900 hits from same IP in 20 minutes

GETting the same 2 files over and over

[Kenton]

Hi

My # of hits and bandwidth just spiked to a record high.

Checking the logs I find that someone does a search for my business name on google and goes to our home page.

My home page is basically 5 links and one image that changes when you rollover each link (5 different rollover images).

Anyway, this user (well an Alaskan University IP) looks as though they moved the mouse over 4 of the 5 options twice as these images were loaded twice (no cache?) and then did nothing for over an hour.

Then the same IP GETs all the images for the home page a few times each and then alternates between getting 2 of the rollover images nearly 900 times over 20 minutes. Back and forward over and over:

137.XXX.XXX.XXX - - [17/May/2004:11:52:42 -0700] "GET /images/My_Animated_GIF.gif HTTP/1.1" 200 13597 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
137.XXX.XXX.XXX - - [17/May/2004:11:52:43 -0700] "GET /images/Different_JPG.jpg HTTP/1.1" 200 55515 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
137.XXX.XXX.XXX - - [17/May/2004:11:52:44 -0700] "GET /images/My_Animated_GIF.gif HTTP/1.1" 200 13597 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
137.XXX.XXX.XXX - - [17/May/2004:11:52:45 -0700] "GET /images/Different_JPG.jpg HTTP/1.1" 200 55515 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
137.XXX.XXX.XXX - - [17/May/2004:11:52:47 -0700] "GET /images/My_Animated_GIF.gif HTTP/1.1" 200 13597 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
137.XXX.XXX.XXX - - [17/May/2004:11:52:47 -0700] "GET /images/Different_JPG.jpg HTTP/1.1" 200 55515 "http://www.example.net.au/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

...
then nothing until 3 & half hours later when they start GETing the images again but then move about the site like a regular user.

Has anyone seen this before?
Should I be concerned?
Should I block this IP?

Thanks
Kenton

[jdMorgan]

Kenton,

You might want to check your server's cache-control headers for those images... Or preload the images to prevent this from happening with other 'playful' users.

There were some threads here a while back discussing problems with IE and rollover images reloading from the server -- you might want to try searching for them.

Jim

[Kenton]

Thanks Jim

But how do I "check your server's cache-control headers for those images"?

Also, these images are preloaded.

I will search on [IE rollover images reloading] now

Thanks
Kenton

[jdMorgan]

Try this Server Headers checker [webmasterworld.com].

Jim

[Kenton]

Thanks again

I get:

HTTP/1.1 200 OK
Date: Thu, 20 May 2004 01:30:52 GMT
Server: Apache/1.3.27 (Unix) DAV/1.0.3 mod_gzip/1.3.26.1a mod_ssl/2.8.10 OpenSSL/0.9.6c PHP/4.3.5
Last-Modified: Fri, 14 May 2004 11:50:28 GMT
ETag: "427fec-28a9-40a4b284"
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 3081

is it the Keep-Alive causing the problem?

[jdMorgan]

No, you have no Expires or Max-age info for cache control [mnot.net] there... Therefore, it is up to the intervening caches and the browser cache to decide when the files are stale and need to be re-fetched.

This is usually not the problem. A too-short expiry period or an incorrectly-specified cache-control header can cause your problem, but usually missing cache-control header info causes stale-content problems -- stuff is not re-fetched often enough.

Look into the IE image caching bug [webmasterworld.com] I mentioned, and as additional data, see what happens if you visit your site with a Mozilla browser and "play" repeatedly with the mouseover images. If you see the same problem with Mozilla/Netscape/FireFox in your access logs, it's not an IE bug, it's site-related.

Jim