New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Facebook Flooding My Server?
Wira_Soenaryo
Member
in Help
Hello,
Does anyone ever experience the server have a lot of connection from Facebook?
My server being flooded from Facebook IP address now.
==============================
66.220.145.245 * inout 7m 21s lfd - (CT) IP 66.220.145.245 (US/United States/-) found to have 791 connections
66.220.145.244 * inout 7m 21s lfd - (CT) IP 66.220.145.244 (US/United States/-) found to have 994 connections
66.220.145.243 * inout 7m 21s lfd - (CT) IP 66.220.145.243 (US/United States/-) found to have 877 connections
66.220.145.246 * inout 7m 21s lfd - (CT) IP 66.220.145.246 (US/United States/-) found to have 864 connections
==============================
Currently I blocked it using CSF Firewall... Any idea how to solve this strange issue?
Thanks...
Comments
Are you running a website on that server ? It might be getting shared a lot of Facebook and it keeps fetching the site's metadata ...
Do you not like traffic? Are you aware of what facebook is?
Hello,
Of course I do like traffic... but this big connection suddently came in to my server, so I kind of bit worry something wrong is happening.
Should everybody think that this is a good sign... then I will be very happy to accept this huge connection..
Thanks..
Maybe something like that: http://securityaffairs.co/wordpress/24359/cyber-crime/use-facebook-ddos-attack.html
Possible a script is running on your server and causing an incoming flood from facebook.
True story: If something on your site gets shared on facebook repeatedly, you will see a flood of traffic from facebook.
It'll end as quickly as it started if people have trouble sharing it effectively. Always be reluctant to block these connections unless you don't want your website to gain popularity.
Look at the web server logs instead of looking at raw TCP connections. What's facebook actually doing? If it's a facebook bot trying to get meta data you should be able to tell if you look at the web server logs.
I use CF as my DNS... if I put CF mode on "Under Attack", all the connection to Facebook will gone slowly...
I believe there no script on my site causing this flood.. My site is web forum based on phpBB... maybe it's like @dotted said some image being used on FB that caused this huge incoming connection..
@Kabeldamagement : this is what I'm afraid of...
Anyway, anybody maybe experiencing the same like me?
Thanks..
Because it tries to captcha the bot and fails...
As @jarland said, if a link is shared on FB you see a lot of this at first.
If your server isn't having any problems and your website is running correctly, what are you worried about ?
Normally meta data is carefully cached from what I've seen from facebook. In fact, the other day I had to literally force facebook to refresh the meta data so it sounds weird to me because if the traffic was from clicks, the ips would most likely be from the clients who clicked on it.
Of course, it greatly depends on what is being shared and how. If it's someone just deep linking to a picture, or there's a
rel="nofollow"on a link, then there really isn't that much objective value in being "popular". Still, unless the traffic is obvious abuse, it doesn't make much sense to block it.