kahunaburger

Earlier on today I was stooopid enough to post a link to my Google Earth traceroute visualization on reddit.com.

I guess people liked it, actually liked it a lot. Within an hour traffic on the server was sky-rocketing. Unfortunately it also ended up on the wired.com main-page as well as popurls.com. All of them are major traffic generators and my poor 3MBit down / 1.5MBit up wireless connection to my ISP, CNSP, could not serve the visitors fast enough. The connection was simply saturated and users faced long load times.

At 11am CNSP had enough and shut down all http-traffic to my fixed ip-address. A minute later I get a call from them and was informed that some worm must have infiltrated my home-network. I assure them that it was just the reddit/wired/popurls effect and that no bad things were happening here at home. Http traffic was cut off for a few more hours and then they opened the floodgates again.

You can see the first spike in the top graph where apache (web server) hits are shown (those graphs are automatically created/updated by Munin). We go from 1-2 hits/sec to 8 hits/sec within one hour (after some log investigations I determined that the hits/sec was actually higher [somewhere around 20 hits/sec] – need to look into that). We stay at this peak for a while and then there’s the period where all traffic was blocked. Around 1pm traffic was allowed again.
The bottom chart shows the outgoing (top half) and incoming (bottom half) traffic. You can clearly see that we are capping at my upstream connection limit at 1.5Mbit.

What’s interesting is the middle chart, which shows the cpu usage during the spike. The server itself had a lot more headroom and could have easily served 4-5 times more traffic. On the left hand side of the cpu usage chart you see a rebuild of the FreeBSD package tree, which consumed a heck of a lot more cpu time than this spike.

Don’t post interesting stuff on reddit if you don’t have the bandwidth