hi=%23fpath=%28%22cce%22%29
 HTTP/1.1 404 79 - -
128.187.97.22 - - [22/Sep/2013:03:49:18 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22dracula.plt%22maj=2min-lo=0min-hi=%23fpath=%28%22cce%22%29
 HTTP/1.1 404 79 - -
128.187.97.22 - - [22/Sep/2013:03:49:18 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22dracula.plt%22maj=5min-lo=0min-hi=%23fpath=%28%22cce%22%29
 HTTP/1.1 404 41 - -
128.187.97.22 - - [22/Sep/2013:03:49:18 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22drocaml.plt%22maj=1min-lo=0min-hi=%23fpath=%28%22abromfie%22%29
 HTTP/1.1 404 79 - -
128.187.97.22 - - [22/Sep/2013:03:49:18 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22fasttest.plt%22maj=1min-lo=0min-hi=%23fpath=%28%22cce%22%29
 HTTP/1.1 404 79 - -
128.187.97.22 - - [22/Sep/2013:03:49:19 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22xmlrpc.plt%22maj=3min-lo=0min-hi=%23fpath=%28%22schematics%22%29
 HTTP/1.1 404 79 - -
128.187.97.22 - - [22/Sep/2013:03:49:19 -0400] GET 
/servlets/planet-servlet.ss?lang=%225.90.0.9%22name=%22bystroTeX.plt%22maj=1min-lo=0min-hi=%23fpath=%28%22amkhlv%22%29
 HTTP/1.1 200 63508 - -




30 minutes ago, Robby Findler wrote:
 I don't think that the planet server itself doesn't keep enough
 information to say much about this, but the requests come via apache
 so there might be more information in a log file at that level that
 Eli might be able to tell us about.
 
 I do see lots of requests coming in for packages, tho. In addition
 to yours, dracula.plt fasttest.plt, drocaml.plt, and xmlrpc.plt seem
 to be being continuously asked for.
 
 Robby
 
 On Sun, Sep 22, 2013 at 12:40 PM, Andrei Mikhailov a.mk...@gmail.com wrote:
 
 Sorry if I am rising a false alarm. I noticed that there is a massive
 download of my package
 called bystroTeX : http://planet.racket-lang.org/display.ss?package=
 bystroTeX.pltowner=amkhlv
 All the downloads are of the (old) version 1.6

 What is going on?
 Is it possible to figure out who downloads it?

-- 
  ((lambda (x) (x x)) (lambda (x) (x x)))  Eli Barzilay:
http://barzilay.org/   Maze is Life!
_
  Racket Developers list:
  http://lists.racket-lang.org/dev