Pages viewed but no bandwidth used?

[memaggiem]

Hi all! I've searched around a bit but have not been able to find an answer tomy question. I hope you all might be able to share your wisdom!

I have a few IP addresses showing up in my website logs - they have so far loaded 1000+ pages each but have used zero badnwidth. Now here's the dumb question.....

What is going on here? I see this for a few different IP addresses. Are they "hijacking" my site or something?

Thanks for your help!!
Maggie

[wige]

When you visit a web page, your browser will generally store a copy of the page in an internal cache. If the server is set up correctly, when the page is visited again, your browser will tell the server the date of the cached version of the page, and if the page has not been updated since the last visit, the server responds with a "no update" message (I'm too lazy to look up the status code) and the browser will simply display the page from the cache rather than getting the page from the server. As the no-update message is very small, repeat traffic could be the cause.

[Jean-Luc]

wige is referring to pages sending a 304 code when being visited by a browser that still have the page in local cache.

There can be another reason for what memaggiem sees in his stats. If a web robot sends a HEAD request, the server will only send the header back without content. An example of application is to check if a server is alife.

I guess that you are talking about AWStats statistics. When AWStats talks about "bandwidth", only the data bytes are counted. Packets that only contain a header count for zero data. This (slightly) underestimates the real bandwidth.

Jean-Luc

[memaggiem]

Hmm....yep, AWStats

I'm a bit suspect about 1000s of pages being loaded from cache - I'm talking 1 IP address has literally now viewed 2304 pages with 0 bandwidth being used (as of today that is)
As best I can tell, the IPs in question are NOT robots due to WHOIS look-ups and whatnot.

I hate to ban IPs when this may be harmless but really now.....I'm flummoxed about the how/why of it all! The robot asking only for header sounds plausible but asking 2304 times?

THanks!
Maggie

[Jean-Luc]

Suggestion: look in the log file and search for the IP address. You will see if there is a 304 code or if there is a HEAD method or something else.

Jean-Luc

[wige]

How often are you getting the requests, per IP address? Is it hourly, a flood of requests in a few minutes, a few requests a day, or some other pattern?

[memaggiem]

I'm trying to get the log files now. I'll post back for the specific IP I mentioned - thanks again very much!

[carbonize]

Sounds like spam attempts as all a spammer does is send the data. If it's a form they just send the POST data and for referrer spam they only need send a GET request and then close the connection so no data is sent back to them.