Source IP rate limiting

2011-11-10 Thread Alex Davies
Hi, I am interested in rate limiting connections from users to stop small DOS 'attacks' from individual users. I see the excellent post at http://blog.serverfault.com/post/1016491873/ and have followed this in a test enviroment. I have the following questions: * What is the best way to monitor

Re: Source IP rate limiting

2011-11-10 Thread Baptiste
On Thu, Nov 10, 2011 at 12:48 PM, Alex Davies a...@davz.net wrote: Hi, I am interested in rate limiting connections from users to stop small DOS 'attacks' from individual users. I see the excellent post at http://blog.serverfault.com/post/1016491873/ and have followed this in a test

Re: Source IP rate limiting

2011-11-10 Thread Alex Davies
Hi, Thanks for your reply. What is the 'signature' that is unique in the logs for this kind of block? I have HTTP logs enabled; for the Session state at disconnection part of the log would I be looking for a first letter of P or R for clients blocked by these filters? (and it it possible to