From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 160573B2A0 for ; Fri, 17 Jun 2016 23:06:25 -0400 (EDT) Received: by mail-qk0-x230.google.com with SMTP id a186so104715497qkf.0 for ; Fri, 17 Jun 2016 20:06:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=2e0x7GOf+fnp5rQlQYCPz0Fauiqu4EW0pIm8n8+1mNw=; b=MVJl6pBt8mYmZcT2pM7tees4VoQIFaeMXg4bXvtykUg49UBP91jSgo5yinfIPKfkJe jZxReCgYL1U6MLFJ/3W99vWxkHsxnHy0aS/9JkfxsRCIHiPppROqRG0svZ4vDaRRj2EW I9SD6iG6tKde4zgcg1aEYFyG+xd4L7E3WfRi1KMEl5YJZqkZhlvFIzZWaKtPFiaydbR1 N7JIhkl/eG6VL7wcgeyb1p67GhfgUwfE9MBOb77IvKFAU5aDhDcciP3t0mFdYGtQR+Os jdRx/SewNAu1eefdkHQ+54B46JGFRKDMtXokcyWgFvd2HGeNLDJfJmHm+nJT6LoZqLLs 0cOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=2e0x7GOf+fnp5rQlQYCPz0Fauiqu4EW0pIm8n8+1mNw=; b=VmTm7S7P30n3+2HAv+zcIQ0JchRJ+W8vSb5Cyk2OmxoOd2e/hKrFkSSocXhyI6s6GJ YC/5e7thq3CNhR+wNybooEZp3JrQPIyCpFYIXBKycJEHkZknMkVTuLrnSHI3wkzOUy9B 6vcynWcS82yTIJgT/VQ2wgqSnHtDs1LL7jacy0PATj+IsaaJ3KEO4rIo4W2hkdLPcZIV Dkn4VASgAjV+l+r8p6s+LxwLuIf6Cf4RLBUPd1kKLl81effhzkxUd1riiKvxVirrtkse 3iF8WIFcR130Z6WZHMLa8SRP+3rrbVm9KjWlPmLpVFJ+sW4ej2gBIPlqKIretdBkZJFI WSiQ== X-Gm-Message-State: ALyK8tKA+/MG1RrTIWNrQshnXYEbb6FgzUbac7Z5AKDeJ4XU788WXsYfGSvMD86mdon9Yg== X-Received: by 10.200.36.200 with SMTP id t8mr6638121qtt.64.1466219184585; Fri, 17 Jun 2016 20:06:24 -0700 (PDT) Received: from [192.168.253.145] ([64.223.225.136]) by smtp.gmail.com with ESMTPSA id n137sm14664691qke.0.2016.06.17.20.06.23 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 17 Jun 2016 20:06:24 -0700 (PDT) From: Rich Brown Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: <0E1152D2-F8C2-490E-B9A4-81B74DA539DC@gmail.com> Date: Fri, 17 Jun 2016 23:06:22 -0400 To: bloat Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) X-Mailer: Apple Mail (2.2104) Subject: [Bloat] statistics for netperf.bufferbloat.net X-BeenThere: bloat@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: General list for discussing Bufferbloat List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Jun 2016 03:06:25 -0000 Folks, I host netperf.bufferbloat.net on a VPS (using Ramnode.com - highly = reliable) I regularly get close to, or run over my monthly data transfer = limit for my VPS. (When this happens, they suspend my VPS until the end = of the month. I have already added an additional $4/month for additional = data, but now I'm running into a 5 TB limit.) I could pony up another $4/month to get another 1TB of data, but I got = curious about who's using the service and if it makes sense that I = should be seeing that much traffic. I set up iptables to log incoming = connections to port 12865 (netperf server). A quick analysis of the = /var/log/kern.log gives the top-ten users for Feb-to-date, and also for = the last week. See the table below or = https://docs.google.com/spreadsheets/d/1y3kYOoCaOpPt3V2v1QGKUhmYGG1yb6KjM9= lwIH4AbQA/edit#gid=3D0. A few notable observations: - There were 1,098,020 netperf sessions recorded from Feb-Jun. - The top ten addresses accounted for 654K of those sessions. - Eight of the top 10 addresses for the full observation period are = still active the most recent week. This indicates that those addresses = appear to be relatively static. - whois says that a high percentage of the addresses appear to be in = Portugal. My questions to this august group: - Are any of you in Portugal? If so, are you really testing this = frequently? - If not, is there any reason not to add an iptables rule for the = addresses below to drop those incoming connections from those addresses? - Any other thoughts for slowing down this "abusive" behavior? Many thanks, Rich 11-Feb-16 17-Jun-16 5-Jun 13-Jun 127 days =09 109433 176.78.183.238 x 57693 193.126.23.244 107384 109.49.94.196 x 50131 109.49.94.196 105936 193.126.23.244 x 47033 68.238.49.248 91787 68.238.49.248 x 42329 176.78.183.238 56184 193.126.22.52 x 42064 88.210.82.86 54395 88.210.82.86 x 35877 93.102.137.61 35877 93.102.137.61 x 34672 193.126.22.52 32919 89.154.251.179 x 21213 89.181.102.43 32400 93.102.205.115 16226 93.102.236.246 27917 78.99.248.25 x 15008 89.154.251.179 654232 top 10 14667 78.99.248.25 1098020 All=E2=80=A6 =09 =09