To ban or not to ban IPs opening up many connections?

Every so often I will see an IP opening up many connections to the server, 100 or more, for a long time (ie: 1 hr or more) by running the command:

netstat -an|grep :80|awk '{print $5}'|sort |more

I'm always uncertain whether I should ban such IPs at the time. They're definitely from individuals, not Googlebot for example. What are some legitimate reasons why an IP would open up so many connetions to my site and for so long? If he's reloading pages like crazy, that shouldn't create so many connections, so it just sounds prudent to ban the IP?

 

 

 

 

Top