Cellar cloud move

[Undertoad]

For the first time, it's possible to isolate and graph only Cellar-related internet traffic. The blue is stuff being uploaded. The first peak is the entire site and database being uploaded. The second one is just the database. The third is a small backup.

The green is people browsing and getting images and stuff. This first week of traffic shows that the estimates were about right. We can't fill the green part to the top, maybe to about the 2.0 line. Point is, we do have room to grow under this plan.

The first green bump: I had the Cellar answering not just to cellar.org, but also to the system's raw IP address. This caused Bing to decide it was an entirely new site on the Internets, and start collecting it and indexing it. That bump is the traffic that resulted. I figured out what was going on and shut it down.

Stuff like that happens; it's hard to tell whether someone is a web indexer, or is maliciously crushing your website. That bandwidth has to be paid for, too. Well in this case, it's not that bad. Fits under the plan. But it can be really bad.

[classicman]

... what cookies? Did I mention the awesome oatmeal raisin cookies my son and I made?

[xoxoxoBruce]

I just hit the eat a cookie button out of curiosity.

"People are worried about online porn on the Internet. It's the endless `Who's better--Kirk or Picard?' threads that *should* scare them."
- Jim Mullen, _Entertainment Weekly_

[Undertoad]

It looked like a denial-of-service attack last night.

This was 20 different IP addresses hitting every single link on the Cellar last night in various patterns. After two hours, the new cloud provider's bots noticed the spike and alerted me to it.

We had these attacks before, but after the move I hadn't blocked the IP addresses that are responsible for it. You can see how, at the end, it doesn't suddenly stop - it trails off. That's me, blocking various sets of addresses until I got them all.

This one three hour attack led to more bandwidth use than about 4 days of everyone just generally Cellarizing. It's not big deal because the capacity to handle it is built in.

[glatt]

So you had to go in and fix it at 11PM last night? What a pain in the ass.

Thank you.

[Undertoad]

However, the good news is that the forum remained responsive, even as the system used all its resources to produce and deliver 200,000 Cellar hits over the space of two hours.

In comparison, during the 20:00 hour there were 3500 hits delivered...

[sexobon]

Is there something tangible to be gained by the attackers; or, is it just for shits and grins?

[Undertoad]

Well, "go in" means I had to stop playing Rocket League and ssh to the server and figure it out. So that was a pain in the ass, but now, I consider it professional experience. Running Cellar servers has kept me fresh in certain areas of knowledge and it's been a real benefit at my new gig.

The whole move has been like that; it forces me to stay on my toes. In fact the whole Cellar lifetime has been like that, a hobby that pays back a little. It's rare I think. Playing bass has never helped me professionally. That I know of.

[Undertoad]

As for why they do it - impossible to know! The attacks started a few months ago I think. We probably have enemies. Or maybe I do. Can't tell.

It's easy enough to create code that will harass a website by merely overloading it or confusing its logging. This sort of thing happens all the time.

[xoxoxoBruce]

Probably somebody I pissed off.

Sharpened your pro skills? Your welcome.

[Clodfobble]

Originally Posted by Undertoad

We probably have enemies. Or maybe I do. Can't tell.

For some reason, the idea of Lamplighter secretly being a sophisticated technological anarchist running a darkened room full of hackers amuses me greatly.

But honestly, I would have thought DDoS attacks were always from overseas, and were basically practice runs for their attempts to bring down really big sites for ransom.

[Undertoad]

These are coming from server co-location type places in the US. But it could just as easily be foreign Asian to begin with, and proxied somehow through these other places, so you never know.

[sexobon]

Well, it's probably not ISIS since Anonymous declared war on them.

[lumberjim]

I always think this thread title is the cellar. 'could' move