<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Bots are a Web Crawler problem. They check
a web page and follow all the links. One is to your stream. They wait for the “Page”
to finish loading, but as this is a stream, it never finishes loading. They
just see data coming and do not check if it is audio or HTML.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Not that I am advocating for Shoutcast,
but it does have two features that would be useful, A ban list, and a maximum duration
setting. No one listens for more than 24 hours.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Tony<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>
Icecast [mailto:icecast-bounces@xiph.org] <b><span style='font-weight:bold'>On
Behalf Of </span></b>Rob Hailman<br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, February 3, 2023
6:53 AM<br>
<b><span style='font-weight:bold'>To:</span></b> icecast@xiph.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> [Icecast]
"Ghost" connections causing connection limit to be reached</span></font><span
lang=EN-US><o:p></o:p></span></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Hello,<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I've been having an issue periodically where our Icecast server (which
is set to a max 200 connections) will reach that limit and start rejecting all
connections, but most of the connections don't seem to be real active
listeners.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>We are running icecast 2.4.4, installed via apt on Ubuntu 22.04.1 LTS.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>We have four streams - two mp3 and two ogg. It seems like what is
happening is that connections to the ogg streams are never getting released -
so the number of clients will go up and up until all 200 connections are taken
up. An excerpt from error.log, showing the mp3 stream count fluctuating but the
.ogg count only increasing:<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>[2023-01-29 10:25:46] INFO source/source_main listener count on
/hi-fi now 6<br>
[2023-01-29 10:25:47] INFO source/source_main listener count on /hi-fi
now 5<br>
[2023-01-29 10:25:47] INFO source/source_main listener count on
/hi-fi.ogg now 124<br>
[2023-01-29 10:25:51] INFO source/source_main listener count on /hi-fi
now 4<br>
[2023-01-29 10:26:17] INFO source/source_main listener count on
/hi-fi.ogg now 125<br>
[2023-01-29 10:26:47] INFO source/source_main listener count on
/hi-fi.ogg now 126<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>When I restart icecast, the logs will show all 200 connections being
released - and in access.log, most of the .ogg connections will be for very
long durations with very small amounts of data transferred - for example:<o:p></o:p></span></font></p>
</div>
<div><span style='white-space:pre-wrap'>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><br>
<br>
</span></font><o:p></o:p></p>
</div>
</span>
<div><span style='white-space:pre-wrap'>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>77.88.9.3 - - [02/Feb/2023:21:40:29 +0000]
"GET /hi-fi.ogg HTTP/1.1" 200 422 "-" "Mozilla/5.0
(compatible; YandexBot/3.0; +<a href="http://yandex.com/bots">http://yandex.com/bots</a>)"
2694965</span></span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>If I'm reading that correctly, the connection was open for <font
color=black><span style='color:black'><span style='white-space:pre-wrap'>31
days with 422 bytes transferred.</span></span></font><o:p></o:p></span></font></p>
</div>
<div><span style='white-space:pre-wrap'>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><br>
<br>
</span></font><o:p></o:p></p>
</div>
</span>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Many (but not all) of these connections seem to be bots.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Would be happy to provide the full log files but didn't want to send
>1MB files to the whole list.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Is this a possible configuration issue, an Icecast bug, or something
else? Any help or suggestions would be greatly appreciated!<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Thanks,<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Rob<o:p></o:p></span></font></p>
</div>
</div>
</div>
</body>
</html>