tera-byte problem

[akersche]

Thanks for your answer-Chicken. It's always interesting to read post from you))

i did consider, that my site would be almost down during the attacks. but that would be ok for me...
(well attacks are never ok... )
and my site aint't got large files nor do i believe my site has to deal with more real useres (perhaps 2) at any time...
and i did see there is a option at the virtual account to set the bandwith to a limit... (didn't check yet, how it works...)

and you are totally wright with anti-virus. but my point is more in prevention and thinking for the future. and that just a couple of people got accounts on tera-byte... but still they are a large host... and if one large host starts with that, hopefully others what do that, too.
and virus epedemic is exponential. so if you manage to kill a few, the virus won't spread that much...

Greetings Arno

PS: hope you were not hit be the virus/attacks, Chicken.

 

[niekas]

its all about money

Here is responce from Steve to my above post (the same was emailed to him).

Your dead wrong and here is why,lets look at how much money i make shall we
your account is a plan 5 that allows you 30 gigs of traffic for 19.95 a
month, the same bandwidth you use costs me 2.05 a gig that means if you use
everything your allowed it costs me 61.50 to operate your site - the 20.00
you pay me it would cost me 41.55 each and every month for your site. the
reason we can offer it so low is averages for every site that uses it max
amount there is another that uses considerably less. however this cost
averaging that allows you to pay a lot less for your site only works if it
isnt abused hence the reason the traffic isnt listed as unlimited, and we
have an overage charge for those sites using more than their allotment,

well i was using way below my alloted bandwidth limit - couple GB less and i could be using your No 4 plan for $9.25/mo. That would make sense right? or you expect all your customers to signup for plan 6 (40gb/mo) and use couple GB per months? I chose the plan to suit my needs with a some space to grow. (40% extra bandwidth just in case) - that makes sense too?

so lets look at your total charges since you moved to plan 5
april you used 21.361gigs
may 21.038 gigs
june 23.383 gigs
july 21.132 gigs
aug 68.058 gigs
sept 41.541 gigs

you can see clearly spike in bandwidth although my visitor number or pageviews haven't changed.
Webmasters weren't notified about this at all.

so in total for this time period you have used 196.513 gigs of bandwidth for
a total cost to me of 402.85 for just the bandwidth im not even talking about
the 24/7 support or the servers and routers i have to pay for to put you
online. in that same time frame including your overage charge you have paid
me 405.28 now this charge you have paid me so far also keeps your site
running from now until Feb 2002 so i guess the extra 3 bucks i have collected
from you to date should pay for my new mercedes? my point is your not being
gouged nor am i ripping you off, your paying for what you used, thats it
nothing more.

Here it is you just said that you needed to collect money out of such sorry cooperation with me that you've been loosing money. You have to admit that those plans that are set up they do not make sense bussiness wise. So its great idea to resell bandwidth for 5$/GB that you bought for 2$/GB to return money on this loosing venture. Please do not blame me for those mistakes. I'm not sure if its the same tera-byte that i've signed up with 16 months ago.

Sorry if i'm not being harsh, but i feel its a very serious problem that haven't been addressed by hosting company and is clearly used to take advantage of their customers.

 

[akersche]

steve emailed me a nice answer, too.
pitty they cannot set a limit on my site, cause it's only on raq 4

niekas:
i guess steve wanted to point you in a diffrent direction.
but is your point that you still don't believe in your statst?
(wish such history of stats would be availiable for every site)
did you read your logs? have you been tried to be hacked??

reading your post and thinking a bit more, i would say following:
hosts should be honest and don't offer "unlimited" or more bandwith, than they actually can
and it's on first sight not transparent, how they make really money. well thought they make money, cause many people are way below the allowed bandwith and others are above...
(pitty that they don't limit bandwith)

and steve, awesome that you got a new mercedes. i guess i have to apply at tera-byte. seeking for a job in america anyway...

 

[niekas]

niekas:
i guess steve wanted to point you in a diffrent direction.
but is your point that you still don't believe in your statst?
(wish such history of stats would be availiable for every site)
did you read your logs? have you been tried to be hacked??

