thousands of entries in Apache access logs for a single IP

[nskyrca]

Hello,
I posted this question on the Mozilla Support site but because it was beyond the scope of that forum. But they suggested that I post the question here. I appreciate your help.

We are seeing thousands of connections in our Apache access logs coming from the same IP address connecting to the same pages with in a short period of time (~5-20 minutes). We see this in Firefox 27, 28, 29, and 30. Below is an example of the entries, and how they loop continuously. I have not been able to reproduce the problem manually, but this happens several times a week, and I see evidence in our logs, and by monitoring the session count in our database, which increase when this happens.

Why is this happening? Is this a bug? I see a bug report filed at https://bugzilla.mozilla.org/show_bug.cgi?id=976878, but I do not see any replies.

xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-" xxx.xxx.xxx.xxx - -

[18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-" xxx.xxx.xxx.xxx - -

[18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-" xxx.xxx.xxx.xxx - -

[18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-" xxx.xxx.xxx.xxx - -

[18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-" xxx.xxx.xxx.xxx - -

[18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"

[LoudNoise]

Is the IP local to your network or is it coming off site?

[nskyrca]

The IP's are coming from local and offsite.

[LoudNoise]

I am confused. I thought you said this was coming from the same address?

[nskyrca]

Sorry for the confusion. We see thousands of connections from one IP in the logs one time, but the next time it happens, we will see thousands of connections from another IP in the logs. So each incident of seeing thousands of connections from an IP address is from a different IP address.

It's like one IP address is connecting very, very fast and connecting to a page(s) (as in the example I provided). This happens for 5-20 minutes then stops. Then, at some later date, another IP address might come along and do the same thing.

Does that help explain it any better? I'm having trouble explaining it.

[trolly]

If I remember right a new connection is established for every element unless HTTP persistent connections or the new SPDY algorithm is used. So this is normal for a complicated web page.
http://en.wikipedia.org/wiki/HTTP_persistent_connection

[AlfonsoML]

Each "block" is using the same IP and different User-Agent strings?

That's not a normal browser, it's some bot masquerading itself.