On Fri, May 16, 2008 at 10:50 PM, Surjendu <[EMAIL PROTECTED]> wrote: > Its an open ended general questions and i want to discuss before > we start implementing anything. > > As far as my knowledge goes by using firewalls we can only > detect network level attacks such as TCP SYN attacks or > malformed packet floods. I also know that there is no way > that the hardware can analyze the packet and find out whether > a particular IP is trying to load the site too many times. > > So should we provide some kind of application level hacks to > stop DOS attacks? If yes how?
One problem some sites run by some friends encounter is not malicious DOS, but just dumb robots, those that don't read robots.txt and go through a computationally intensive site page by page. They track number of GETs/second from specific IPAddrs, and if it exceeds some threshold, get a static 'come back later' page. I think they may have moved to a specific 'slow bot' server that handles queries from these bots now -the load balancer redirects them there. its ok to walk the site, but not to interfere with anyone else.
