[arch-mirrors] Huge traffic from China

[mirror-admin]

Hi,

we got request from fraction of subnet 27.221.66.0/24

thx

On 7/2/2020 12:52, services via arch-mirrors wrote:

> Hello,
>
> Same case here.
>
> Impact is low here (via one ip only), because a file which don't exist 
> (old iso) :
> arch//iso/2020.03.01/archlinux-2020.03.01-x86_64.iso" failed (2: No 
> such file or directory)
>
> Can you share ip on the list for compare and block all ip before ddos ?
>
> Regards,
> Eric.
>
> On 7/2/2020 5:02 AM, mirror-admin wrote:
>> Hello,
>>
>> Yes, we notice same download pattern from china IP. Not only for 
>> Archlinux, but for other archive as well.
>>
>> What we do is try to be nice, we throttling down our upload speed to 
>> their IP.
>>
>> Thx
>>
>> On 7/2/2020 09:49, Johannes Findeisen wrote:
>>> Hello,
>>>
>>> I am driving the mirror arch.unixpeople.org. Since some months I
>>> encounter a lot of traffic from China which seems to be like a DDoS. I
>>> fixed this some month ago by blocking all IP address ranges from China.
>>> This stopped the traffic. Yesterday I tried to remove all my firewall
>>> rules and to see what happens... Just some hours ago the DDoS startet
>>> again so I really had to block China from my mirror again because it
>>> would become a fulltime job to monitor my host.
>>>
>>> While all this happened I tried to figure out what's going on and saw
>>> endless downloads of the arch .iso file from many many IP addresses in
>>> China. When the download from one IP had finished the download directly
>>> started again from exactly the same IP in an endless loop.
>>>
>>> Does anyone other here encounter such things?
>>>
>>> Regards
>>>
>>> Johannes