Anatomy of a bad RSS reader
by Volker Weber
User enters his office at the University of Paderborn and switches on his computer at 9am. Fetches the RSS feed at 09:05:37 and reads two pages seven seconds later with his Firefox 1.5.0.1 browser. Twenty seconds later he reads another page. Less than two hours later he loads his robot and all hell breaks loose. He fetches the RSS feed 11,861 times in the next 42 minutes and 24 seconds.
131.234.xxx.xx - - [27/Feb/2006:10:49:17 +0100] "GET /index.rdf HTTP/1.1"
131.234.xxx.xx - - [27/Feb/2006:10:49:17 +0100] "GET /index.rdf HTTP/1.1"
131.234.xxx.xx - - [27/Feb/2006:10:49:17 +0100] "GET /index.rdf HTTP/1.1"
131.234.xxx.xx - - [27/Feb/2006:10:49:17 +0100] "GET /index.rdf HTTP/1.1"
131.234.xxx.xx - - [27/Feb/2006:10:49:17 +0100] "GET /index.rdf HTTP/1.1"
....
131.234.xxx.xx - - [27/Feb/2006:11:31:41 +0100] "GET /index.rdf HTTP/1.1"
131.234.xxx.xx - - [27/Feb/2006:11:31:41 +0100] "GET /index.rdf HTTP/1.1"
Then the storm ends. User reads three more pages throughout the day and shuts down his computer shortly after 5pm.
What a job. Nine to five. And I bet that at home he has DSL service from Arcor. His address is now blocked. If you are working at the University of Paderborn and someone tells you he cannot access my site, then you will know.
Is anybody betting against me if I say this is a Notes agent? :-)
Comments
Doesn't fit to a Notes agent description. Notes agents can't normally be scheduled to run in that fast sequence and they time out after a while (in case the get is in a non terminating loop). Even if it is a Java agent Notes tears down the agent jvm, so a thread wouldn't survive the timeout either.
Would be interesting to find the real culprit (code). Does the university know and takes action?
:-) stw
Even if the network officials on university level don't know, there is a fairly dense community at UPB who read vowe dot net, at least if it's among the faculty/staff (Students are harder to track down to an IP, since there IP adresses are more dynamic). So I guess there's going to be enough social correction :-).
Do you have access to the log containing the UserAgent strings? That may give you some insight into who/what is doing it.
Jan-Piet, of course I have. Where do you think this data is from? :-) And no, the UserAgent string does not contain any conclusive data. Just like I would expect from this agent.
As the first comment said, unlikely to be Notes at that polling frequency.
Post a comment
Recent comments
Karsten Lehmann
on Nice try at 01:17
Oswald Prucker
on Nice try at 00:54
Jim Boling
on Nice try at 23:24
Albert Dandl
on Nice try at 20:12
Karsten Lehmann
on Nice try at 19:18
Riza Baltazar
on Color coordination for web sites at 19:10
Sean Cull
on From my inbox at 19:00
Armin Roth
on Nice try at 18:02
Bart Severein
on From my inbox at 16:52
Hubert Stettner
on Why is Nokia such a complete failure? at 14:59
Ralf Stellmacher
on Overheard in New York at 12:47
Chris Frei
on Holy moly at 09:03
Ben Poole
on Why is Nokia such a complete failure? at 08:50
Dirk Steins
on Holy moly at 08:11
simon carter
on Why is Nokia such a complete failure? at 08:06
Ingo Seifert
on Holy moly at 05:50
Moritz Schroeder
on Why is Nokia such a complete failure? at 04:22
Mika Heinonen
on Why is Nokia such a complete failure? at 02:26
Andy Mell
on Holy moly at 00:54
Volker Weber
on Why is Nokia such a complete failure? at 00:23
Oswald Prucker
on Holy moly at 00:02
Yves Luther
on Why is Nokia such a complete failure? at 23:33
Volker Weber
on Why is Nokia such a complete failure? at 22:39
Hubert Stettner
on Why is Nokia such a complete failure? at 22:05
Roland Leißl
on Can't get it out of my head at 20:59
Click here to subscribe
