The GCache Nightmare
Many moons ago, I decided to run a little script called a GCache. It was supposed to help people using filesharing services to find other clients on the network and so bootstrap their connection. I deleted it 18 months ago, but still receive insane amounts of hits from it. I've complained to the makers of the different clients, but they never answer, and there seems to be nothing I can do to prevent what, according to my logs, looks like a distributed denial of service attack.
Take a look at this...
219.140.141.18 - - [05/Oct/2004:14:04:15 +0100] "GET /gcache/gcache.php?hostfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
24.199.178.209 - - [05/Oct/2004:14:04:21 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=1.1.0.7&get=1 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
208.230.87.25 - - [05/Oct/2004:14:04:32 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=1.1.0.8&get=1 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
4.181.131.124 - - [05/Oct/2004:14:04:33 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.1.1&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.1"
80.142.232.207 - - [05/Oct/2004:14:04:34 +0100] "GET /gcache/gcache.php?client=LIME&version=2.9.6&urlfile=1 HTTP/1.0" 404 162 "-" "LimeWire/2.9.6"
81.17.197.5 - - [05/Oct/2004:14:04:42 +0100] "GET /gcache/gcache.php?hostfile=1&client=MLDK&version=2.5-28 HTTP/1.0" 404 162 "-" "MLdonkey/2.5-28"
221.137.190.102 - - [05/Oct/2004:14:05:08 +0100] "GET /gcache/gcache.php?urlfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
193.251.190.203 - - [05/Oct/2004:14:05:11 +0100] "GET /gcache/gcache.php?client=LIME&version=2.9.7&hostfile=1 HTTP/1.0" 404 162 "-" "LimeWire/2.9.7"
206.77.0.156 - - [05/Oct/2004:14:06:11 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=0.9.1.5 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
206.77.0.156 - - [05/Oct/2004:14:06:11 +0100] "GET /gcache/gcache.php?ip=10.13.33.136%3A12255&url=http%3A%2F%2Fwww.paonet.org%2Frpao%2Fpub%2Fgwebcache%2Fgcache.php&client=MRPH&version=0.9.1.5 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
172.172.155.249 - - [05/Oct/2004:14:06:21 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.0.35&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.0"
65.54.98.112 - - [05/Oct/2004:14:06:24 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=1.1.0.7&get=1 HTTP/1.0" 404 162 "-" "Mozilla/4.0"
172.130.42.151 - - [05/Oct/2004:14:06:47 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.8.2&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.8"
168.8.208.3 - - [05/Oct/2004:14:07:22 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=1.1.0.7&get=1 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
172.146.216.180 - - [05/Oct/2004:14:07:30 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.7.8&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.7"
218.247.207.95 - - [05/Oct/2004:14:07:33 +0100] "GET /gcache/gcache.php?urlfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
222.216.236.138 - - [05/Oct/2004:14:07:43 +0100] "GET /gcache/gcache.php?urlfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
172.140.78.141 - - [05/Oct/2004:14:07:55 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
172.140.78.141 - - [05/Oct/2004:14:07:56 +0100] "GET /gcache/gcache.php?ip=169.254.205.111%3A8529&url=http%3A%2F%2Fwww.mcadatacenter.com%2Fgwebcache%2Fgcache.php&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
80.181.5.130 - - [05/Oct/2004:14:08:11 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.8.1&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.8 [IT]"
172.156.167.34 - - [05/Oct/2004:14:08:18 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.4.8&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.4"
69.156.36.105 - - [05/Oct/2004:14:08:31 +0100] "GET /gcache/gcache.php?client=LIME&version=3.8.10&urlfile=1 HTTP/1.1" 404 162 "-" "LimeWire/3.8.10"
