Blocking Trouble GET requests

[illdill]

I am experiencing a slew of GET requests from time to time that last a minute or more and make the exact same request about 10 times a second. Is there a way to detect and temporarily block IP addresses that "GET" request a page more than once within so much time?


Thanks

Tim

 

[feherke]

Hi

Firewalls can filter out such floods. I suggest to ask in the forum appropriate to your operating system.

Feherke.

http://rootshell.be/~feherke/

 

[illdill]

Ok, now it is happening from my own IP address. A file I recently accessed. Could this be an apache/win2003 glich?

*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321
*.*.186.76 - - [29/Jun/2006:02:57:05 -0400] "GET /the_Atheist_who_saved_the_usa.html HTTP/1.1" 302 321


And on and on....

 

[lgarner]

What's this page look like, especially the header? 302 is a redirection response. Check the configuration also. If the page was really found at that location, the code should be 200.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

 

[illdill]

I am using proxy to redirect to the proper server.

<VirtualHost 192.168.0.12:80>
ServerAdmin webmaster@xxxxx.org
ServerName xxxxx.org
ServerAlias

http://www.xxxxx.org

RewriteEngine On
RewriteRule ^/(.*)$

http://www.xxxxx.org:81/$1

[P]
</VirtualHost>

Occasionaly I get a proxy error, but I just refresh a couple times and it's fine. The problem above (repeating GET requests) is what slows or stalls the server. The page does exist, and I was able to view it.

When I first requested the page however, I only had redirect statement rather than Rewrite, so it was looking for the page without the port number after the domain.

http://domain.org/page.html

rather than

http://domain.org:81/page.html

<VirtualHost 192.168.0.12:80>
ServerAdmin webmaster@xxxx.org
ServerName xxxx.org
ServerAlias

http://www.xxxx.org

Redirect /

http://www.xxxx.org:81

</VirtualHost>

The reason for using the proxy is to prevent the port number from appearing in the address.

Thanks again

 

[illdill]

Will this happen everytime a request for a Redirected page that cannot be found occurs? If so, how can I prevent it, other than fixing the bad link or replacing the missing page?


Thanks.

 

[illdill]

Let me try to clear this up a little more...

When trying to access the following link:

http://domain.org/page.html

I need the proxy Rewrite:

<VirtualHost 192.168.0.12:80>
ServerAdmin webmaster@xxxxx.org
ServerName xxxxx.org
ServerAlias

http://www.xxxxx.org

RewriteEngine On
RewriteRule ^/(.*)$

http://www.xxxxx.org:81/$1

[P]
</VirtualHost>

Otherwise, I use the Redirect and the accessible link looks like this:

http://domain.org:81/page.html

But, If I am using Redirect and someone requests the following link:

http://domain.org/page.html

Which needs the port number but does not have it, this is when the GET problem occurs.

Thanks aigan.