Old 13th April 2009, 14:25   #1
DJ Matt
Senior Member
 
DJ Matt's Avatar
 
Join Date: May 2002
Location: Topeka, KS
Posts: 433
Tons of connections from AOL

This morning I noticed that my server is full of many dupe connections from a bunch of servers, all tracing back to AOL/shoutcast, all with a useragent of "ultravox metadata puller"

What the heck is this?

Matt...
Star104 Internet Radio
http://www.star104.net
Oldies104 Celebrating 14 years on the air! (Does anyone remember OldiesRadioNET.com?)
DJ Matt is offline   Reply With Quote
Old 13th April 2009, 15:22   #2
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
dont worry that is just the new mini player or widget.

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 13th April 2009, 16:50   #3
DJ Matt
Senior Member
 
DJ Matt's Avatar
 
Join Date: May 2002
Location: Topeka, KS
Posts: 433
Oh ok, wow I must be popular now

Is there a way to fix it so that the YP sees these as individual listeners instead of dupes?

Matt...
Star104 Internet Radio
http://www.star104.net
Oldies104 Celebrating 14 years on the air! (Does anyone remember OldiesRadioNET.com?)
DJ Matt is offline   Reply With Quote
Old 13th April 2009, 21:34   #4
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
The increased connections are caused by the fact that when someone clicks the "tune in" button on the shoutcast.com website a popup player now launches instead of the old .pls file.
This popup player uses the meta puller to gain info about streams.

The connection (time spent listening) by the meta puller is less than a second so it does not really count as a listener

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 3rd May 2009, 05:34   #5
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Quote:
The connection (time spent listening) by the meta puller is less than a second so it does not really count as a listener
I am seeing the same thing DJ Matt, but only during certain shows. Over 100 total "listeners" that all joined and left within a 2 hour period. Looking at the logs/stats there are anywhere from 10 - 20 connections from each of these AOL addresses:

207.200.98.1
207.200.98.2
207.200.98.3
207.200.98.4
207.200.98.5

These connections are not just only for a second like Jkey mentioned this is just a sample of a few of these connections and durations from the admin stats.

207.200.98.1 1h 31m 02s
207.200.98.3 1h 31m 01s
207.200.98.1 1h 30m 59s
207.200.98.5 1h 30m 52s
207.200.98.5 1h 30m 52s
207.200.98.1 1h 30m 51s
207.200.98.2 1h 30m 49s
207.200.98.1 1h 30m 48s
207.200.98.4 1h 30m 22s
207.200.98.1 1h 30m 18s
207.200.98.1 1h 30m 15s
207.200.98.3 1h 30m 08s
207.200.98.2 1h 30m 07s
etc...
207.200.98.2 48m 55s
207.200.98.4 47m 19s
207.200.98.1 46m 52s
207.200.98.4 45m 17s
207.200.98.5 44m 49s
etc...
oracletech is offline   Reply With Quote
Old 3rd May 2009, 16:57   #6
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
for every listener the meta puller is used.
Thats why it stacks up like it does.

i have checked across 4 dnas's and the connections are limited to 0-1 seconds.
Quote:
small part of my log
<05/03/09@12:43:28> [dest: 205.188.234.100] starting stream (UID: 48543)[L: 2]{A: ultravox metadata puller}(P: 1)
<05/03/09@12:43:28> [dest: 205.188.234.100] connection closed (0 seconds) (UID: 48543)[L: 1]{Bytes: 40960}(P: 1)
<05/03/09@12:43:30> [dest: 205.188.234.99] starting stream (UID: 48544)[L: 2]{A: ultravox metadata puller}(P: 1)
<05/03/09@12:43:30> [dest: 205.188.234.99] connection closed (1 seconds) (UID: 48544)[L: 1]{Bytes: 40960}(P: 1)
<05/03/09@12:43:35> [dest: 205.188.234.97] starting stream (UID: 48545)[L: 2]{A: ultravox metadata puller}(P: 1)
<05/03/09@12:43:35> [dest: 205.188.234.97] connection closed (0 seconds) (UID: 48545)[L: 1]{Bytes: 40960}(P: 1)

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 3rd May 2009, 18:13   #7
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Most of the time this is the case they connect and disconnect within a second like you said.

