[Ltib] Help tracking down bandwidth issue

[Stuart Hughes]

Hi everyone,

I need your help.  As you may recall, there have been some issues this
month with bandwidth use.

The logs showed that on one day (18th April) a single IP address
downloaded over 1 terabyte of data.  After a long tussle with the
support team at the ISP, they agreed that it wasn't possible that
someone downloaded a terabyte in 24 hours and they chopped out the
offending entries from the access log for that day, which effectively
reset bitshrine.orgs bandwidth counters.

Anyhow, this is merely treating the symptom, not the cause.  What I
think is happening is that someone has a misbehaving script that
attempts to download a file, immediately gives up and then retries the
same download in a loop forever.

What I would like to to do is to think if any of you have:

* Written a script that could misbehave

* Have a "new" version of ltib that shows this kind of odd behaviour (I
doubt this as the client looks like a Windows NT .NET client).

* Have a theory to explain this.

To help you get your head around this, a section of one of the logs is
attached.

TIA, Stuart

access_log_extract_20110401.txt
Description: Text document