For some time now we have been suffering from periods of slow to non-existent access to the site. We have determined that the cause is hosts that are accessing our site in a way that appears to be automated. To counter this traffic, we initially chose to block entire networks from accessing the webserver. However, this is not ideal, as it can lead to blocking legitimate access as well. Recently, I became aware of a module for our webserver (named mod_evasive) that appeared to address the problem in what I considered to be an elegant way.
The way that mod_evasive works is quite simple. If a host accesses the webserver more than a threshold limit, it is automatically blocked for a predetermined time. (I believe it's 10 minutes, but that's from memory.) If the host stops trying to access the server, the timer is triggered, and after the timeout, the host has access again. No matter how many times they try to access, they will always be temporarily blocked unless they stop. In theory, a host could be blocked forever, but attacking computers seldom keep trying to access once they realize it's futile. They simply move on to the next target.
I asked for the module to be installed. Since that time, I have gotten one report of a host that was blocked. What I'd like to know from the members is if you have experienced increased access times in the past seven days. I have been ill and have not accessed the site (except for my routine maintenance tasks) for over two weeks. So, if you have noticed long access times in the past week, please reply in this thread. Moving forward, if you do notice this behavior, please notify me by email at
geek@stovebolt.com.
I have noticed that we have had no periods of extreme hit counts. Usually, when we're seeing delays in access, the hit counts rise into the six figures, well over our normal traffic rates.