I've never said i don't believe in those logs. I've never said i've been hacked - what i was saying that its global problem and its affecting all sites. I tried to download my logs and my puter crashed once it leaped over 1GB. Its another 5 $. So i left that for next month. And if its global problem and hosting company does nothing to protect their users and looking into quick buck its really bad. I wonder if they implemented any kind of protection for their own server or they let bandwidth go down the drain too.

reading your post and thinking a bit more, i would say following:
hosts should be honest and don't offer "unlimited" or more bandwith, than they actually can
and it's on first sight not transparent, how they make really money. well thought they make money, cause many people are way below the allowed bandwith and others are above...
(pitty that they don't limit bandwith)

Thats what i was saying i wasn't using their bandwith to the limit - i've actually was flooring on that plan and almost qualifying for cheaper plan with less bandwidth.

 

[akersche]

you are right. making quick money won't work forever...
but i believe there is a strong competition going on... so prices are low
but there are so many hosts that rip costumers... it's not good for the whole business... (didn't mean/blame any specific host with this statement!)

BUT there are hosts, where bandwith is really limited and you don't need to pay for more... that's how companies here in my country work. you just limited the speed for each server...
got a couple of friends that got servers at these data center...
(some build their own servers and installed them in the data center)
And yes, that's what I believe in: Security is a global problem.
Virus wouldn't spread a lot if everyone would be carefull.
But security at webhosts is really tricky! you want to allow everyone to see your site...
And here the statement of Steve@tera-byte:
"as far as security goes our systems are quite secure things like worms and such are not part of security nor can they be dealt with on a scale such as what we do the customer has to mitigate his damages himself."

So they DO SOMETHING ABOUT SECURITY
I don't know insider details @tera-byte, but I guess more could be done... but that would cost.... (so we are back at [quick] money)

 

[Chicken]

Originally posted by akersche
...and i did see there is a option at the virtual account to set the bandwith to a limit... (didn't check yet, how it works...)

How it works:

Limits the bandwidth.

What this means:

The amount of data transfer is limited per second. Right now I'll just put up an analogy, as it is easier to understand. What you have now is a swimming pool that you are trying to drain (this is the server attempting to send out data to your visitors). You could open a 10 foot wide hole and let the water flow out, or you can poke a pinhole sized hole in the side of the pool and let the water leak out in a small squirt. By limiting the bandwidth for a site, you are closing the size of the hole.

This might not be the best analogy, but you get the idea.

Niekas, as you said, "what i was saying that its global problem and its affecting all sites". It is a global problem one that affects everyone, but you seem to be saying that it shouldn't affect you. I guess you'd rather the NOC eat the problem and then raise the price of the packages to make up for it, after all *someone* is going to have to pay for it.

 

[Steve]

akersche the mercedes thing was a joke i dont own one my point was the 3 bucks made off the site wasnt about to buy me one, thats the problem with email emotion is lost so what i thought was a pretty funny line gets lost in the translation.

as far as the overcharges on bandwidth go i could explain why its needed but it would take a small novel to do so if you want to hear it ill explain it, i will say if it didnt exist we would have one of two problems
1.) sites using more would drive up the averages for webhosting forcing higher prices or becoming another "unlimited host" which will kill the business
2.) sites trying to use more would force a cap to be put on the sites and slowing down the sites to an unusable point and driving customers off, because its never the fault of the site that its slow its always the fault of the host
both of these options do not work for me or for the MAJORITY of the customers

Steve

 

[akersche]

chicken. thx to tell me, how limiting works in the option at the raq.
it works like i thought would be a way to do it [just wasn't sure if raq got a diffrent solution. e.g. stop transfer totally when limit is reached.]
found "mod_throttle" could do that:
http://forum.rackshack.net/showthread.php?threadid=323

about stoping worm: http://forum.rackshack.net/showthread.php?threadid=528


steve. well sorry for missunderstanding. when i first read it i interpreted as joke... or "visualization"
[but then i thought you might got one...]

personally your option 2) would be fine for my site [got just a personal homepage.]
i used to have and still got a free account. first i wanted to get a cheap host... but then i decided for a reliable one (email is what i care most about...) and did sign up at tera-byte (tried worldzonepro, but they where in progress of moving).
so i don't get any money out of my site... and i think it's not that cheap, what i am paying... so i don't wanna have surprises and additional bills... (wanna have control)

but i also need an account for a friend's company site.... and i charge him... and i can't rise the price in one month... that would be to tricky to explain and host's in our country don't work like that (are option 2. and most traffic is "inbound" and not that expensive for hosts here...)...
and it would sound like i did sh.. because his company site was attacked.

