raphnet.net on slashdot
Intro
Slashdot.org is a kind of news site for news concerning
technology, science, video games, a bit of politics... (Read slashdot everyday during a week to get an idea of
what it is). Of course, this site is *very* popular.On the november 30 2004, someone posted a news concerning my project to connect a Snes APU on a PC parallel port (slashdot's article) A lot of people tried to follow the link in the article at the same time. Of course, my servers did not crash(hey, I'm not running windows) and did pretty well.
The machines
There are 2 machines responsible for my website.The first one is a Pentium 2 running OpenBSD. It does routing, natting, filtering and takes care of the internet connection (Ethernet bridge with IStop.com, over ADSL. No PPPOE :)). At the time where the traffic on my website was at it's peak, here is the result of the uptime command on this machine:
8:45PM up 116 days, 14:57, 2 users, load averages: 0.18, 0.13, 0.09The connection tracking table was holding more that 1363 entries and my internet connection bandwith was completely used. This was not a very big job for this machine.
The second machine is the web server (and dns). It is a Ultra Sparc 1, running Solaris 9, and using Apache as web server. At the time where the traffic was at it's peak, here is the result of the uptime command:
la commande uptime:
8:48pm up 61 day(s), 3:44, 3 users, load average: 1.76, 2.28, 2.73Now we can see that the webserver was working harder than the usual :)
Internet Connection
My internet connection was not very usable during the slashdot effect...
# ping 205.151.222.250 ... 64 bytes from 205.151.222.250: icmp_seq=24 ttl=249 time=5773 ms 64 bytes from 205.151.222.250: icmp_seq=25 ttl=249 time=5905 ms 64 bytes from 205.151.222.250: icmp_seq=26 ttl=249 time=5733 ms 64 bytes from 205.151.222.250: icmp_seq=27 ttl=249 time=5449 msA was receiving a lot of packets/S, as we can see here (tcpdump -n -i _interface_servers_subnet_) :
17:04:43.057451 64.36.32.xxx.1661 > 192.168.0.2.80: . ack 2521 win 65535 (DF) 17:04:43.059113 192.168.0.2.80 > 64.36.32.xxx.1661: . 2521:3781(1260) ack 0 win 50400 (DF) 17:04:43.060019 192.168.0.2.80 > 64.36.32.xxx.1661: P 3781:4372(591) ack 0 win 50400 (DF) 17:04:43.072751 68.251.113.xxx.1303 > 192.168.0.2.80: . ack 21601 win 25920 (DF) 17:04:43.074450 192.168.0.2.80 > 68.251.113.xxx.1303: P 44641:46081(1440) ack 0 win 50160 (DF) 17:04:43.083652 12.10.219.xxx.58873 > 192.168.0.2.80: . ack 4380 win 46720 (DF) 17:04:43.085365 192.168.0.2.80 > 12.10.219.xxx.58873: P 8760:10220(1460) ack 1 win 48604 (DF) 17:04:43.100820 12.10.219.xxx.58873 > 192.168.0.2.80: . ack 5840 win 45260 (DF) 17:04:43.102537 192.168.0.2.80 > 12.10.219.xxx.58873: P 10220:11680(1460) ack 1 win 48604 (DF) 17:04:43.107235 68.228.238.xxx.4578 > 192.168.0.2.80: F 3354638977:3354638977(0) ack 1557458525 win 64267 (DF) 17:04:43.107771 192.168.0.2.80 > 68.228.238.xxx.4578: . ack 1 win 49235 (DF) 17:04:43.139007 69.47.178.xxx.1714 > 192.168.0.2.80: . ack 2921 win 65535 (DF) 17:04:43.140869 192.168.0.2.80 > 69.47.178.xxx.1714: . 3960:5420(1460) ack 0 win 49640 (DF) 17:04:43.142040 192.168.0.2.80 > 69.47.178.xxx.1714: F 5420:6802(1382) ack 0 win 49640 (DF) 17:04:43.149665 67.169.70.xxx.42032 > 192.168.0.2.80: . ack 4345 win 65535 <nop,nop,timestamp 4005770868 528296770> (DF) 17:04:43.153557 69.47.178.xxx.1714 > 192.168.0.2.80: . ack 3960 win 64496 (DF) 17:04:43.159481 69.47.178.xxx.1716 > 192.168.0.2.80: . ack 1 win 65535 (DF) 17:04:43.168650 69.47.178.xxx.1716 > 192.168.0.2.80: P 1:441(440) ack 1 win 65535 (DF) 17:04:43.169786 192.168.0.2.80 > 69.47.178.xxx.1716: . ack 441 win 49200 (DF) 17:04:43.172995 192.168.0.2.80 > 69.47.178.xxx.1716: P 1:274(273) ack 441 win 49200 (DF) 17:04:43.188736 211.30.133.xxx.2496 > 192.168.0.2.80: S 987126853:987126853(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) 17:04:43.189636 192.168.0.2.80 > 211.30.133.xxx.2496: S 3063641482:3063641482(0) ack 987126854 win 49640 <mss 1460,nop,nop,sackOK> (DF) 17:04:43.208018 64.36.32.xxx.1662 > 192.168.0.2.80: S 1369071175:1369071175(0) win 65535 <mss 1260,nop,nop,sackOK> (DF) 17:04:43.208553 192.168.0.2.80 > 64.36.32.xxx.1662: . ack 1 win 50400 (DF) 17:04:43.218164 68.228.238.xxx.4580 > 192.168.0.2.80: F 2240835960:2240835960(0) ack 1516094539 win 65041 (DF) 17:04:43.218711 192.168.0.2.80 > 68.228.238.xxx.4580: . ack 1 win 49640 (DF) 17:04:43.220144 203.94.167.xxx.35488 > 192.168.0.2.80: F 0:0(0) ack 2335 win 23168 <nop,nop,timestamp 1252433835 528296760> (DF) 17:04:43.220694 192.168.0.2.80 > 203.94.167.xxx.35488: . ack 1 win 48722 <nop,nop,timestamp 528297200 1252433835> (DF)
Hits
Usually, my website has an average of 70000 hits in one month. After being slashdotted, my website received more than 270000 hits in 2 days (111286 during November 30 and 162728 during December 1st):
This is a lot of hits in a very short time. On the next graph, it looks like I received almost no visits before december 30, even though the number of daily hits was between 2000 and 4000:
