IP: Re: Eyeballs or Spiders?

[Dave Farber <farber () cis upenn edu>]

Date: 01 Nov 1996 18:08:21 EST
From: <capek () watson ibm com> (Peter G. Capek)
cc: <farber () central cis upenn edu>
Subject: IP: Eyeballs or Spiders?


Just saw your note about spiders via IP.  Let me suggest another
possible choice which may be appropriate in some situations: Slow them
down.


This is a technique we've used, effectively we believe, to thwart
password and username guessers.  Have the server keep a crude history,
by IP address (or perhaps remote domain name) of the number of
requests over some period, and use that to adjust the responsiveness
of the server to that client.  With appropriate choice of decay times
and coefficients, one can slow an abuser down almost arbitrarily while
not impeding the customers one desires.


In addition to avoiding the abuse of information that the server is
providing, this may be an effective way of providing more equitable
sharing of a heavily loaded server.  I believe the technique has
application as a "governor" in other areas of networking and
computers.


            Peter Capek