<05/02/09@21:46:36> [dest: 207.200.98.1] starting stream (UID: 243968)[L: 141]{A: ultravox metadata puller}(P: 11)
<05/02/09@21:46:36> [dest: 207.200.98.1] connection closed (0 seconds) (UID: 243968)[L: 140]{Bytes: 24576}(P: 11)
<05/02/09@21:46:36> [dest: 207.200.98.2] starting stream (UID: 243969)[L: 141]{A: ultravox metadata puller}(P: 11)
<05/02/09@21:46:36> [dest: 207.200.98.2] connection closed (0 seconds) (UID: 243969)[L: 140]{Bytes: 24576}(P: 11)
<05/02/09@21:46:37> [dest: 207.200.98.4] starting stream (UID: 243970)[L: 141]{A: ultravox metadata puller}(P: 11)
<05/02/09@21:46:37> [dest: 207.200.98.4] connection closed (1 seconds) (UID: 243970)[L: 140]{Bytes: 24576}(P: 11)
<05/02/09@21:46:39> [dest: 207.200.98.5] starting stream (UID: 243971)[L: 141]{A: ultravox metadata puller}(P: 11)
<05/02/09@21:46:39> [dest: 207.200.98.5] connection closed (1 seconds) (UID: 243971)[L: 140]{Bytes: 24576}(P: 11)
<05/02/09@21:46:39> [dest: 207.200.98.4] starting stream (UID: 243972)[L: 141]{A: ultravox metadata puller}(P: 11)




But as of lately during certain shows, for some reason mine are connecting and not disconnecting until 90 to 30 minutes later.

Looking at the logs they are connecting and it seems that its and then disconnecting a few hours later.


When flood started:
<05/02/09@22:26:36> [dest: 207.200.98.2] starting stream (UID: 246950)[L: 102]{A: ultravox metadata puller}(P: 45)
<05/02/09@22:26:36> [dest: 205.188.234.97] starting stream (UID: 246951)[L: 103]{A: ultravox metadata puller}(P: 65)
<05/02/09@22:26:36> [dest: 207.200.98.1] starting stream (UID: 246952)[L: 104]{A: ultravox metadata puller}(P: 85)
<05/02/09@22:26:37> [dest: 207.200.98.3] starting stream (UID: 246953)[L: 105]{A: ultravox metadata puller}(P: 86)
<05/02/09@22:26:38> [dest: 207.200.98.1] starting stream (UID: 246954)[L: 106]{A: ultravox metadata puller}(P: 90)
<05/02/09@22:26:41> [dest: 205.188.234.101] starting stream (UID: 246955)[L: 107]{A: ultravox metadata puller}(P: 93)
<05/02/09@22:26:42> [dest: 207.200.98.2] starting stream (UID: 246956)[L: 108]{A: ultravox metadata puller}(P: 97)
<05/02/09@22:26:43> [dest: 207.200.98.5] starting stream (UID: 246957)[L: 109]{A: ultravox metadata puller}(P: 98)
<05/02/09@22:26:43> [dest: 207.200.98.4] starting stream (UID: 246958)[L: 110]{A: ultravox metadata puller}(P: 99)
<05/02/09@22:26:44> [dest: 205.188.234.101] starting stream (UID: 246959)[L: 111]{A: ultravox metadata puller}(P: 100)
<05/02/09@22:26:46> [dest: 207.200.98.5] starting stream (UID: 246960)[L: 112]{A: ultravox metadata puller}(P: 101)
<05/02/09@22:26:46> [dest: 207.200.98.5] starting stream (UID: 246961)[L: 113]{A: ultravox metadata puller}(P: 102)
<05/02/09@22:26:47> [dest: 207.200.98.1] starting stream (UID: 246962)[L: 114]{A: ultravox metadata puller}(P: 103)
<05/02/09@22:26:48> [dest: 207.200.98.2] starting stream (UID: 246963)[L: 115]{A: ultravox metadata puller}(P: 104)
<05/02/09@22:26:50> [dest: 207.200.98.1] starting stream (UID: 246964)[L: 116]{A: ultravox metadata puller}(P: 106)
<05/02/09@22:26:53> [dest: 207.200.98.3] starting stream (UID: 246965)[L: 117]{A: ultravox metadata puller}(P: 107)
<05/02/09@22:26:54> [dest: 205.188.234.99] starting stream (UID: 246966)[L: 118]{A: ultravox metadata puller}(P: 108)
<05/02/09@22:26:56> [dest: 205.188.234.101] starting stream (UID: 246967)[L: 119]{A: ultravox metadata puller}(P: 110)
<05/02/09@22:26:57> [dest: 205.188.234.100] starting stream (UID: 246968)[L: 120]{A: ultravox metadata puller}(P: 111)
<05/02/09@22:26:59> [dest: 205.188.234.101] starting stream (UID: 246969)[L: 121]{A: ultravox metadata puller}(P: 112)
<05/02/09@22:27:00> [dest: 207.200.98.1] starting stream (UID: 246970)[L: 122]{A: ultravox metadata puller}(P: 114)
<05/02/09@22:27:01> [dest: 207.200.98.2] starting stream (UID: 246971)[L: 123]{A: ultravox metadata puller}(P: 116)
<05/02/09@22:27:03> [dest: 205.188.234.100] starting stream (UID: 246972)[L: 124]{A: ultravox metadata puller}(P: 117)
<05/02/09@22:27:06> [dest: 207.200.98.5] starting stream (UID: 246973)[L: 125]{A: ultravox metadata puller}(P: 118)
<05/02/09@22:27:06> [dest: 205.188.234.100] starting stream (UID: 246974)[L: 126]{A: ultravox metadata puller}(P: 119)
<05/02/09@22:27:07> [dest: 207.200.98.1] starting stream (UID: 246975)[L: 127]{A: ultravox metadata puller}(P: 120)
<05/02/09@22:27:11> [dest: 205.188.234.99] starting stream (UID: 246976)[L: 128]{A: ultravox metadata puller}(P: 122)
<05/02/09@22:27:13> [dest: 207.200.98.3] starting stream (UID: 246977)[L: 129]{A: ultravox metadata puller}(P: 123)
<05/02/09@22:27:13> [dest: 205.188.234.98] starting stream (UID: 246978)[L: 130]{A: ultravox metadata puller}(P: 124)
<05/02/09@22:27:16> [dest: 207.200.98.4] starting stream (UID: 246979)[L: 131]{A: ultravox metadata puller}(P: 125)
<05/02/09@22:27:20> [dest: 207.200.98.1] starting stream (UID: 246980)[L: 132]{A: ultravox metadata puller}(P: 126)
<05/02/09@22:27:23> [dest: 207.200.98.1] starting stream (UID: 246981)[L: 133]{A: ultravox metadata puller}(P: 127)
<05/02/09@22:27:30> [dest: 207.200.98.3] starting stream (UID: 246982)[L: 134]{A: ultravox metadata puller}(P: 128)
<05/02/09@22:27:31> [dest: 207.200.98.2] starting stream (UID: 246983)[L: 135]{A: ultravox metadata puller}(P: 131)
etc..







