Technical Mumbo Jumbo
In retrospect, that referrer spamming wasn't much of an "attack". The server load was pretty much zero the entire time, and one request per second is no big deal at all. I'm sure the server could handle much more than that. But the annoyance factor was high.
I've also been wondering about something I see in my logs. When someone using Internet Explorer on Windows accesses my site, the last element to download takes exactly 5 minutes to show up in the logs. Here's an example of what I mean (IP address removed to protect the innocent):
x.x.x.x - - [28/Jan/2003:15:51:51 -0500] "GET /blog/ HTTP/1.1" 200 11792 - "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
x.x.x.x - - [28/Jan/2003:15:51:51 -0500] "GET /blog/styles-site.css HTTP/1.1" 200 5713 - "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
x.x.x.x - - [28/Jan/2003:15:56:53 -0500] "GET /blog/archives/2003/01/27/weird.jpg HTTP/1.1" 200 32768 - "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
The last image shows up in the log five minutes later. (oddly enough, it failed to download the xml.gif...) At first I thought it was taking 5 minutes for those browsers to download the image, but that doesn't make sense. It shouldn't be that slow, and other browsers don't show this problem. Then I remembered an article about some things that Internet Explorer does to increase speed but which break the rules of HTTP. Specifically, it leaves connections open on the server in order to make it quicker to download subsequent pages. Hmm, now that I reread the article, it seems that this might not be an accurate description of what is happening.
Well, I don't know if what Internet Explorer is doing is valid, but there are only two possibilities here: either it takes 5 minutes to download the image completely (unlikely), or Internet Explorer is not closing the connection, causing Apache to timeout after five minutes and close the connection. I don't think that is kosher behavior. Also, I still can't figure out why the webcam image never shows up in Internet Explorer. I don't have access to IE 6.0 on Windows, so maybe I'll never know what's wrong. Thanks, Microsoft!