[thelist] responsiveness from "the coffee shop"

[Bob Meetin]

So yes I'm still working through the possibilities. Along the way, in 
working with the HG support staff, they gave me some commands to help 
identify culprits when the server load does get whacked out of 
proportion. The load average spikes I occasionally see do not correspond 
to the coffee shop issues, but they are something that bothers me and 
I'd liek to fix anyhow. About 20 minutes ago it spiked up to about 60 
then dropped to under 1 in about 10 minutes. Here's what I caught via 
monitoring:

NETSTAT SUMMARY - ignore connections from 174.121.22.85
tcp        0      0 174.121.22.85:80            178.128.228.250:58753       TIME_WAIT   -                   
tcp        0      0 174.121.22.85:80            178.128.228.250:58754       TIME_WAIT   -                   
tcp        0      0 174.121.22.85:80            178.128.228.250:58756       TIME_WAIT   -          

There were about 40 connections from 178.128.228.250 and another 20 or 
so from 68.74.86.48, Greece and the U.S. I could block these for the 
future, but how do I know if they are valid.

Along the same lines, I've considered setting up the monitoring script 
to automatically add them to a block list (if past some threshhold) or 
zapping any processes, but again how do we know whether they are legit 
or not?

-- Bob