high bandwidth users?

[jdw]

Our forum has just been online for a few weeks and I noticed that 2 out of the 2000+ users are causing almost 13% of the bandwidth. There are even 2 users that have posted more and have been online longer and still only use about a 10th of what the other 2 are using.

What could cause this? All images in peoples signatures and avatars are hosted elsewhere. I even compared which topics they visit but I can't find any real difference.

The forum is running on SMF 1.07 and Apache 2.0 with HTTP compression.

Thanks!

[H]

Are these registered users? If they are guests they could be guests using a Webcopier to download the entire site. Check the user agent

Are they using a different theme to everyone else?

Are there any errors in your errorlog?

[jdw]

Are these registered users? If they are guests they could be guests using a Webcopier to download the entire site. Check the user agent

They are registered users. I checked there IP if they might be hanging around as a guest as well but that doesn't seem to be the case. I don't see any downloaders either.

Are they using a different theme to everyone else?

Nope. There's only one theme available.

Are there any errors in your errorlog?

Nothing I can find that is related to this and none on both their IP.

[Grudge]

Are you sure it's not Google and MSN?

[jdw]

Are you sure it's not Google and MSN?

No I found both IP addresses in the userlist. They are the numbers 3 and 4 in the list of most posts and longest online. That's what I think is strange, the numbers 1 and 2 use so much less bandwidth.

I was thinking maybe they could be F5 junkies I've seen some discussions were replies follow within 10 seconds of each other. Is there any creative way I could monitor that?

[jdw]

This is from the statistics. What could be causing the huge difference?

Hits	Files	KBytes	Visits	Hostname
34677	5827	33553	36	xxxxxxxxxx
28239	4374	144982	27	yyyyyyyyy

I looked through the access log, the error log and the user statistics and I can't find any difference 

[Dannii]

Prehaps they added Live bookmarks or something.

[Ben_S]

Post the hostnames, it's probably a cache of some type but noone can help without that info.

[Dannii]

Looking again.. Live bookmarks wouldn't do that.

Prehaps one user's browser does gzip, and the other doesn't. No idea really

[jdw]

The hostnames are both the same xxx.tilbu1.nb.home.nl [nofollow] and yyy.ndwrt1.lb.home.nl [nofollow]. That's why I didn't mention them. They're not spiders. I checked that.

[Cesay]

Is it 2 IP addresses? or 2 actual user accounts? Some ISPs, like AOL, assign the same proxy addresses to many, many people so more than 1 user will share the same IP address.

[jdw]

It's two user accounts that each have their own IP which is unique for that account.

I know it's not a searchbot, hacker, spammer or anything like that because I know who they are. I talk to them on our board every day. As you can see in the stats they are very active users. What I don't understand is why 34,000 hits from one user uses 33MB while 28,000 hits from the other user loads 144MB.

I agree with Ben_S it must be a cache problem, but I have not clue what it could be.

[H]

Whats the largest image that loads on your site (e.g. a large header image)?

Even with a cache problem that is very high bandwidth unless you have some large pics.

[jdw]

Whats the largest image that loads on your site (e.g. a large header image)?

Even with a cache problem that is very high bandwidth unless you have some large pics.

Again, if that were the case every user should use that much. I optimized the site and brought the total page size down to 28KB. The largest image size is 1.6KB.

I was thinking that although is seems high, with 144MB spread over 28239 hits, that one user is only loading an extra 4KB per hit. I expect the images are cached but either index.php, style.css or script.js isn't. It happens with about 1 in 20 users.

I am trying to analyze the access log (all 1GB of it...) to see if I can find any similarity in the user agent. Maybe it's a bug in their browser or a certain security setting.

[jdw]

I discovered that some users aren't sending the Accept-Encoding field in the request-heading. So the output is not compressed. That's whats causing the excess bandwidth. Would something like this work?

// If zlib is being used, turn off output compression.
$headers = apache_request_headers();
$encoding = $headers['Accept-Encoding'];
if ((@ini_get('zlib.output_compression') == '1' || @ini_get('output_handler') == 'ob_gzhandler') && !$encoding == '')
   $modSettings['enableCompressedOutput'] = '0';
else
   ob_start('ob_gzhandler');
}

[Dannii]

You could try it, but there's probably a reason they're not sending that heading - their browser can't or won't handle gziped pages.

(I suggested that earlier )

[H]

* huwnet thinks they should get a free browser like Firefox or opera

[jdw]

You could try it, but there's probably a reason they're not sending that heading - their browser can't or won't handle gziped pages.

(I suggested that earlier )

Yeah, seems you had it right all along. But it's not that their browser can't (IE6, FF), but won't. I posted this in an Apache board since it's not about SMF anymore. Some suggest the cause is a firewall or proxy. If I ever get there I'll let you know. Maybe I can save some hosting $$ for someone 

* huwnet thinks they should get a free browser like Firefox or opera

ahh, the perfect world  While we're dreaming, can I put in a request for a "Block users from asking for bigger avatars"-setting? 

Thanks everyone for your help!

[H]

...I posted this in an Apache board since it's not about SMF anymore...

You may want to search through the php bugtracker as we are using php gzip rather than mod_gzip