| View previous topic :: View next topic |
| Author |
Message |
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
 Posted: Sun Mar 21, 2010 3:58 am Post subject: |
 |
|
no, it's me jumping the gun. The per-mount access log would only apply to listeners on a stream. Using that approach would probably not be useful in general for this because the number of cases where a client drop could occur would be considerable. What might be better for this would be a simple flag in the <mount>, say
<skip_accesslog>true</skip_accesslog>
That flag would then limit logging in either a per-mount log or the global one.
karl. |
|
| Back to top |
|
 |
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 4:15 am Post subject: |
|
|
| OK. Any idea when this will be available to test? |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Sun Mar 21, 2010 4:43 am Post subject: |
|
|
try www.icecast.pwp.blueyonder.co.uk/icecast-2.3.2-kh21d.tar.gz
for consistency use
<mount>
<mount-name>/*/*.html</mount-name>
....
<skip-accesslog>true</skip-accesslog>
</mount>
However you should be getting a lot of requests actually dropped.
karl. |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 5:48 am Post subject: |
|
|
| Seems to work nicely. Thanks! |
|
| Back to top |
|
|
robertut
Joined: 31 Aug 2007
Posts: 156
|
| Posted: Sun Mar 21, 2010 11:46 am Post subject: |
|
|
| audiorapture wrote: |
| robertut wrote: |
| audiorapture wrote: |
| I now have 238,657 unique IPs in my blocklist and counting. |
How come, such a huge number? |
You should ask whoever is operating that botnet... I simply block each IP that makes a bogus request for [stream name]/index.html (which doesn't exist). |
Can be dangerous to block so many IPs, don't you think?
Since most internet providers use DHCP to their subscribers, you'll end up by blocking the enditre provider subnet, if the botnet is comming from that provider.
Today the botnet uses a certain IP,, you block it, but tomorrow uses another he got from the provider, while the new user who gets tomorrow the botnets's today IP will still be blocked.
You may end up in blocking more legitimate users than botnets, in 90%-10% aspect... don't you think? |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 1:53 pm Post subject: |
|
|
Given that botnets easily control millions of PCs and that IP adresses don't change /that/ often, even if they are dynamically assigned - no, I don't think the risk of blocking an innocent user is very high.
I think it is more likely that at some point I will get a bone-fide listener whose computer actually is infected. |
|
| Back to top |
|
|
robertut
Joined: 31 Aug 2007
Posts: 156
|
| Posted: Sun Mar 21, 2010 2:44 pm Post subject: |
|
|
| audiorapture wrote: |
| IP adresses don't change /that/ often |
In Europe, most ISPs have their DHCP lease time set to 1 hour. A simple reconnect always gets a new IP. |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Sun Mar 21, 2010 3:14 pm Post subject: |
|
|
My ISP (UK) has a stupidly low lease time (like a minute), and my IP rarely changes, DHCP does not require a different IP, ytou should just get an extension of the current IP, in fact it should be discouraged because so many things will break if you change IPs often. Think of a straightforward large http/ftp transfer.
What the IP collection will indicate is that the provider should be notified of the IP/time of the abuse. Whether the provider will actually do anything is another matter.
karl. |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 3:22 pm Post subject: |
|
|
| robertut wrote: |
| audiorapture wrote: |
| IP adresses don't change /that/ often |
In Europe, most ISPs have their DHCP lease time set to 1 hour. A simple reconnect always gets a new IP. |
I guess it's a good thing we don't care that much about the European market with our stream? |
|
| Back to top |
|
|
robertut
Joined: 31 Aug 2007
Posts: 156
|
| Posted: Sun Mar 21, 2010 5:59 pm Post subject: |
|
|
| audiorapture wrote: |
| I guess it's a good thing we don't care that much about the European market with our stream? |
LOL that doesn't mean that in your market there are no providers like the European ones LOL.
| karlH wrote: |
| What the IP collection will indicate is that the provider should be notified of the IP/time of the abuse. |
Indeed. Or use something more suitable for filtering out unwanted connections, like fail2ban. |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 6:58 pm Post subject: |
|
|
::shrugs:: honestly I am really not that concerned about false positives in the ban list.
I am more concerned with icecast seeming to time out on new connections in irregular intervals. |
|
| Back to top |
|
|
jcr
Modérateur français
Joined: 14 Apr 2006
Posts: 544
Location: France, Auvergne
|
| Posted: Sun Mar 21, 2010 7:33 pm Post subject: |
|
|
| audiorapture wrote: |
I guess it's a good thing we don't care that much about the European market with our stream? |
AFAIK, Europe is one of the most active community in icecast services..
What you guess is your own problem, but..
- Most internet services are international. ie, I host in France services (some icecast servers) for American, south Amarica, Japan, Africa.
- Internet is by nature, international.
- botnets and other crap are a global infection, we all need to fight against such absurdities.
For my own part, I use a somewhat basic perl script feeding fail2ban after 3 bad http requests... This has solved my problem.
_________________
Epsilon Friends Radio Icecast Radio on CentovaCast admin panel. Icecast hosting |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Sun Mar 21, 2010 8:16 pm Post subject: |
|
|
| audiorapture wrote: |
::shrugs:: honestly I am really not that concerned about false positives in the ban list.
I am more concerned with icecast seeming to time out on new connections in irregular intervals. |
I would need more information about those to see what can be done. A full error log showing this effect would be best.
karl. |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sun Mar 21, 2010 8:42 pm Post subject: |
|
|
| karlH wrote: |
| audiorapture wrote: |
| I am more concerned with icecast seeming to time out on new connections in irregular intervals. |
I would need more information about those to see what can be done. A full error log showing this effect would be best. |
To be perfectly honest, I cannot say that it's actually icecast's fault at this point.
The symptom is that a client tries to connect and times out (I haven't seen a second attempt fail, yet), a second symptom is that a client loses sync and buffers for a few seconds, but at least recovers nicely.
Since the hardware is rather old (P3-500, 128MB RAM) and darkice sits at around 70% CPU encoding 3 stream formats there could be many contributing factors... |
|
| Back to top |
|
|
audiorapture
Joined: 21 Aug 2009
Posts: 60
Location: Virginia, USA
|
| Posted: Sat Mar 27, 2010 12:29 pm Post subject: |
|
|
I reset the deny IP list to 0 today, and 2 things happened:
1) I got 1,300+ entries within 10 minutes
2) The timeout issue seems to have disappeared
It seems there is an issue with (overly long?) deny lists? At the end, mine had more that 260,000 entries (file size more than 3.5 MB).
I might just leave out the blocking part, since my access log is now save from these bogus requests. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
