Forum has been very slow 2 days now...

[Joerg Oster]

It is very fast at the moment !

And back to ultra slow again. With only 4 guests or so.

[Jim Ablett]

Site is getting very frustrating to use for me now. I have to refresh every page about 10 times before I can get in.
Sometimes I can't get in at all. This has been going on for months now with no fix. I may have to start posting somewhere else instead.

Jim.

[Modern Times]

It is very fast at the moment !

And back to ultra slow again. With only 4 guests or so.

Yes, very odd.

[towforce]

Site is getting very frustrating to use for me now. I have to refresh every page about 10 times before I can get in.
Sometimes I can't get in at all. This has been going on for months now with no fix. I may have to start posting somewhere else instead.

Jim.

There's always Ed's site - link. Once a month post a link to your thread there from your thread here.

[hgm]

It seems the times of poor forum performance coinside with a huge number of GET requests (some 4/sec) from the IP gange 47.246.164.*. I now made an attempt to block those IPs by adding to the apache2.conf file:

Code: Select all

<RequireAll>
    Require all granted
    Require not ip 47.246.64.0/24
</RequireAll>

I am not sure whether this will have any effect without restarting the Apache server (which I am not sure how to do), or whether indeed it will work as intended, and whether this will then solve the problem.

[jefk]

well it seems to be better now;
at least at this moment

[Tibono]

It seems the times of poor forum performance coinside with a huge number of GET requests (some 4/sec) from the IP gange 47.246.164.*. I now made an attempt to block those IPs by adding to the apache2.conf file:

Code: Select all

<RequireAll>
    Require all granted
    Require not ip 47.246.64.0/24
</RequireAll>

I am not sure whether this will have any effect without restarting the Apache server (which I am not sure how to do), or whether indeed it will work as intended, and whether this will then solve the problem.

Hi,
beware you have a mismatch (typo?) IP range 164.* vs require not 64.0/24
All the best,
Tibono

[hgm]

Although on September 1 the mentioned IP numbers were topping the list, I doubt these are the whole problem. I have now looked at the access log for September 4, a day on which there were also complaints about slow response. What I did was this:

1) Extract all lines with GET using grep (typically >99% of the requests)
2) pipe that to anothe grep, which selects a time interval
3) pipe that to wc to count the number of lines
4) repeat that for 24 intervals of 1 hour to get the busiest hour
5) repeat tthatfor 6 intervals of 10 min to get the busiest
6) repeat that for 10 intervals of 1 min to get the busiest minute (which was 07:29)

In this minute there wer 2336 GET requests. There were only 535 requests from the mentioned IP range, though. And it doesn't seem like rejecting a quarter of the requests would solve the problem.

So I sorted the requests by IP. (The standard sort command then automatically uses the time stamp as secondary key, as it is the second item on the lines.) I posted the results at gets . Please tell me what you make of this.

What struck me as suspect is that there is a huge number of requests to GET index.php, which is the forum home page. They come from many different IP addresses in the 43.x.y.z range, each requesting it 4-8 times per minute, without doing anything else. There is an 'sid' in the query string (session ID?), which suggests the requests come from someone who is logged on. But for each request from the same IP all sid are different.

If I take a look at which these IP were doing the rest of the day, e.g. for 43.156.21.2 (which had 8 requests during the mentioned minute), it just continues doing that. In the hour 7:00-8:00 it made 137 GET requests. During the day there were 2018. All of those are for index.php.

This seems like a DDOS attack to me. Why would a client at a certain address only look at the forum home page, several times a minute, and never do anything else? I don't understand the significance of the sid. These seem to be different for each request, but I don't know how the forum software uses these, so maby that is normal. It could be that these are just random hexadecimal numbers, though, trying to overload the CPU by having it run some decription algorithm to test whether the user making the request is actually logged on.

Anyway, this is about all I can do for today.

[hgm]

beware you have a mismatch (typo?) IP range 164.* vs require not 64.0/24
All the best,
Tibono

Ah yes, but that is just in the forum posting. The VNC Colsole I used to log on to the server did not support copy-pasting, so I had to retype it. In the apache2.conf file I wrote it correctly.

[towforce]

...I am not sure whether this will have any effect without restarting the Apache server...

Not normally needed for web servers.

Thank you for the time taken to look at this in a busy period!