HTTP 206 partial content requests flooding Apache

HTTP 206 partial content requests flooding Apache

by Luca Bösch -
Number of replies: 5
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Testers

Hi you all

After posting to the General help forum https://moodle.org/mod/forum/discuss.php?d=416261 I think this one is more appropriate.
I have a lot of requests with 206 status flooding my server. I'm speaking requests similar to this one

X.XXX.XX.XXX - - [09/Jan/2021:15:29:26 +0100] "GET /pluginfile.php/1569996/course/overviewfiles/mscwi-moodle-picture.png HTTP/2.0" 206 69 "https://my.moodle.address/my/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"

twenty times per second. Parts of it are to the script /file.php/* as well, but the most are to /pluginfile.php/*.

That's accumulating more and more and causing problems as described in the initial forum post.

Has anyone an idea on what could be causing this?

How to circumvent?

Moodle 3.9.3, Apache running on Ubuntu 20.04 with php-fpm.

Best,
Luca

Average of ratings: -
In reply to Luca Bösch

Re: HTTP 206 partial content requests flooding Apache

by Ken Task -
Picture of Particularly helpful Moodlers

From your server via ssh do a reverse lookup on that IP:

dig -x X.XXX.XX.XXX

Then see if that IP is from a student/teacher/manager in the moodle via DB query:



select auth,lastname,firstname,email,lastip from mdl_user where lastip = 'X.XXX.XX.XXX';

Is the image associated with a calendar?

Is the IP address seen attempting to update a calendar ... multiple calendars?

Note: IP address could be a bot if not associated with a user.

You might also search apache error log for that IP address for connections via http or https.

How large is that image?

'SoS', Ken


Average of ratings: -
In reply to Ken Task

Re: HTTP 206 partial content requests flooding Apache

by Luca Bösch -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Testers

Thanks for your answer, Ken

No, the images are not associated with calendar.
The users are valid authenticated users.
File sizes include
64,22 KB (65.765 Bytes)
18,45 KB (18.888 Bytes)
4,63 KB (4.740 Bytes)

Best,
Luca

Average of ratings: -
In reply to Luca Bösch

Re: HTTP 206 partial content requests flooding Apache

by Howard Miller -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Is this related to "file chunking"? Even, MDL-65110
Average of ratings: -
In reply to Howard Miller

Re: HTTP 206 partial content requests flooding Apache

by Luca Bösch -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Testers
I don't think so since the files are that small in size.
Average of ratings: -
In reply to Luca Bösch

Re: HTTP 206 partial content requests flooding Apache

by Tomoya Saito -
Picture of Plugin developers
We have faced the similar trouble.

First, some of video files may contain unusual frames.

If users play such a video using recent version of Google Chrome or Microsoft Edge,  a large number of file transmission requests (range requests) are sent from web browser to web server.
Sending file transfer requests continues as long as the video is playing.
This trouble occurs not only with the Moodle, but also with other web sites.

Even if the video file contains unusual frames, it can be played normally on the video player of the PCs.
Therefore, it is difficult to detect the unusual frames before uploading the video.

Even if the Web server prohibits rage requests, transfer requests will overflow after the user's playback position reaches the unusual frame.

A similar bug occurred in the Google Chrome around 20165 or 2016.
Recent versions of the Chrome and the Edge use range requests as standard when downloading media files.
So, I guess that the similar bug has occurred.
Average of ratings: Useful (1)