82.122.108.100 - - [05/Oct/2004:14:08:44 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.6.0.56&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.6.0.56"
172.196.45.76 - - [05/Oct/2004:14:08:46 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.5.11&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.5"
172.177.236.116 - - [05/Oct/2004:14:08:51 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.4.11&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.4 [DE]"
211.144.174.173 - - [05/Oct/2004:14:08:55 +0100] "GET /gcache/gcache.php?urlfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
218.83.179.139 - - [05/Oct/2004:14:08:56 +0100] "GET /gcache/gcache.php?urlfile=1&client=GNUC&version=1.8.4.0 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
81.173.190.28 - - [05/Oct/2004:14:09:08 +0100] "GET /gcache/gcache.php?client=LIME&version=4.0.4&urlfile=1 HTTP/1.1" 404 162 "-" "LimeWire/4.0.4"
67.160.204.73 - - [05/Oct/2004:14:09:12 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.3.2&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.3"
172.161.183.193 - - [05/Oct/2004:14:09:13 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.6.7&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.6"
172.141.167.12 - - [05/Oct/2004:14:09:30 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.7.13&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.7"
200.193.64.150 - - [05/Oct/2004:14:10:04 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=1.1.0.7&get=1 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
66.216.148.64 - - [05/Oct/2004:14:10:17 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.8.2&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.8"
81.86.244.212 - - [05/Oct/2004:14:10:34 +0100] "GET /gcache/gcache.php?hostfile=1&client=MLDK&version=2.5-28b HTTP/1.0" 404 162 "-" "MLdonkey/2.5-28b"
192.240.72.54 - - [05/Oct/2004:14:10:35 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
192.240.72.54 - - [05/Oct/2004:14:10:35 +0100] "GET /gcache/gcache.php?ip=192.240.72.54%3A10159&url=http%3A%2F%2Fwww.e-gera.net%2Fgwebcache%2Fgcache.php&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
24.169.128.49 - - [05/Oct/2004:14:10:43 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.4.6&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.4"
172.195.48.98 - - [05/Oct/2004:14:10:43 +0100] "GET /gcache/gcache.php?client=LIME&version=2.9.8&urlfile=1 HTTP/1.1" 404 162 "-" "LimeWire/2.9.8"
144.216.124.126 - - [05/Oct/2004:14:10:57 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
144.216.124.126 - - [05/Oct/2004:14:10:57 +0100] "GET /gcache/gcache.php?ip=144.216.124.126%3A9410&url=http%3A%2F%2Fmembers.lycos.co.uk%2Fwheelzoff%2Fgwebcache%2Fgcache.php&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
66.203.191.25 - - [05/Oct/2004:14:11:08 +0100] "GET /gcache/gcache.php?client=LIME&version=2.9.10&urlfile=1 HTTP/1.1" 404 162 "-" "LimeWire/2.9.10"
81.66.122.75 - - [05/Oct/2004:14:11:12 +0100] "GET /gcache/gcache.php?hostfile=1&client=MLDK&version=2.5-28 HTTP/1.0" 404 162 "-" "MLdonkey/2.5-28"
194.125.181.88 - - [05/Oct/2004:14:11:22 +0100] "GET /gcache/gcache.php?client=BEAR&version=4.2.4.11&hostfile=1 HTTP/1.1" 404 162 "-" "BearShare 4.2.4"
213.40.67.66 - - [05/Oct/2004:14:11:34 +0100] "GET /gcache/gcache.php?hostfile=1&client=MRPH&version=0.9.2.6 HTTP/1.1" 404 162 "-" "Mozilla/4.0"
As you can see - they all get 404's back, which is the internet equivalent of a "nobody's home, stop knocking", it's not just one client but all of them, and somehow they fail to see that my website hasn't had a GCache in over 18 months. Does anyone have a solution to this? Can I do something that will crash the Gnutella client when it tries to connect or something to disincentivize people from doing this? Who wrote software that could be so incredibly antisocial, I thought these people were under the impression they were writing software for the common good?
Posted by nlvp at October 5, 2004 03:16 PM