They all connect and then right after 12am they all disconnected.

<05/03/09@00:01:01> [dest: 205.188.234.99] connection closed (5646 seconds) (UID: 246966)[L: 209]{Bytes: 45412728}(P: 108)
<05/03/09@00:01:01> [dest: 205.188.234.101] connection closed (5645 seconds) (UID: 246967)[L: 208]{Bytes: 45404787}(P: 110)
<05/03/09@00:01:01> [dest: 205.188.234.99] connection closed (5630 seconds) (UID: 246976)[L: 207]{Bytes: 45281698}(P: 122)
<05/03/09@00:01:01> [dest: 205.188.234.98] connection closed (5569 seconds) (UID: 246990)[L: 206]{Bytes: 44798746}(P: 9)
<05/03/09@00:01:01> [dest: 205.188.234.101] connection closed (3865 seconds) (UID: 247089)[L: 205]{Bytes: 31166799}(P: 13)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (2920 seconds) (UID: 247145)[L: 204]{Bytes: 23605290}(P: 23)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (2303 seconds) (UID: 247186)[L: 203]{Bytes: 18667311}(P: 29)
<05/03/09@00:01:01> [dest: 205.188.234.97] connection closed (4465 seconds) (UID: 247059)[L: 202]{Bytes: 35966851}(P: 40)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (2673 seconds) (UID: 247162)[L: 201]{Bytes: 21622910}(P: 41)
<05/03/09@00:01:01> [dest: 205.188.234.100] connection closed (2666 seconds) (UID: 247163)[L: 200]{Bytes: 21566903}(P: 52)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (2796 seconds) (UID: 247150)[L: 199]{Bytes: 22614936}(P: 62)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (54 seconds) (UID: 247328)[L: 198]{Bytes: 694857}(P: 79)
<05/03/09@00:01:01> [dest: 205.188.234.101] connection closed (837 seconds) (UID: 247285)[L: 197]{Bytes: 6942929}(P: 81)
<05/03/09@00:01:01> [dest: 205.188.234.100] connection closed (3262 seconds) (UID: 247124)[L: 196]{Bytes: 26342923}(P: 88)
<05/03/09@00:01:01> [dest: 207.200.98.3] connection closed (362 seconds) (UID: 247311)[L: 195]{Bytes: 3158936}(P: 94)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (5659 seconds) (UID: 246956)[L: 194]{Bytes: 45510949}(P: 97)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (5657 seconds) (UID: 246958)[L: 193]{Bytes: 45502799}(P: 99)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (5655 seconds) (UID: 246960)[L: 192]{Bytes: 45486916}(P: 101)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (5655 seconds) (UID: 246961)[L: 191]{Bytes: 45486916}(P: 102)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (5654 seconds) (UID: 246962)[L: 190]{Bytes: 45470825}(P: 103)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (5652 seconds) (UID: 246963)[L: 189]{Bytes: 45462884}(P: 104)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (5651 seconds) (UID: 246964)[L: 188]{Bytes: 45454942}(P: 106)
<05/03/09@00:01:01> [dest: 207.200.98.3] connection closed (5648 seconds) (UID: 246965)[L: 187]{Bytes: 45422759}(P: 107)
<05/03/09@00:01:01> [dest: 205.188.234.98] connection closed (5628 seconds) (UID: 246978)[L: 186]{Bytes: 452674****(P: 124)
<05/03/09@00:01:01> [dest: 207.200.98.3] connection closed (5611 seconds) (UID: 246982)[L: 185]{Bytes: 45134786}(P: 128)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (5610 seconds) (UID: 246983)[L: 184]{Bytes: 45126844}(P: 131)
<05/03/09@00:01:01> [dest: 205.188.234.100] connection closed (5608 seconds) (UID: 246984)[L: 183]{Bytes: 45110753}(P: 132)
<05/03/09@00:01:01> [dest: 205.188.234.101] connection closed (5568 seconds) (UID: 246991)[L: 182]{Bytes: 44790805}(P: 135)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (5564 seconds) (UID: 246992)[L: 181]{Bytes: 44758831}(P: 136)
<05/03/09@00:01:01> [dest: 205.188.234.97] connection closed (5479 seconds) (UID: 247001)[L: 180]{Bytes: 44078812}(P: 139)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (4758 seconds) (UID: 247043)[L: 179]{Bytes: 38318916}(P: 143)
<05/03/09@00:01:01> [dest: 207.200.98.3] connection closed (3385 seconds) (UID: 247116)[L: 178]{Bytes: 27326799}(P: 148)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (3262 seconds) (UID: 247125)[L: 177]{Bytes: 26334772}(P: 149)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (697 seconds) (UID: 247292)[L: 176]{Bytes: 5838890}(P: 155)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (3138 seconds) (UID: 247135)[L: 175]{Bytes: 25350897}(P: 157)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (2151 seconds) (UID: 247196)[L: 174]{Bytes: 17454812}(P: 158)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (2040 seconds) (UID: 247204)[L: 173]{Bytes: 16570828}(P: 164)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (2027 seconds) (UID: 247206)[L: 172]{Bytes: 16462995}(P: 173)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (1932 seconds) (UID: 247211)[L: 171]{Bytes: 15710877}(P: 176)
<05/03/09@00:01:01> [dest: 207.200.98.1] connection closed (451 seconds) (UID: 247308)[L: 170]{Bytes: 3864451}(P: 186)
<05/03/09@00:01:01> [dest: 207.200.98.2] connection closed (1686 seconds) (UID: 247231)[L: 169]{Bytes: 13734766}(P: 187)
<05/03/09@00:01:01> [dest: 207.200.98.5] connection closed (918 seconds) (UID: 247283)[L: 168]{Bytes: 7590766}(P: 193)
<05/03/09@00:01:01> [dest: 205.188.234.100] connection closed (1465 seconds) (UID: 247244)[L: 167]{Bytes: 11966799}(P: 194)
<05/03/09@00:01:01> [dest: 207.200.98.4] connection closed (1165 seconds) (UID: 247262)[L: 166]{Bytes: 9566877}(P: 201)
<05/03/09@00:01:01> [dest: 207.200.98.3] connection closed (574 seconds) (UID: 247298)[L: 165]{Bytes: 4854805}(P: 211)
etc..
oracletech is offline   Reply With Quote
Old 3rd May 2009, 18:27   #8
Greg_E
Major Dude
 