But Steve, it's the decission of tera-byte how to make business and marketing... and since it seems to be ok for the majority it's ok for me...
and i have to think of moving or wait hoping that sometime tera-byte is flexible to offer option 2. for customers that would like that option...


here is site i would recommend to read (for chicken and steve and other's using raq's) security (ipchains, pmfirewall,...):
http://list.cobalt.com/pipermail/cobalt-security/2001-June/002630.html


well i think we should end the discussion. i guess everybody understands the points of each other ))

 

[niekas]

I'm not sure i've been understood.
I perfectly understand TOS and Bandwidth overcharge are normal bussiness practice. I do not question that whatsoever.
What really bugs me that Hosting company (tera-byte) thinks its OK to have worm hitting its members IP's with requests generating 40GB of extra traffic and just charge for it.
No notification so members could take care of it and also notice that we(tera-byte) ain't doing a damn thing (you are on your own) and you gonne be charged for it if you fail to fix it.
For me it looked like perfect chance for you to make a quick buck and you just went for it.
I wasn't discussing the policies of bandwidth overcharge - i agreed to that. But tera-byte - company that claims to have round the clock network personal monitoring its IP network failed to detect this problem(intentionally or unintentionaly (doesn't look like)) and notify its customers about consequences.

Steve you have to admit that what happened was according to your protocol, TOS, legal agreement, but its really sucks to be your customer knowing that every single time you can expect to be taken advantage off.

 

[akersche]

i did understand...

 

[niv]

How is Steve going to block all WinNT servers? Look, everyone is being affected by this, not just you tera-byte users. If that bastard worm is still ping -fing servers around the world from basically anywhere, then that's too bad.

 

[niekas]

Originally posted by Hayama-kun
How is Steve going to block all WinNT servers? Look, everyone is being affected by this, not just you tera-byte users. If that bastard worm is still ping -fing servers around the world from basically anywhere, then that's too bad.

i didn't say anything about steve blocking all NT servers... You think i'm that clueless? or my complain has no ground whatsoever that customers should be notified about network status and its affect on users monthly payment? Because there were no indication of whats happening on stats of third party.
He has network administrators sitting there 24/7/365 and i'm sure they knew about this, but why they chose didn't notify their clients?

 

[akersche]

something else i found @ tera-byte:
for dedicated or colocation they offer 2 plans. one with a price for the actual usage and others limited and with definded bandwith.
(Burstable vs. Fixed)

STEVE: I would love to see that option on virtual hosting, too!!
And I bet there would be enough customers to fill at least one server if not half of your servers...

 

[Steve]

billig on a 10 buck plan for something like that would be a logistical nightmare it just isnt feasable

Steve

 

[Chicken]

Originally posted by niekas

i didn't say anything about steve blocking all NT servers... You think i'm that clueless? or my complain has no ground whatsoever that customers should be notified about network status and its affect on users monthly payment? Because there were no indication of whats happening on stats of third party.
He has network administrators sitting there 24/7/365 and i'm sure they knew about this, but why they chose didn't notify their clients?

See this is the problem though. I run an NT server at home (actually it is a Win2000 server, but close enough for illustration purposes). My home machine could be infected with the worm and hit your site. It isn't. So now we know my machine isn't among the infected.

The server you are on isn't able to distinguish between these worm infected hits and people like me who are just visiting your site.

I'm not sure how else to explain it to you, but this has been causing problems (you might not have know about these annoying things and that is understandable). The network is up to provide access to your site (you really wouldn't want it any other way, eh?). Removing this 'feature' would kill your site.

Is it clearer now?

 

[niekas]

hmm i never had any doubt about what you just explained to me. I understand the way worm works and the attack mechanism. Not going into ISO/OSI Network Model details, but basics of the why bandwidth problem arose.

I HAVE NO PROBLEMS WITH THAT.

Its like you explaining me something that i already agree on and never question it. Hmm. Maybe i wasn't clear?

I agree its not Steves fault that my site got flooded with bogus worm requests. He didn't have anything to do with the creation of the worm ...that its hitting my site. He is innocent of that.

I never blamed him for this virus. Or asked about the mechanism of the attack. I'm talking about his role in this as the head of the company during the moment where he probably had to make decision to stay true to customer support and keep helpfull and caring attidute or make some cash by using circumstances.

