Title: A night on the stats.

Author: Tim Pushman

Date: 09 July 2006 16:58:52 +01:00 or Sun, 09 July 2006 16:58:52 +01:00

Summary: When England's out of the Cup and the night is looking long, what does any bored sys admin do? Glass of good wine in hand, he trawls the web logs looking for the weird and the unusual.

Body: 

Now, as an average, accu.org pulls down between 1.5Gb and 2Gb of bandwidth a month (that's without the mailing lists and the journals) so it was quite a surprise to see a jump to 4.5Gb in May. Had the ACCU suddenly become so popular after the conference? Was this the hoped for stampede of eager new programmers? Unfortunately not... a quick glance showed that all the bandwidth gains had been on weekdays and that 25% had gone to one IP which belonged to a set of educational IPs (SBC Education Services), followed by a large chunk being used by Paradise Valley School District and Wayne Schools!

I hauled up the access logs for that period and checked through to see what was happening. It looked like all of those IPs were accessing various parts of myspace.com (a community site that is in the top 5 of web sites worldwide) and doing it through the ACCU Access Gateway. Because of the popularity of myspace.com, many schools block the IPs at their firewalls to stop students wasting time there during school hours. It seems that some enterprising school students have found out about the ACCU gateway and were using it as a proxy server. In fact, I even tracked down a posting on one of the forums at myspace.com advertising the fact that the ACCU had a proxy that was open to anyone.

Some more hours spent browsing through the logs showed up some other potentially interesting 'customers', particularly to a Russian site (no idea what it was about, I don't speak Russian) and to a Spanish community site.

It raises the question of when does an access gateway for the visually impaired become an anonymous proxy. And what, if anything, should be done about it. In the case of the schools above I blocked the three main IPs for a few days to see how traffic patterns changed (bandwidth usage dropped to half nearly) but later reenabled them. After all, maybe they are being used by the visually impaired? I have no way of telling.

Currently bandwidth is not a problem and so I've left things as they are. The main problem in practice is that is messes up the logs and usage statistics with a lot of irrelevant information, so I've moved the access gateway off to it's own sub domain (access.accu.org) and continue to keep an eye on it. However, it is quite possible that if too many people find out about a freely available proxy, something might have to change.

Notes: 

More fields may be available via dynamicdata ..