Join Date: Nov 2006
Location: USA
Posts: 1,687
My gut feeling... Someone found some kind of exploit and are making use of it. It just plain looks fishy and I would be very tempted to ban the subnets if it wasn't coming from an AOL IP.

Your mileage may vary!
Greg_E is offline   Reply With Quote
Old 3rd May 2009, 18:49   #9
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
I agree Greg. Would have banned the IP's if they did not belong to AOL and if I did the metadata for the flash player would break.

This has happened twice during the same show Friday and Saturday. Thus, making me think it is indeed a exploit of some level.

Jkey, If more information would help I would be glad to provide it.
oracletech is offline   Reply With Quote
Old 3rd May 2009, 20:12   #10
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
it is indeed strange behaviour,after the weekend i will get someone to clarify whats going on.

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 3rd May 2009, 23:44   #11
SC_faisal
SHOUTcast (Alumni)
 
Join Date: Sep 2008
Posts: 162
Matt -

Whats your station name?
SC_faisal is offline   Reply With Quote
Old 4th May 2009, 00:32   #12
fc*uk
Moderator
 
fc*uk's Avatar
 
Join Date: Dec 2005
Location: Atlantic Beach
Posts: 8,127
Faisal --- guessing from the users profile, search the yp for oldies104 and you should find it.
fc*uk is offline   Reply With Quote
Old 7th May 2009, 18:23   #13
SC_faisal
SHOUTcast (Alumni)
 
Join Date: Sep 2008
Posts: 162
Basically those connections from the flash popup player.

f.
SC_faisal is offline   Reply With Quote
Old 7th May 2009, 18:35   #14
dotme
Moderator
 
dotme's Avatar
 
Join Date: Feb 2005
Location: USA
Posts: 4,024
Hmmm... I wonder about that.

Each connection in that log is a YP address, not a client machine address. Wouldn't the pop-up player show a connection from the user's IP address, not an AOL-owned YP address?

Some of those connections held on for 60-90 minutes. That would quickly max out a small DNAS.

I've never seen the "ultravox metadata puller" agent hold a connection for more than a couple of seconds (That plays hell with 5-min tune-in stats, by the way... lol)

Maybe it was an anomaly.
dotme is offline   Reply With Quote
Old 7th May 2009, 19:15   #15
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
its back again during the same show...


Quote:
scweb-dtc0l-4.shoutcast.com 37m 15s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 37m 13s 0 Kick Ban Ban Reserve
scweb-dtc0l-5.shoutcast.com 37m 11s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 36m 59s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 36m 56s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 36m 48s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 36m 45s 0 Kick Ban Ban Reserve
scweb-dtc0l-1.shoutcast.com 36m 43s 0 Kick Ban Ban Reserve
scweb-dtc0l-5.shoutcast.com 36m 39s 0 Kick Ban Ban Reserve
scweb-dtc0l-5.shoutcast.com 36m 37s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 36m 22s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 36m 10s 0 Kick Ban Ban Reserve
scweb-dtc0l-5.shoutcast.com 36m 09s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 35m 46s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 35m 40s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 35m 22s 0 Kick Ban Ban Reserve
scweb-dtc0l-1.shoutcast.com 34m 56s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 34m 34s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 34m 27s 0 Kick Ban Ban Reserve
scweb-dtc0l-1.shoutcast.com 34m 10s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 26m 51s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 26m 15s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 16m 48s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 16m 16s 0 Kick Ban Ban Reserve
scweb-dtc0l-1.shoutcast.com 16m 14s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 13m 49s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 13m 49s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 13m 49s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 13m 49s 0 Kick Ban Ban Reserve
scweb-ntc0l-5.shoutcast.com 7m 21s 0 Kick Ban Ban Reserve
scweb-dtc0l-2.shoutcast.com 7m 17s 0 Kick Ban Ban Reserve
scweb-ntc0l-5.shoutcast.com 7m 06s 0 Kick Ban Ban Reserve
scweb-dtc0l-4.shoutcast.com 6m 46s 0 Kick Ban Ban Reserve
scweb-dtc0l-3.shoutcast.com 6m 16s 0 Kick Ban Ban Reserve
scweb-ntc0l-3.shoutcast.com 6m 09s 0 Kick Ban Ban Reserve



just a snipit from the logs:

<05/07/09@14:30:23> [dest: 207.200.98.4] starting stream (UID: 212188)[L: 65]{A: ultravox metadata puller}(P: 7) <05/07/09@14:30:29> [dest: 207.200.98.4] starting stream (UID: 212189)[L: 66]{A: ultravox metadata puller}(P: 20) <05/07/09@14:30:44> [dest: 207.200.98.1] starting stream (UID: 212190)[L: 67]{A: ultravox metadata puller}(P: 29) <05/07/09@14:30:48> [dest: 207.200.98.4] starting stream (UID: 212191)[L: 68]{A: ultravox metadata puller}(P: 30) <05/07/09@14:30:58> [dest: 207.200.98.5] starting stream (UID: 212192)[L: 69]{A: ultravox metadata puller}(P: 33) <05/07/09@14:31:05> [dest: 207.200.98.1] starting stream (UID: 212193)[L: 70]{A: ultravox metadata puller}(P: 46) <05/07/09@14:31:12> [dest: 207.200.98.2] starting stream (UID: 212194)[L: 71]{A: ultravox metadata puller}(P: 47) <05/07/09@14:31:28> [dest: 207.200.98.4] starting stream (UID: 212195)[L: 71]{A: ultravox metadata puller}(P: 50) <05/07/09@14:31:29> [dest: 207.200.98.3] starting stream (UID: 212196)[L: 72]{A: ultravox metadata puller}(P: 55) <05/07/09@14:31:41> [dest: 207.200.98.2] starting stream (UID: 212197)[L: 73]{A: ultravox metadata puller}(P: 58)


I finally just started kicking them, but thats not a option long term.

<05/07/09@14:39:37> [dest: 205.188.234.100] connection closed (2737 seconds) (UID: 212092)[L: 40]{Bytes: 22144105}(P: 22)
<05/07/09@14:39:38> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:38> [dest: 205.188.234.100] connection closed (2738 seconds) (UID: 212093)[L: 39]{Bytes: 22152046}(P: 25)
<05/07/09@14:39:39> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:39> [dest: 205.188.234.100] connection closed (2739 seconds) (UID: 212094)[L: 38]{Bytes: 22160196}(P: 28)
<05/07/09@14:39:40> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:40> [dest: 205.188.234.98] connection closed (2348 seconds) (UID: 212106)[L: 37]{Bytes: 19031981}(P: 14)
<05/07/09@14:39:41> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:41> [dest: 205.188.234.100] connection closed (2318 seconds) (UID: 212109)[L: 36]{Bytes: 18784131}(P: 41)
<05/07/09@14:39:41> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:41> [dest: 205.188.234.99] connection closed (2288 seconds) (UID: 212113)[L: 35]{Bytes: 18551954}(P: 54)
<05/07/09@14:39:42> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:42> [dest: 205.188.234.100] connection closed (1720 seconds) (UID: 212134)[L: 34]{Bytes: 14015843}(P: 36)
<05/07/09@14:39:43> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:43> [dest: 205.188.234.99] connection closed (1690 seconds) (UID: 212138)[L: 33]{Bytes: 13767326}(P: 62)
<05/07/09@14:39:43> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:44> [dest: 205.188.234.101] connection closed (1636 seconds) (UID: 212143)[L: 32]{Bytes: 13336032}(P: 68)
<05/07/09@14:39:44> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:44> [dest: 205.188.234.98] connection closed (1458 seconds) (UID: 212146)[L: 31]{Bytes: 11912045}(P: 0)
<05/07/09@14:39:45> [dest: xx.xx.123.100] kicked
<05/07/09@14:39:45> [dest: 205.188.234.100] connection closed (1123 seconds) (UID: 212157)[L: 30]{Bytes: 9245048}(P: 39)


Hopefully you guys can figure this out, if you need anymore information please let me know.

Last edited by oracletech; 7th May 2009 at 19:45.
oracletech is offline   Reply With Quote
Old 7th May 2009, 20:16   #16
Greg_E
Major Dude
 
Join Date: Nov 2006
Location: USA
Posts: 1,687
BTW, this does not happen with an aac+ stream, which explains why I never see it even when I click on our listen link.

Your mileage may vary!
Greg_E is offline   Reply With Quote
Old 7th May 2009, 20:30   #17
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Yup Greg, the flash player doesn't support acc+.
oracletech is offline   Reply With Quote
Old 8th May 2009, 13:08   #18
SC_faisal
SHOUTcast (Alumni)
 
Join Date: Sep 2008
Posts: 162
Ya I hope it was an anomaly. I did some more digging and asking around our development team and the 'ultravox metadata puller' is not the flash player but something else.

It could very well be the firehoses but I need to look around some more...

f.
SC_faisal is offline   Reply With Quote
Old 8th May 2009, 13:46   #19
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
Quote:
Originally posted by SC_faisal
Ya I hope it was an anomaly. I did some more digging and asking around our development team and the 'ultravox metadata puller' is not the flash player but something else.

It could very well be the firehoses but I need to look around some more...

f.
Tag informed me a long time ago that the puller was related
to the flash widget(and now probably the new player).

To pull metadata from a uvox server i was led to believe
that you had to actually tune into the stream itself with some kind of meta puller.
Maybe the puller is just implemented the way it is to accomidate for the future framework of a future dnas release(if one ever comes ).

That does not explain however why the puller would stay connected so long.Could be a fault in the system itself lets hope someone from sc finds what the puller is used for when the shoutcast player connects and then fixes it

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 10th May 2009, 02:48   #20
DJ Matt
Senior Member
 
DJ Matt's Avatar
 
Join Date: May 2002
Location: Topeka, KS
Posts: 433
Yes, it's happened a few times on the other stations in the network, probably a bug since they don't immediately disconnect.

Matt...
Star104 Internet Radio
http://www.star104.net
Oldies104 Celebrating 14 years on the air! (Does anyone remember OldiesRadioNET.com?)
DJ Matt is offline   Reply With Quote
Old 12th May 2009, 14:53   #21
chuckeh
SHOUTcast Freak
 
chuckeh's Avatar
 
Join Date: Jun 2004
Location: NRW, Germany
Posts: 323
Cant be the firehoses, cause its also connecting to none-firehose streams.
chuckeh is offline   Reply With Quote
Old 13th May 2009, 21:53   #22
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Its happened again 80+ connections start but don't disconnect from AOL IP (ultravox metadata puller).

I finally just banned the IP's, maybe I will remove it in a few hours. Can we get some official word on this from a shoutcast dev?

BTW we are running: SHOUTcast Server Version 1.9.8/Linux

1. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
2. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
3. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
4. 207.200.98.4 : scweb-ntc0l-4.shoutcast.com - subnet ban - unban
5. 207.200.98.2 : scweb-ntc0l-2.shoutcast.com - subnet ban - unban
6. 207.200.98.3 : scweb-ntc0l-3.shoutcast.com - subnet ban - unban
7. 207.200.98.1 : scweb-ntc0l-1.shoutcast.com - subnet ban - unban
8. 207.200.98.4 : scweb-ntc0l-4.shoutcast.com - subnet ban - unban
9. 205.188.234.97 : scweb-dtc0l-1.shoutcast.com - subnet ban - unban
10. 205.188.234.98 : scweb-dtc0l-2.shoutcast.com - subnet ban - unban
11. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
12. 205.188.234.99 : scweb-dtc0l-3.shoutcast.com - subnet ban - unban
13. 205.188.234.99 : scweb-dtc0l-3.shoutcast.com - subnet ban - unban
14. 205.188.234.99 : scweb-dtc0l-3.shoutcast.com - subnet ban - unban
15. 207.200.98.3 : scweb-ntc0l-3.shoutcast.com - subnet ban - unban
16. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
17. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
18. 207.200.98.2 : scweb-ntc0l-2.shoutcast.com - subnet ban - unban
19. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
20. 207.200.98.4 : scweb-ntc0l-4.shoutcast.com - subnet ban - unban
21. 207.200.98.3 : scweb-ntc0l-3.shoutcast.com - subnet ban - unban
22. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
23. 207.200.98.3 : scweb-ntc0l-3.shoutcast.com - subnet ban - unban
24. 205.188.234.97 : scweb-dtc0l-1.shoutcast.com - subnet ban - unban
25. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
26. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
27. 205.188.234.98 : scweb-dtc0l-2.shoutcast.com - subnet ban - unban
28. 207.200.98.5 : scweb-ntc0l-5.shoutcast.com - subnet ban - unban
29. 205.188.234.98 : scweb-dtc0l-2.shoutcast.com - subnet ban - unban
30. 205.188.234.100 : scweb-dtc0l-4.shoutcast.com - subnet ban - unban
31. 207.200.98.4 : scweb-ntc0l-4.shoutcast.com - subnet ban - unban
32. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
33. 205.188.234.100 : scweb-dtc0l-4.shoutcast.com - subnet ban - unban
34. 205.188.234.99 : scweb-dtc0l-3.shoutcast.com - subnet ban - unban
35. 205.188.234.101 : scweb-dtc0l-5.shoutcast.com - subnet ban - unban
36. 205.188.234.97 : scweb-dtc0l-1.shoutcast.com - subnet ban - unban
oracletech is offline   Reply With Quote
Old 14th May 2009, 03:05   #23
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
Someone if they can, will eventially give a public explaination but for now use that word you need when shoutcasting......Patience

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 3rd June 2009, 11:34   #24
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Just an update this connection flooding from AOL has been happening still... Just recently was a huge one. Take a look at this graph from last night.

oracletech is offline   Reply With Quote
Old 3rd June 2009, 12:40   #25
dotme
Moderator
 
dotme's Avatar
 
Join Date: Feb 2005
Location: USA
Posts: 4,024
Yikes. Talk about maxing out a guy's slots...

A good PHP anti-ripper script fine-tuned to identify and kill (kick) those connections if they are more than 2 minutes old might be a good solution until AOL can address it on their end.
dotme is offline   Reply With Quote
Old 3rd June 2009, 13:31   #26
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
I have found a possible solution to the abnormal multiple connections problem.This info has been forwarded to AOL.

Tip for long connections problem:-
If you find the metapuller is connected for a long time
do a title update see if it drops the connection after.
Ive found if the stream metadata is not found by the puller it gets stuck in a loop searching for it.
This could be a dnas fault or metapuller design flaw.
As once fresh metadata(song title) is injected from the source(sc_dsp) the puller disconnects.

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 15th July 2009, 15:12   #27
oracletech
Junior Member
 
Join Date: May 2009
Posts: 8
Update the metadata

Updating the metadata does work as long as you change the title text by at least one character. We forced the metadata updates each time a show started and that only changed the metadata every 2-4 hours.

Now we are updating the metadata with some additional rotating text that changes every 10 minutes. The connection floods from AOL have gone completely away since.

oracletech is offline   Reply With Quote
Old 15th July 2009, 15:50   #28
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
Glad that you have resolved the problem.
Hopefully down the line aol staff will address the flaw in the meta puller.

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Old 31st August 2009, 11:09   #29
zollymonsta
Member
 
Join Date: Sep 2006
Location: Wellington, New Zealand
Posts: 53
Ultravox Metadata Puller still not fixed :(

This problem still is present... I'm being flooded!!

<08/31/09@18:32:52> [dest: 118.92.124.103] starting stream (UID: 269)[L: 3]{A: MPEG OVERRIDE}(P: 1)
<08/31/09@18:32:53> [dest: 205.188.234.97] starting stream (UID: 270)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:32:54> [dest: 205.188.234.97] connection closed (1 seconds) (UID: 270)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:33:42> [dest: 205.188.234.97] starting stream (UID: 271)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:33:43> [dest: 205.188.234.97] connection closed (2 seconds) (UID: 271)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:34:10> [dest: 205.188.234.101] starting stream (UID: 272)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:34:11> [dest: 205.188.234.101] connection closed (1 seconds) (UID: 272)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:34:24> [dest: 173.29.108.189] starting stream (UID: 273)[L: 4]{A: xmms/1.2.7}(P: 2)
<08/31/09@18:34:25> [dest: 173.29.108.189] connection closed (2 seconds) (UID: 273)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:34:25> [dest: 205.188.234.97] starting stream (UID: 274)[L: 4]{A: ultravox metadata puller}(P: 3)
<08/31/09@18:34:27> [dest: 205.188.234.97] connection closed (2 seconds) (UID: 274)[L: 3]{Bytes: 16384}(P: 3)
<08/31/09@18:34:35> [dest: 205.188.234.101] starting stream (UID: 275)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:34:36> [dest: 205.188.234.101] connection closed (1 seconds) (UID: 275)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:34:40> [dest: 205.188.234.101] starting stream (UID: 276)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:34:41> [dest: 205.188.234.101] connection closed (1 seconds) (UID: 276)[L: 3]{Bytes: 16384}(P: 2)
<08/31/09@18:34:50> [dest: 118.92.124.103] connection closed (118 seconds) (UID: 269)[L: 2]{Bytes: 728609}(P: 1)
<08/31/09@18:34:50> [dest: 118.92.124.103] starting stream (UID: 277)[L: 3]{A: MPEG OVERRIDE}(P: 1)
<08/31/09@18:34:51> [dest: 118.92.124.103] connection closed (0 seconds) (UID: 277)[L: 2]{Bytes: 8192}(P: 1)
<08/31/09@18:34:51> [dest: 118.92.124.103] starting stream (UID: 278)[L: 3]{A: MPEG OVERRIDE}(P: 2)
<08/31/09@18:34:51> [dest: 118.92.124.103] connection closed (1 seconds) (UID: 278)[L: 2]{Bytes: 8192}(P: 2)
<08/31/09@18:34:51> [dest: 118.92.124.103] starting stream (UID: 279)[L: 3]{A: MPEG OVERRIDE}(P: 1)
<08/31/09@18:34:51> [dest: 118.92.124.103] connection closed (0 seconds) (UID: 279)[L: 2]{Bytes: 8192}(P: 1)
<08/31/09@18:35:02> [dest: 118.92.124.103] starting stream (UID: 280)[L: 3]{A: MPEG OVERRIDE}(P: 1)
<08/31/09@18:35:03> [dest: 205.188.234.100] starting stream (UID: 281)[L: 4]{A: ultravox metadata puller}(P: 2)
<08/31/09@18:35:08> [dest: 205.188.234.100] connection closed (4 seconds) (UID: 281)[L: 3]{Bytes: 90112}(P: 2)
<08/31/09@18:35:14> [dest: 118.92.124.103] connection closed (12 seconds) (UID: 280)[L: 2]{Bytes: 300300}(P: 1)
<08/31/09@18:38:15> [dest: 118.92.124.103] starting stream (UID: 282)[L: 3]{A: MPEG OVERRIDE}(P: 1)
<08/31/09@18:38:15> [dest: 118.92.124.103] starting stream (UID: 283)[L: 4]{A: MPEG OVERRIDE}(P: 2)
<08/31/09@18:38:15> [dest: 118.92.124.103] connection closed (0 seconds) (UID: 282)[L: 3]{Bytes: 8192}(P: 1)
<08/31/09@18:38:16> [dest: 205.188.234.100] starting stream (UID: 284)[L: 4]{A: ultravox metadata puller}(P: 1)
<08/31/09@18:38:17> [dest: 205.188.234.100] connection closed (2 seconds) (UID: 284)[L: 3]{Bytes: 16384}(P: 1)
<08/31/09@18:38:20> [dest: 205.188.234.97] starting stream (UID: 285)[L: 4]{A: ultravox metadata puller}(P: 1)

Started at 6:32pm NZST tonight... and still going strong now (and it's 11:06pm NZST)

It seems to have started with one listener (NZ Based IP) then continues on from that with different IP's tracing back to AOL.

I really wish AOL would sort out this problem.

Cheers,
Grant
zollymonsta is offline   Reply With Quote
Old 18th December 2009, 18:34   #30
DJfire
Junior Member
 
Join Date: Oct 2003
Posts: 27
I hate to beat a dead horse but....it's still going on.
It is taking most of my slots.
(I have 35 on right now)
Any word on the fix or a way to ban them without losing the YP listing?

35 at once I think is excessive.

Thanks
DJfire is offline   Reply With Quote
Old 18th December 2009, 20:58   #31
dotme
Moderator
 
dotme's Avatar
 
Join Date: Feb 2005
Location: USA
Posts: 4,024
Send a title update to your server.
dotme is offline   Reply With Quote
Old 22nd December 2009, 16:32   #32
Jkey
Forum King
 
Join Date: Jul 2004
Location: E*arth
Posts: 3,031
Beating a dead horse is just sick !!

If shoutcast makes you do that,try another less violent
form of media/content delivery.

I cant believe this is still not fixed

So Long, and Thanks for All the Fish.
Jkey is offline   Reply With Quote
Reply
Go Back   Winamp & Shoutcast Forums > Shoutcast > Shoutcast Technical Support

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump