ipd/1.0

Has anyone else seen this one?

[Pushycat]

This started showing up in my logs today, it seems like a search engine spider, or at least a bot of some kind, and it's somewhat abusive causing my CPU usage to increase by several dozen percent. The IP appears to be Asian. Does anyone have a clue what ipd is?

[EliteWeb]

Whats the IP address

[Pushycat]

I'm sorry. I should have included that in my original post. The IP Address is 202.157.154.105.

[PsychoTekk]

the IP belongs to Webvisions Pte Ltd [webvisions.com], a multinational asian hosting provider located in singapore.
"ipd/1.0" seems to be some homemade bot - i'd block it

[jdMorgan]

Pushycat,

Did it read and obey robots.txt?

Thanks,
Jim

[Pushycat]

PsychoTekk, thanks. I've already added it to my browscap.ini file which is available via the website in my profile.

jdMorgan, it did not request (or read) robots.txt.

[Pushycat]

I just heard from a colleague of mine who did some further analysis of our log files. It seems ipd was making multiple concurrent requests from a variety of different IP Addresses including:

130.94.245.51 (Verio),
202.157.154.105 (Webvisions Pte Ltd),
195.149.39.86 (Exodus Communications) and
64.71.140.50 (Hurricane Electric).

Is this probably an example of what I think is called IP Address spoofing?

[PsychoTekk]

>IP address spoofing<
well, the bot had to be able to configure the packets that are sent out,
and that takes a good coding knowledge.
i personally don't think that someone would equip an unknown bot with
such an advanced mechanism, though you never know

or what did you mean by IP address spoofing?

[Pushycat]

What I think I mean by IP Address spoofing is where the sender is somehow able to disguise the real IP Address so that packets make it back to them while making it look like they're going somewhere else.

The content in question is valuable and desirable and they often have to deal with thieves. IMO it's not unreasonable to think it might be worth someone's time to craft a bot specifically for that website.

[Dreamquick]

Pushy,

I'd agree with PsychoTekk - it's very unlikely to be true ip address spoofing as the level of effort & technical knowledge required to spoof *and* recieve the packets across the net is going to be so extremely high - building that level of ability into a bot is pointless.

Sending spoofed packets in a single direction is really quite easy to do - it just involves making a packet to the correct specification with the forged header. Getting the response back (i.e. sending *and* then recieving spoofed packets) is a whole heap more tricky as by definition you will not get a spoofed packet returned to the real source address.

You either have to be able to sniff the traffic as it goes out to the forged address or somehow affect the routing so that traffic to the forged address goes to the address you want it to go to.

Neither one of those are all that easy and most of the time it would be more time effective just to crack the box!

A more likely scenario for traffic appearing to come from random addresses is the use of open proxies - the last hop appears to be the source of the request so anyone can effectively appear to be someone else if they find they happen to be running an open proxy.

Additionally routing traffic through a proxy (or a chain of proxies) requires very little extra effort to code into any application once you understand the basic idea of how a http request works.

Tony