Icecast - Feb 2022 - Many short connections less than 1 second

Good afternoon Philipp,



I think this is a good example.



The second one is an OnlineRadioBox HisBot, this one is OK.

The first and the third and fourth one, is one I can?t understood. All 3 are the
same IP.

For example, I had yesterday 81 IP-Addresses with 219 accesses smaller than 1
second. Some of them really connect later some not!

I log the IPs and the time. If it would help, I could forward you one of the
emails to your private management address.



Thanks,

Hans-Georg







-----Urspr?ngliche Nachricht-----
Von: Icecast [mailto:icecast-bounces at xiph.org] Im Auftrag von Philipp Schafft
Gesendet: Mittwoch, 23. Februar 2022 16:58
An: Icecast streaming server user discussions
Betreff: Re: [Icecast] Many short connections less than 1 second



Good afternoon,



On Wed, 2022-02-23 at 12:54 +0100, HGAlt wrote:
> Hi,
>
> I have figured out, that I have many connections with a duration of
> less than 1 second and these IP addresses are never connected for
> longer time.
> Can anybody tell me, what could be a possible reason for that?
> I am afraid that something with my configuration could be wrong!


it is a little bit hard to say without details.



Maybe you want to post a typical access.log entry for one of them?



Generally such requests could be some kind of probing.



With best regards,



--

Philipp Schafft (CEO/Gesch?ftsf?hrer)

Telephon:  +49.3535 490 17 92

Website:   https://www.loewenfelsen.net/

Follow us: https://www.linkedin.com/company/loewenfelsen/



L?wenfelsen UG (haftungsbeschr?nkt)     Registration number:

Bickinger Stra?e 21                     HRB 12308 CB

04916 Herzberg (Elster)                 VATIN/USt-ID:

Germany                                 DE305133015



--
Diese E-Mail wurde von Avast Antivirus-Software auf Viren gepr?ft.
https://www.avast.com/antivirus
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.xiph.org/pipermail/icecast/attachments/20220223/88184eab/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12559 bytes
Desc: not available
URL:
<http://lists.xiph.org/pipermail/icecast/attachments/20220223/88184eab/attachment.png>

Is it possible their listening software has some kind of local buffer 
and they
are just keeping it full?

Is there any benefit to having lots of short overlapping connections 
rather than
one solid connection?

Having Line 1 be a different software than lines 3 and 4 is kind of odd.



On 2/23/22 10:19, HGAlt wrote:
>
> Good afternoon Philipp,
>
> I think this is a good example.
>
> The second one is an OnlineRadioBox HisBot, this one is OK.
>
> The first and the third and fourth one, is one I can?t understood. All 
> 3 are the same IP.
>
> For example, I had yesterday 81 IP-Addresses with 219 accesses smaller 
> than 1 second. Some of them really connect later some not!
>
> I log the IPs and the time. If it would help, I could forward you one 
> of the emails to your private management address.
>
> Thanks,
>
> Hans-Georg
>
> -----Urspr?ngliche Nachricht-----
> Von: Icecast [mailto:icecast-bounces at xiph.org] Im Auftrag von Philipp 
> Schafft
> Gesendet: Mittwoch, 23. Februar 2022 16:58
> An: Icecast streaming server user discussions
> Betreff: Re: [Icecast] Many short connections less than 1 second
>
> Good afternoon,
>
> On Wed, 2022-02-23 at 12:54 +0100, HGAlt wrote:
>
> > Hi,
>
> >
>
> > I have figured out, that I have many connections with a duration of
>
> > less than 1 second and these IP addresses are never connected for
>
> > longer time.
>
> > Can anybody tell me, what could be a possible reason for that?
>
> > I am afraid that something with my configuration could be wrong!
>
> it is a little bit hard to say without details.
>
> Maybe you want to post a typical access.log entry for one of them?
>
> Generally such requests could be some kind of probing.
>
> With best regards,
>
> --
>
> Philipp Schafft (CEO/Gesch?ftsf?hrer)
>
> Telephon:? +49.3535 490 17 92
>
> Website:?? https://www.loewenfelsen.net/
>
> Follow us: https://www.linkedin.com/company/loewenfelsen/
>
> L?wenfelsen UG (haftungsbeschr?nkt) Registration number:
>
> Bickinger Stra?e 21 HRB 12308 CB
>
> 04916 Herzberg (Elster) VATIN/USt-ID:
>
> Germany ???????????DE305133015
>
>
>
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
> 	Virenfrei. www.avast.com 
>
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
>
>
> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast