Go Away!

kvxz · 7th July 2001, 17:54

I periodically have this problem, but it usually goes away...but not today! I have these entries on the shoutcast server which I figured might be someone who's not got their browser configured properly and it's trying to read the stream from the browser itself. They'd usually come in little batches over a few hours and then presumably "give up", unable to figure out how to listen. But now I'm wondering if it isn't something else, because this time I've got one going for about 18 hours now! It hits my server randomly, but it's been at least 6 times an hour. I killed the server for a little while, and that didn't stop it; then I even killed the entire PC for 50 minutes, and still it was back four minutes after I restarted shoutcast. Here's the exact entry:

[http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))

I'm sick of my server log being filled up with this garbage, especially this latest pestilence! Any ideas on what I can do...can I block the IP address, or anything?

While I'm griping, please forgive me if this has been discussed elsewhere, but I'm new to the forums...what's the deal with the public server's having to be touched every minute! This also is wasting my server log space...any chance of going back to the 5 minute increments? (which was still too often in my book...30 mintes or even an hour would work for me!

Tom · 7th July 2001, 18:39

[http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))

That is something hitting your http://IP:PORT page.
If you are sick of this garbage in your log files then edit the sc_serv.ini file and turn those features off. You are interested in TchLog and WebLog.
A touch of 30 to 60 mins would get a lot of feedback from users and broadcasters since the currently playing on SHOUTcast.com would only get updated every 30 - 60 mins. At that rate why even have it?

Tom

kvxz · 7th July 2001, 19:29

Well, is this in a newer version of shoutcast? I'm on v1.666.1, and I don't see any such things in the ini. I saw something about a BanFile...is this something I could use to reject this IP address (and future ones)? While I appreciate that I may be able to remove it from the log one way or another, it just frustrates me to have this so mindlessly and relentlessly happening! What is doing it, why, and why won't it stop?

Now if TchLog will remove my touches, that's fine...that's something I know the whys and wherefores for, and it wouldn't bother me to know that's going on without seeing it. It can touch me every second for all I care...but still, every minute seems extreme...that quintuples the activity! But as for WebLog, does that just have to do with web browsers making contact, or every type of contact? I do most certainly want to know who's actually listening through Winamp etc. and for how long...I just want the garbage gone...

kvxz · 7th July 2001, 23:53

Well, I figured out the Ban File, entered the offending IP address, and it has not done any good (perhaps because it's not trying to listen). Is this somebody trying to hack into my server, or maybe just some website somewhere that's taken it upon themselves to list my stream, and it's touching my server like shoutcast does? If the latter, it's certainly not regular...sometimes twice within 10 seconds, other times going 15 minutes without. How about some way to block the IP from coming into my system at all, like a TCP/IP setting in Windows or something?

gurb · 8th July 2001, 00:47

I'm no web browser wizard but the request sent ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) is only the browser asking for the index page. Honestly I can't see this as a good reason to ban someone on your server for this reason. It's a perfectly normal thing to do. It consumes very little bandwidth and CPU to send the response (certainly compared to the b/w consumption of a shoutcast server :). The best way to avoid these browser requests is to shut down your server and put up an "Armed Response" sign. May you and your listeners live in peace.

kvxz · 8th July 2001, 01:59

Well, the only problem with that is that my website itself is not served by me, so there's no index to look for! The only thing on my PC is the shoutcast server, which my offsite website has a link to. It did in fact cross my mind that this could be a struggling listener, but considering it's been going on at least six times an hour for the past 24 hours, one would hope this is not a human being really desperate to enjoy my station! My main gripe is not bandwidth or CPU, though, it's simply the inanity of it being done, and the clutter it adds to my web log. I want to see actual streaming listeners, without having to ferret out their IP address and time spent listening amidst

([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))
([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))
([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))
([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))
([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))
([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt))

every hour!

gurb · 8th July 2001, 06:42

Oh well. I don't know for what reason you have chosen to run the older version of DNAS. As far as I understand even the 1.666.1 version came w/ integrated web server (web-admin interface).

As Tom pointed out in newer versions you have the ability to turn off logging of http:// requests in your log. So if this is the problem why don't you take a look at the newer releases? There's a README included in the package which explains all the new nifty features and bug fixes. Maybe a newer / other release of the DNAS can give you what you want.

cheers

scottyc · 8th July 2001, 07:43

Quote:

Originally posted by kvxz
I periodically have this problem, but it usually goes away...but not today!

herpes outbreaks...

Tom · 8th July 2001, 18:28

Well I'll repeat it again. If you tired of the "garbage" in your log files then upgrade and turn it off (1.7.1 has it if you don't want 1.8.0). It is only someone looking at the dynamic page found at http://IP:PORT. I suggest you type that in your browser to see what it is. (Where IP is the server IP and PORT is the port).
Tom

kvxz · 8th July 2001, 19:37

Well, Major Dude, you can't "repeat it again", since you didn't suggest I upgrade in the first place! (Feel free to review your initial post). And why does having banned the IP address not work? Does that only work on an attempted contact by an audio streaming program?

And why in heaven's name would someone be attempting to look at my dynamic page 6 times an hour for the past 30 hours? Surely it's got to be something automated, I'd hope. But in the 16 months I've been using shoutcast, I've never been afflicted with anything like this...perhaps I should've never gone public, or switched over from relaying off live365 (both of which were done in the past 2 months)...

And as for everyone disparaging me for using an old version, I am a relative neophyte compared to y'all, so if my old shoutcast and old winamp continue to do the job, I'm not too keen on upgrading and screwing something up so much that I'm off the air for three days trying to figure it out! I just ran an ad in the newspaper for my station last week, so now is definitely not the time to go messing with things. I guess I'll just live with it for awhile until the rush of new listeners dies down...

Tom · 8th July 2001, 20:43

Well, Junior Member (whatever that has to do with it), you will see that I said "repeat it again", not "repeat myself again"! (Feel free to review gurb's second post).

Apparently if you banned their IP and they still connect to the page then the ban IP only takes effect to the actual stream. As for why they are connecting to that page, maybe they are trying to figure out why you banned them. Or perhaps it is automated, and they are adding you to some other yp. Either way I see no harm in viewing that page, unless you are concerned with someone seeing your:
Server Status, Stream Status, # of listeners, Listener Peak, Average Listen Time, Stream Title, Stream Genre, Stream URL, Stream ICQ, Stream AIM, Stream IRC, Current Song, OS and version of the DNAS.
However if you start getting hammered on http://IP:PORT/admin.cgi?pass= then there would be reason for concern. I don't know what there is left to tell you regarding this issue.

You're welcome and best of luck on future problems you encounter.

Tom

kvxz · 10th July 2001, 02:43

Well, I went ahead and took the plunge anyway, and was fortunately successful (after an hour or so of tweaking and trial & error). But of course a new irrelevant but annoying problem has come up...how do you get the winamp & shoutcast source (and the shoutcast monitor, for that matter) windows to open up in the same place and same position on your screen every time? Winamp & source were doing it fine before with the old version, though shoutcast didn't, so I always moved that manually.

kvxz · 10th July 2001, 03:11

AND another odd naught...the delay from my source to receipt on the listening end used to be about 15 seconds, but now it's more like 75 seconds! Whassup with that? And finally (I hope), it seems like my system is moving slower now too...my harddrive is just gruntin' and groanin' like crazy! Would that have anything to do with my installing the new versions on my D: drive partition? If so, I guess I can move it onto the C: and overwrite the old versions, since it's working okay...

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

7th July 2001, 17:54	#1
kvxz Junior Member Join Date: Dec 2000 Posts: 13	I periodically have this problem, but it usually goes away...but not today! I have these entries on the shoutcast server which I figured might be someone who's not got their browser configured properly and it's trying to read the stream from the browser itself. They'd usually come in little batches over a few hours and then presumably "give up", unable to figure out how to listen. But now I'm wondering if it isn't something else, because this time I've got one going for about 18 hours now! It hits my server randomly, but it's been at least 6 times an hour. I killed the server for a little while, and that didn't stop it; then I even killed the entire PC for 50 minutes, and still it was back four minutes after I restarted shoutcast. Here's the exact entry: [http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) I'm sick of my server log being filled up with this garbage, especially this latest pestilence! Any ideas on what I can do...can I block the IP address, or anything? While I'm griping, please forgive me if this has been discussed elsewhere, but I'm new to the forums...what's the deal with the public server's having to be touched every minute! This also is wasting my server log space...any chance of going back to the 5 minute increments? (which was still too often in my book...30 mintes or even an hour would work for me!

7th July 2001, 18:39	#2
Tom Moderator Join Date: Apr 2000 Posts: 4,485	[http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) That is something hitting your http://IP:PORT page. If you are sick of this garbage in your log files then edit the sc_serv.ini file and turn those features off. You are interested in TchLog and WebLog. A touch of 30 to 60 mins would get a lot of feedback from users and broadcasters since the currently playing on SHOUTcast.com would only get updated every 30 - 60 mins. At that rate why even have it? Tom

7th July 2001, 19:29	#3
kvxz Junior Member Join Date: Dec 2000 Posts: 13	Well, is this in a newer version of shoutcast? I'm on v1.666.1, and I don't see any such things in the ini. I saw something about a BanFile...is this something I could use to reject this IP address (and future ones)? While I appreciate that I may be able to remove it from the log one way or another, it just frustrates me to have this so mindlessly and relentlessly happening! What is doing it, why, and why won't it stop? Now if TchLog will remove my touches, that's fine...that's something I know the whys and wherefores for, and it wouldn't bother me to know that's going on without seeing it. It can touch me every second for all I care...but still, every minute seems extreme...that quintuples the activity! But as for WebLog, does that just have to do with web browsers making contact, or every type of contact? I do most certainly want to know who's actually listening through Winamp etc. and for how long...I just want the garbage gone...

7th July 2001, 23:53	#4
kvxz Junior Member Join Date: Dec 2000 Posts: 13	Well, I figured out the Ban File, entered the offending IP address, and it has not done any good (perhaps because it's not trying to listen). Is this somebody trying to hack into my server, or maybe just some website somewhere that's taken it upon themselves to list my stream, and it's touching my server like shoutcast does? If the latter, it's certainly not regular...sometimes twice within 10 seconds, other times going 15 minutes without. How about some way to block the IP from coming into my system at all, like a TCP/IP setting in Windows or something?

8th July 2001, 00:47	#5
gurb Junior Member Join Date: Jun 2001 Posts: 5	I'm no web browser wizard but the request sent ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) is only the browser asking for the index page. Honestly I can't see this as a good reason to ban someone on your server for this reason. It's a perfectly normal thing to do. It consumes very little bandwidth and CPU to send the response (certainly compared to the b/w consumption of a shoutcast server :). The best way to avoid these browser requests is to shut down your server and put up an "Armed Response" sign. May you and your listeners live in peace.

8th July 2001, 01:59	#6
kvxz Junior Member Join Date: Dec 2000 Posts: 13	Well, the only problem with that is that my website itself is not served by me, so there's no index to look for! The only thing on my PC is the shoutcast server, which my offsite website has a link to. It did in fact cross my mind that this could be a struggling listener, but considering it's been going on at least six times an hour for the past 24 hours, one would hope this is not a human being really desperate to enjoy my station! My main gripe is not bandwidth or CPU, though, it's simply the inanity of it being done, and the clutter it adds to my web log. I want to see actual streaming listeners, without having to ferret out their IP address and time spent listening amidst ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) ([http:211.55.37.203] REQ:"/" (Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)) every hour!

