[CentOS-mirror] Weird traffic pattern spotted, is it just us?

Hi!


This is an old problem.

Solution:

https://lists.centos.org/pipermail/centos-mirror/2020-October/024445.html


Cheers,

Peter


2021. 07. 08. 19:38 keltezéssel, Alex Iribarren írta:
> Hi all,
>
> First of all, sorry if this is the wrong mailing list for this, feel 
> free to point me to a more appropriate place.
>
> Some time ago, I was looking at the httpd logs of our mirror servers 
> and I noticed a weird pattern: we seem to have an awful lot of 
> suspicious-looking partial content requests for ISO images. In the 
> past 24 hours, we've had 64k requests for 98 different ISOs coming 
> from 508 different IPs.
>
> A single IP address has sent 3115 partial content requests for 
> CentOS-7.0-1406-x86_64-DVD.iso, and then moved on to requesting 
> CentOS-5.11-i386-bin-DVD-1of2.iso 2069 times (in the last 24 hours). 
> Downloading the full file doesn't seem to be the goal of this traffic, 
> in most cases the clients download fewer bytes than the total 
> filesize. To test this, I disabled partial requests on the server side 
> so the full file would be served regardless of how many bytes a client 
> requested, and the clients would carry on sending requesting even 
> though they had already downloaded the entire file multiple times.
>
> The requests seem to all have random-ish useragents, but all of them 
> start with "Mozilla/5.0", so they're pretending to be web browsers. 
> The web browsers I've tested don't issue HTTP 206 requests when 
> downloading files, even big ones, and they would probably stop when 
> they had the full file anyway. The vast majority of these strange 
> requests, 95%, seem to come from Chinese IPs. We get requests all the 
> time, but they seem to pick up around 3am CEST and they start to be 
> less frequent by 5pm, which sort-of matches Chinese daytime.
>
> Globally, these requests don't seem to be doing any harm, they are 
> less than 1.2% of the requests we got in the last 24 hours, but they 
> don't look like legitimate traffic and I just can't figure out what 
> the point of it would be. Are we being used for weird speedtests from 
> China? Or is this a really lazy DDoS attack?
>
> Does anybody else see this kind of traffic? Try looking for 
> `http_status=206 useragent="Mozilla *" uri_path="*.iso"` in your logs, 
> I'm curious to see if this is common or not.
>
> Cheers,
> Alex
> _______________________________________________
> CentOS-mirror mailing list
> CentOS-mirror at centos.org
> https://lists.centos.org/mailman/listinfo/centos-mirror