General list for discussing Bufferbloat
 help / color / mirror / Atom feed
From: Rich Brown <richb.hanover@gmail.com>
To: bloat <bloat@lists.bufferbloat.net>
Subject: [Bloat] statistics for netperf.bufferbloat.net
Date: Fri, 17 Jun 2016 23:06:22 -0400	[thread overview]
Message-ID: <0E1152D2-F8C2-490E-B9A4-81B74DA539DC@gmail.com> (raw)

Folks,

I host netperf.bufferbloat.net on a VPS (using Ramnode.com - highly reliable) I regularly get close to, or run over my monthly data transfer limit for my VPS. (When this happens, they suspend my VPS until the end of the month. I have already added an additional $4/month for additional data, but now I'm running into a 5 TB limit.)

I could pony up another $4/month to get another 1TB of data, but I got curious about who's using the service and if it makes sense that I should be seeing that much traffic. I set up iptables to log incoming connections to port 12865 (netperf server). A quick analysis of the /var/log/kern.log gives the top-ten users for Feb-to-date, and also for the last week. See the table below or https://docs.google.com/spreadsheets/d/1y3kYOoCaOpPt3V2v1QGKUhmYGG1yb6KjM9lwIH4AbQA/edit#gid=0.

A few notable observations:

- There were 1,098,020 netperf sessions recorded from Feb-Jun.
- The top ten addresses accounted for 654K of those sessions.
- Eight of the top 10 addresses for the full observation period are still active the most recent week. This indicates that those addresses appear to be relatively static.
- whois says that a high percentage of the addresses appear to be in Portugal.

My questions to this august group:

- Are any of you in Portugal? If so, are you really testing this frequently?
- If not, is there any reason not to add an iptables rule for the addresses below to drop those incoming connections from those addresses?
- Any other thoughts for slowing down this "abusive" behavior?

Many thanks,

Rich

11-Feb-16	17-Jun-16		5-Jun	13-Jun
127	days			
109433	 176.78.183.238	x	57693	 193.126.23.244
107384	 109.49.94.196	x	50131	 109.49.94.196
105936	 193.126.23.244	x	47033	 68.238.49.248
91787	 68.238.49.248	x	42329	 176.78.183.238
56184	 193.126.22.52	x	42064	 88.210.82.86
54395	 88.210.82.86	x	35877	 93.102.137.61
35877	 93.102.137.61	x	34672	 193.126.22.52
32919	 89.154.251.179	x	21213	 89.181.102.43
32400	 93.102.205.115		16226	 93.102.236.246
27917	 78.99.248.25	x	15008	 89.154.251.179
654232	top 10		14667	 78.99.248.25
1098020	All…			
		



             reply	other threads:[~2016-06-18  3:06 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-06-18  3:06 Rich Brown [this message]
2016-06-18  8:43 ` Kevin Darbyshire-Bryant

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://lists.bufferbloat.net/postorius/lists/bloat.lists.bufferbloat.net/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0E1152D2-F8C2-490E-B9A4-81B74DA539DC@gmail.com \
    --to=richb.hanover@gmail.com \
    --cc=bloat@lists.bufferbloat.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox