I ran some aggregation on my site's session data, mostly out of curiosity.
I discovered that certain IP addresses had thousands of sessions, and as far as I can tell all of them were "open once, don't bother using again".
Of course, these are purged every so often by the garbage collector, but it seems like an awful lot.
Take Bingbot for example. Across a small number of IP addresses, there are no fewer than 100,000 opened sessions. That accounts for just about 15-20% of the total current number of sessions, all by itself.
I honestly expected that "rank" to go to some malicious user somewhere. Not Bingbot.
Is this normal, and what steps can I take to fix this if not? At the very least it would help if Bingbot actually used session cookies...