DOS attack from Inktomi/Yahoo?

More than 50 "guests" from Inktomi/Yahoo made all websites down for 1 hour

[gcan]

Today I discovered that Apache stopped to serve webpages. Server was responding and load was normal. All services ftp, mail, Mysql etc was working fine, except Apache. Top showed a huge number of Apache processes and connections.

Not so many people were online and it looked strange to me because even with 1000 people on the busiest website, Apache works fine and server load is under 0,8 - 2.00. I restarted Apache. Some 1-2 minutes everything was fine, but then Apache stopped to serve pages again. I restarted Apache one more time and noticed an unusual number of "guests" (users who are not logged in).

I checked all "guests" and discovered that more than 50 of them are in the same IP address range. All IP addresses started with 74.6. ...

74.6.7.227
74.6.25.40
74.6.23.184
74.6.31.94
74.6.22.60
..............
etc. etc.

ARIN database shows that all IP addresses belong to Inktomi Corporation and abuse email is: [e-mail]

As I understand these are spiders of Inktomi/Yahoo.

Of course I want my web pages being indexed, but not in the way which looks like a DOS attack.

Similar strange problems - server is responding and all services are up, but Apache stops to server pages - I notice from time to time, but usually it takes a few minutes and everything is back to normal. This time it took 55 minutes.

Is there any way how to fix this problem without blocking all IP addresses of Inktomi by Firewall?

Thanks.

[digitalv]

If it was a DOS attack, the IP addresses you can see don't actually mean anything - the reason a DOS works is because the IP address contained in the packet isn't the actual IP address that's sending it.

In other words, it's a spoofed IP. Whoever is doing it just spoofed a Yahoo/Inktomi IP in the packet.