Ok, I have added a temporary rule to ipchains to block all access from
that IP.
I don't actually believe this was a DoS, as it was for the same URL, and
a URL that is reasonable to ask for.
We'll have to find out a better way to do this in the future.
Shachar
Tzafrir Cohen wrote:
>On Mon, 15 Jul 2002, Tzafrir Cohen wrote:
>
>
>
>>On Mon, 15 Jul 2002, Shachar Shemesh wrote:
>>
>>
>
>Either this is someone just hogging our server, but then he/she has closer
>RH mirrors. Or it is an attempted DoS.
>
>Anyway, it desereves kicking, IMHO
>
>
>
>>>What's the trafic profile?
>>>
>>>
>>193.194.32.1 - - [15/Jul/2002:09:05:25 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 78472
>>193.194.32.1 - - [15/Jul/2002:09:05:25 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 58031
>>193.194.32.1 - - [15/Jul/2002:09:05:26 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 68251
>>193.194.32.1 - - [15/Jul/2002:09:05:26 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 69711
>>193.194.32.1 - - [15/Jul/2002:09:05:26 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 58031
>>193.194.32.1 - - [15/Jul/2002:09:05:27 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 58031
>>193.194.32.1 - - [15/Jul/2002:09:05:28 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 58031
>>193.194.32.1 - - [15/Jul/2002:09:05:31 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 95993
>>193.194.32.1 - - [15/Jul/2002:09:05:32 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 69711
>>193.194.32.1 - - [15/Jul/2002:09:05:33 +0300] "GET
>>/pub/distributions/RedHat/red
>>hat-7.3-en/iso/i386/valhalla-i386-disc2.iso HTTP/1.0" 206 66791
>>
>>$ host 193.194.32.1
>>Host 1.32.194.193.in-addr.arpa not found: 3(NXDOMAIN)
>>$ whois 193.194.32.1
>>inetnum: 193.194.32.0 - 193.194.63.255
>>netname: AUI
>>descr: Al'Akhawayn University
>>descr: Ifrane, Morocco
>>[snip]
>>
>>
>>
>>
>
>
>
----------------------------------------------------------------------------
To unsubscribe, send a message to [EMAIL PROTECTED]
Archives available at http://www.mail-archive.com/[email protected]/