8th July 2001, 06:42	#7
gurb Junior Member Join Date: Jun 2001 Posts: 5	Oh well. I don't know for what reason you have chosen to run the older version of DNAS. As far as I understand even the 1.666.1 version came w/ integrated web server (web-admin interface). As Tom pointed out in newer versions you have the ability to turn off logging of http:// requests in your log. So if this is the problem why don't you take a look at the newer releases? There's a README included in the package which explains all the new nifty features and bug fixes. Maybe a newer / other release of the DNAS can give you what you want. cheers

8th July 2001, 18:28	#9
Tom Moderator Join Date: Apr 2000 Posts: 4,485	Well I'll repeat it again. If you tired of the "garbage" in your log files then upgrade and turn it off (1.7.1 has it if you don't want 1.8.0). It is only someone looking at the dynamic page found at http://IP:PORT. I suggest you type that in your browser to see what it is. (Where IP is the server IP and PORT is the port). Tom

8th July 2001, 19:37	#10
kvxz Junior Member Join Date: Dec 2000 Posts: 13	Well, Major Dude, you can't "repeat it again", since you didn't suggest I upgrade in the first place! (Feel free to review your initial post). And why does having banned the IP address not work? Does that only work on an attempted contact by an audio streaming program? And why in heaven's name would someone be attempting to look at my dynamic page 6 times an hour for the past 30 hours? Surely it's got to be something automated, I'd hope. But in the 16 months I've been using shoutcast, I've never been afflicted with anything like this...perhaps I should've never gone public, or switched over from relaying off live365 (both of which were done in the past 2 months)... And as for everyone disparaging me for using an old version, I am a relative neophyte compared to y'all, so if my old shoutcast and old winamp continue to do the job, I'm not too keen on upgrading and screwing something up so much that I'm off the air for three days trying to figure it out! I just ran an ad in the newspaper for my station last week, so now is definitely not the time to go messing with things. I guess I'll just live with it for awhile until the rush of new listeners dies down...

8th July 2001, 20:43	#11
Tom Moderator Join Date: Apr 2000 Posts: 4,485	Well, Junior Member (whatever that has to do with it), you will see that I said "repeat it again", not "repeat myself again"! (Feel free to review gurb's second post). Apparently if you banned their IP and they still connect to the page then the ban IP only takes effect to the actual stream. As for why they are connecting to that page, maybe they are trying to figure out why you banned them. Or perhaps it is automated, and they are adding you to some other yp. Either way I see no harm in viewing that page, unless you are concerned with someone seeing your: Server Status, Stream Status, # of listeners, Listener Peak, Average Listen Time, Stream Title, Stream Genre, Stream URL, Stream ICQ, Stream AIM, Stream IRC, Current Song, OS and version of the DNAS. However if you start getting hammered on http://IP:PORT/admin.cgi?pass= then there would be reason for concern. I don't know what there is left to tell you regarding this issue. You're welcome and best of luck on future problems you encounter. Tom

10th July 2001, 02:43	#12
kvxz Junior Member Join Date: Dec 2000 Posts: 13	Well, I went ahead and took the plunge anyway, and was fortunately successful (after an hour or so of tweaking and trial & error). But of course a new irrelevant but annoying problem has come up...how do you get the winamp & shoutcast source (and the shoutcast monitor, for that matter) windows to open up in the same place and same position on your screen every time? Winamp & source were doing it fine before with the old version, though shoutcast didn't, so I always moved that manually.

10th July 2001, 03:11	#13
kvxz Junior Member Join Date: Dec 2000 Posts: 13	AND another odd naught...the delay from my source to receipt on the listening end used to be about 15 seconds, but now it's more like 75 seconds! Whassup with that? And finally (I hope), it seems like my system is moving slower now too...my harddrive is just gruntin' and groanin' like crazy! Would that have anything to do with my installing the new versions on my D: drive partition? If so, I guess I can move it onto the C: and overwrite the old versions, since it's working okay...