What i'm blaming him for failing to inform his customers of the problem that could affect their monthly bill as much as 10 times of what they paying already for the hosting since they not didn't implement anything to prevent this on their servers.

I got offers from 4 isp's to host my site. I talked to one of them on the phone - they specialize in NT hosting and he told me that they configured their routers to prevent attack before it even went into full swing.

Why not tera-byte? he sais it because it will increase the load on the router and routers whole purpose is to route traffic, not to inspect it. I'm kind of distanced from networking (although i hold a few microsoft NT certificates from long time ago..), but did he (steve) really look into this or its was a good way to make a quick buck selling something for 2.5 of the original price?

 

[Steve]

niekas
I'm not quite sure why you think I even look at what bandwidth people use at any time during the month at all. its quite simple the system monitors the bandwidth, at the end of the month the system spits out a list of those that went over their quota, we invoice those people accordingly. why should it be any different? are we not a web host who's main purpose is to get the pages you create to the internet? why should I guess at what caused the extra bandwidth a worm a ping flood an ad you placed somewhere or a feature of your site on slashdot? what do NT hosts have to do with any of this your not on an NT server?
if indeed your traffic was caused by something else other than actual hits I would by all means credit you back however all indications point to web hits and nothing more from your site if the bandwidth for your site was anything but web hits to your site wouldn't all accounts on similar ips be affected in the same way? or at least some of the accounts I host? of all the sites I host there were approx 15 sites that were in your bandwidth range and with the exception of you all of them were in the same range all previous months. so did you get hit by some massive attack aimed at your site? possibly however if that was the case your still being hit by the same attack this month as your bandwidth patterns are almost identical. is anyone else affected this month? there have been reports of approx 6.5 gigs of excess bandwidth not related to web hits this month by a number of customers, will I do anything about that? yes I will ill reduce all overages by that 6.5 gigs (that equates to a cost of aprox 500,000 dollars across all the sites I host) and eat that cost however that still doesn't explain your excess 20 gigs of usage so far this month if it was anything but web hits.


Steve

 

[niekas]

NT server has nothing to do its just that they specializing in that maybe thats why they look more seriously into this - we all know that those worm were designed for IIS.

i'm not sure if you know, but i've been on plan 5 so i'm over the limit by 12 GB now or you have some other statistics.
whats interesting to note about bandwidth.
i've disabled my site by htaccess(using redirectmatch \. )
to redirect all web queries to another location on different host(to preserve bandwidth) to deliver a message about why site is down.

having average 5 thousands of users coming to the site daily means that they will get redirected to the new location once, maybe twice, but most of the crowd will be redirected once.
My site still uses ~200MB/day. How can that be?
Each of that query should be in byte range not even KB. I think.

What you think is going on?

 

[akersche]

200MB/day -> you would be within your limit.

change dns-severs, too, than usage would shrink a bit.

AND your site still could be attacked (by virus or hackers), which could create bandwith...
and security is really a tricky issue, especially in that large scale host as tera-byte is...

Steve: wow, really great that you help customers out and pay for the average damage of 6.5GB
(anyway I am glad that I am still within limits 7GB of allowed 20GB)

 

[Steve]

i was refering to your average usage of 20 gigs a month before Aug not how much bandwidth your consuming compaired to your plan.

i find this quite funny actually i just performed some tests on your site
first i ran
tail -f /var/log/httpd/access | grep your domain > test.txt
for one minute at 3:30 am and the log file reached 12k in one minute
had a look at the file and figured out the average size of a request is 81 bytes

based on these numbers ive estimated roughly 17 megs a day or 510 megs a month in 81 byte requests if you multiply out those numbers times your index page alone at 7.184 k i think you will enjoy the number recieved

510,000,000/81= 6,296, 296 hits in a month on the index page
6,296, 296 x 7,184 the size of the index page =
45,232,592,592 bytes

or roughly 44 gigs in a 30 day period for the index page alone

while my tests do speculate a number of points the most obvious thing i see is your doing a ton of hits on your website

So why do you think there is an error?

oh and just so you know the logs on that server have not worked since july 17th 2001 i had fixed them this evening in order to run my tests so any figure you recieved from the server were at least two months old, and thats why we use the router and not the servers for billing.


Steve