Small DoS on my Grey Album page


grep -c "67.250.102.2" /opt/stereo/stereo/stereo.lu/logs/stereo.lu-access.log
2539

Oh you minger.

I woke up to this:

/usr/sbin/logcheck: fork: Cannot allocate memory
/usr/sbin/logcheck: fork: Cannot allocate memory
sort: open failed: /var/tmp/logcheck.XXwDiDKY/logoutput/syslog: Too many open files in system

Whoops.


Apache sometimes goes haywire on this server because it thinks it has huge masses of ram available but in fact doesn’t because it’s running inside a virtual environment. I reduce the maximum number of servers in apache a bit, restart it, check ps fax for anthing strange and go back to ranting on IRC.

A couple of minutes later it happens again. I run apachetop on my web site’s logs since it’s been receiving a lot of traffic since I was added to the Grey Tuesday mirror list. Well, what I saw was a lot of traffic indeed. I tail the logs


# grep "67.250.102.2" /opt/stereo/stereo/stereo.lu/logs/stereo.lu-access.log | tail
67.250.102.2 - - [26/Feb/2004:09:09:34 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:09:43 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 13655 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:09:50 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:09:55 +0000] "GET /grey/10JustifyMyThug.mp3 HTTP/1.1" 206 29735 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:00 +0000] "GET /grey/10JustifyMyThug.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:07 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:10 +0000] "GET /grey/10JustifyMyThug.mp3 HTTP/1.1" 206 13655 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:11 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:16 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"
67.250.102.2 - - [26/Feb/2004:09:10:23 +0000] "GET /grey/11Interlude.mp3 HTTP/1.1" 206 2048 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)"

This is 1Cust2.tnt1.coeur-dalene.id.da.uu.net and they liked the Grey Album so much that they hit my server 2539 times.


grep -c "67.250.102.2" /opt/stereo/stereo/stereo.lu/logs/stereo.lu-access.log
2539

Oh you minger. IP blocked.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.