[Bloat] statistics for netperf.bufferbloat.net

[Bloat] statistics for netperf.bufferbloat.net

[Rich Brown]

Folks,

I host netperf.bufferbloat.net on a VPS (using Ramnode.com - highly reliable) I regularly get close to, or run over my monthly data transfer limit for my VPS. (When this happens, they suspend my VPS until the end of the month. I have already added an additional $4/month for additional data, but now I'm running into a 5 TB limit.)

I could pony up another $4/month to get another 1TB of data, but I got curious about who's using the service and if it makes sense that I should be seeing that much traffic. I set up iptables to log incoming connections to port 12865 (netperf server). A quick analysis of the /var/log/kern.log gives the top-ten users for Feb-to-date, and also for the last week. See the table below or https://docs.google.com/spreadsheets/d/1y3kYOoCaOpPt3V2v1QGKUhmYGG1yb6KjM9lwIH4AbQA/edit#gid=0.

A few notable observations:

- There were 1,098,020 netperf sessions recorded from Feb-Jun.
- The top ten addresses accounted for 654K of those sessions.
- Eight of the top 10 addresses for the full observation period are still active the most recent week. This indicates that those addresses appear to be relatively static.
- whois says that a high percentage of the addresses appear to be in Portugal.

My questions to this august group:

- Are any of you in Portugal? If so, are you really testing this frequently?
- If not, is there any reason not to add an iptables rule for the addresses below to drop those incoming connections from those addresses?
- Any other thoughts for slowing down this "abusive" behavior?

Many thanks,

Rich

11-Feb-16	17-Jun-16		5-Jun	13-Jun
127	days			
109433	 176.78.183.238	x	57693	 193.126.23.244
107384	 109.49.94.196	x	50131	 109.49.94.196
105936	 193.126.23.244	x	47033	 68.238.49.248
91787	 68.238.49.248	x	42329	 176.78.183.238
56184	 193.126.22.52	x	42064	 88.210.82.86
54395	 88.210.82.86	x	35877	 93.102.137.61
35877	 93.102.137.61	x	34672	 193.126.22.52
32919	 89.154.251.179	x	21213	 89.181.102.43
32400	 93.102.205.115		16226	 93.102.236.246
27917	 78.99.248.25	x	15008	 89.154.251.179
654232	top 10		14667	 78.99.248.25
1098020	All…			
		

Re: [Bloat] statistics for netperf.bufferbloat.net

[Kevin Darbyshire-Bryant]

On 18/06/16 04:06, Rich Brown wrote:
> Folks,
>
> I host netperf.bufferbloat.net on a VPS (using Ramnode.com - highly reliable) I regularly get close to, or run over my monthly data transfer limit for my VPS. (When this happens, they suspend my VPS until the end of the month. I have already added an additional $4/month for additional data, but now I'm running into a 5 TB limit.)
>
>
> My questions to this august group:
>
> - Are any of you in Portugal? If so, are you really testing this frequently?
> - If not, is there any reason not to add an iptables rule for the addresses below to drop those incoming connections from those addresses?
> - Any other thoughts for slowing down this "abusive" behavior?
>
> Many thanks,
>
> Rich
>
> 11-Feb-16	17-Jun-16		5-Jun	13-Jun
> 127	days			
> 109433	 176.78.183.238	x	57693	 193.126.23.244
> 107384	 109.49.94.196	x	50131	 109.49.94.196
> 105936	 193.126.23.244	x	47033	 68.238.49.248
> 91787	 68.238.49.248	x	42329	 176.78.183.238
> 56184	 193.126.22.52	x	42064	 88.210.82.86
> 54395	 88.210.82.86	x	35877	 93.102.137.61
> 35877	 93.102.137.61	x	34672	 193.126.22.52
> 32919	 89.154.251.179	x	21213	 89.181.102.43
> 32400	 93.102.205.115		16226	 93.102.236.246
> 27917	 78.99.248.25	x	15008	 89.154.251.179
> 654232	top 10		14667	 78.99.248.25
> 1098020	All…			
It ain't me.  And I'd have blocked those addresses just before writing 
the email....see who screams :-)  I hope this isn't some DDoS scheme 
someone has cooked up using netperf servers.

Kevin