[tlug] Monkey vs Apache!!! Fight!

["Stephen J. Turnbull" <stephen@example.com>]

Sach Jobb writes:

 > He's just a normal user. So, that just left me with more
 > questions... is there some sort of virus on one of his machines? Is
 > the cheap fw getting confused and rapid fire sending the same
 > request uri over and over? Is apache just buggered?

It's not Apache being buggered, since the requests are coming from
outside.  It seems unlikely it's the firewall, especially not a cheap
one.

First, I don't see a referrer in the logs, but that's where I'd look
first -- some script in your content either going nuts, or convincing
itself that the expected content was broken and retrying, or some
network problem that actually did cause the content to be broken so
that the request was retried.

It's possible that the browser itself, or a proxy on the firewall is
broken, but I'd put that at lower probability.

 > 2) What to you do to protect apache against somebody that just
 > suddenly goes nuts with the connections, intentionally or not?

It's possible with some firewalls to rate limit connections from a
given IP.  Maybe Apache has a similar functionality, but probably not.