[Steve]

I’ve got a bbpress install which I run as support forum. I sometimes post links to zip files in there with patch fixes on them.

I was looking at my webstats and noticed :

a) A huge number of hits on my zip files

b) A huge increase in bandwith against my website from my own server

Checking my access logs I see:

192.168.0.1 - - [10/Nov/2011:06:37:13 +0000] "HEAD /wordbooker/wordbookerdebug200401.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:13 +0000] "GET /wordbooker/wordbookerdebug200401.zip HTTP/1.0" 200 818430 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:29 +0000] "HEAD /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:29 +0000] "GET /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 818550 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:40 +0000] "HEAD /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:40 +0000] "GET /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 818550 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:46 +0000] "HEAD /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:46 +0000] "GET /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 832241 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:46 +0000] "HEAD /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:37:46 +0000] "GET /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 832241 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:29 +0000] "HEAD /wordbooker/wordbookerdebug200401.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:29 +0000] "GET /wordbooker/wordbookerdebug200401.zip HTTP/1.0" 200 818430 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:45 +0000] "HEAD /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:45 +0000] "GET /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 818550 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:50 +0000] "HEAD /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:50 +0000] "GET /wordbooker/wordbookerdebug200402.zip HTTP/1.0" 200 818550 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:55 +0000] "HEAD /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:55 +0000] "GET /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 832241 "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:55 +0000] "HEAD /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 - "-" "bbPress/1.0.3"

192.168.0.1 - - [10/Nov/2011:06:38:55 +0000] "GET /wordbooker/wordbookerdebug200403.zip HTTP/1.0" 200 832241 "-" "bbPress/1.0.3"

So why is bbPress doing this? I did wonder if it was one of the plugins but surely they’d show as external IP addresses.

[Steve]

I just realised I was on 1.0.3 not 1.1 so I’ve upgraded and will see if it fixes the problem

[Steve]

And it doesn’t

[John James Jacoby]

Possible a logged in user is spamming it and being caught by Akismet?

[Steve]

Only 2 spams this month according to Akismet

Just did a grep of the access log round one of those times and there is NOTHING going on

[Steve]

Turned off all the plug-ins apart from support forums and it still did it. It doesn’t do it if the zip file is located on the same domain as the BBPress install.

[Steve]

I turned off every single plugin and it still does it – so its something in the core of bbpress 1.1

[John James Jacoby]

That’s new information.

If you’re linking between domains on the same IP, chances are the traffic is just natural traffic. Any correlation between these hits and legitimate views? Any stats or analytics you can use to see if it something server side is pinging or tracking back?

[Steve]

Its not natural traffic – it just seems to be bbpress doing repeated head/gets on links that are pasted in posts – it also seems to do it to links out to other sites – well it used 195MB of bandwidth against another server in less than 1 day.

And I’ve found it does do it if the file is in the same domain – just missed it in the access logs.

Checking my server access logs the only odd thing I see is

192.168.0.1 - - [16/Nov/2011:07:59:44 +0000] "POST /xmlrpc.php HTTP/1.0" 200 483 "-" "The Incutio XML-RPC PHP Library -- bbPress/1.1"

184.168.193.192 - - [16/Nov/2011:07:59:53 +0000] "GET /forums/topic/please-help-with-wordbooker-image-problem HTTP/1.0" 200 42632 "-" "WordPress/3.2.1; http://alt3redegos.com"

184.168.193.192 - - [16/Nov/2011:08:00:05 +0000] "GET /forums/topic/please-help-with-wordbooker-image-problem HTTP/1.0" 200 42632 "-" "WordPress/3.2.1; http://alt3redegos.com/dev/relaunch"

184.168.193.192 - - [16/Nov/2011:08:00:12 +0000] "GET /forums/topic/please-help-with-wordbooker-image-problem HTTP/1.0" 200 42632 "-" "WordPress/3.2.1; http://alt3redegos.com/dev/relaunch"

192.168.0.1 - - [16/Nov/2011:08:00:21 +0000] "HEAD /wp-content/uploads/debugs/wordbookerdebug200406.zip HTTP/1.0" 200 - "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:21 +0000] "GET /wp-content/uploads/debugs/wordbookerdebug200406.zip HTTP/1.0" 200 862574 "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:21 +0000] "HEAD /wp-content/uploads/debugs/wordbookerdebug200406.zip HTTP/1.0" 200 - "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:21 +0000] "GET /wp-content/uploads/debugs/wordbookerdebug200406.zip HTTP/1.0" 200 862574 "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:40 +0000] "HEAD /2011/10/12/the-new-posting-options-explained/ HTTP/1.0" 200 - "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:41 +0000] "POST /xmlrpc.php HTTP/1.0" 200 483 "-" "The Incutio XML-RPC PHP Library -- bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:41 +0000] "HEAD /forums/topic/debug-204-6 HTTP/1.0" 200 - "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:42 +0000] "GET /forums/topic/version-204-released HTTP/1.0" 200 28310 "-" "bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:08:00:41 +0000] "POST /forums/xmlrpc.php HTTP/1.0" 200 446 "-" "The Incutio XML-RPC PHP Library -- bbPress/1.1"

192.168.0.1 - - [16/Nov/2011:07:46:44 +0000] "POST /forums/bb-cron.php?doing_wp_cron HTTP/1.0" 200 - "-" "bbPress/1.1"

So why does that bb-cron call at 07:46 appear after the 08:00 activies. What does bb-cron do?

[Steve]

If I rename bb-cron.php the problem goes away. So what jobs does bb-cron normally run?