Odd www log entries: Accelerated browsing the culprit?

VirginSnow at vfemail.net VirginSnow at vfemail.net
Sun Nov 11 09:52:36 EST 2007


I've been noticing some odd entries in my www server logs.  What I'm
seeing is page requisites being requested before the page requiring
them.  I have an HTML file with links to a few CSS stylesheets and JPG
images.  But I'm receiving & serving requests for the stylesheets &
images before requests for the page itself!  How can the browser
possibly know what to download for a page if it hasn't even seen the
page yet?

In some cases, I'm seeing the same image (which appears on said web
page) being downloaded repeatedly within a short amount of time.  In
one case, 19 times in the space of four (4) seconds.  I think most web
browsers out there are smart enough that, when an image appears
multiple times in the same web page, they download the image only
once.

Could I be seeing some sort of web acceleration technology?  All of
the requests have valid referer URI (albeit not in the correct order).
Some (but not all) of the requesting IP addresses reverse-resolve to
what look like end-user addresses (xyz-123-45-67-89.pool.someisp.con)
but some of them return NXDOMAIN.  So, if I am facing web
accelerators, they seem likely to live on the end-user's PC, and not
on some intermediate, accelerating, proxy.

Yes, it is possible that someone visited the page, had their DHCP
lease expire, got a new IP, and hit "reload" on their browser.  But I
think this is too unlikely to show up so frequently in my logs.  Does
anyone have an explanation for this?

If visitors to my sites ARE using acellerated browsing, I want to be
able to detect this and redirect them to another page (i.e., a 403
error).  Is there any (server-independent, at least theoretical) way
to do this?

Much thanks!


More information about the gnhlug-discuss mailing list