I have noticed lately how my server is being slowed down dramatically during certain parts of the day, and so I proceeded to look into the possibility of a DOS attack or particular heavy usage from some quarters.
What I learned was rather astonishing.
On one of my websites on the server, I track script processing time for each page load. Using this value, I could see what IPs were hitting the most when the processing times were the greatest.
A great number of the page loads in this review were coming from 207.46.*.* -- Microsoft. And a lot of these page loads weren't coming from their search spider, but rather apparently ordinary browser configurations. This seems to be consistent with various reports of Microsoft's various forms of testing websites.
What I then proceeded to do was compare the average script processing time for page loads coming from 207.46.*.* to pages loads coming from anywhere else.
For the last two months, the average proc time was:
MS: 2.299 secs.
Non-MS: 1.143 secs.
For the last month:
MS: 2.907 secs.
Non-MS: 1.46 secs.
For the last week, approximately:
MS: 6.078 secs.
Non-MS: 2.236 secs.
I really couldn't believe my eyes at these results.
Does anyone have ideas for strategies to deal with this beyond simply blocking Microsoft's IP range?