Thanx for your help. But it is impossible with me, i have more than 4'000 concurrent clients infected with this virus. I cant firewall all of them and they are using dynamic ip address. Do you have another way?
-----Original Message----- From: Henrik Nordstrom [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 06:45 PM To: pmquan Cc: [EMAIL PROTECTED] Subject: Re: [squid-users] SQUID and Welchia Worm (DoS) On Wed, 14 Apr 2004, pmquan wrote: > Many users in my network infected with Welchia.Worm and this virus > send mass-request out to port 80. SQUID handle that and hang on (I can > connect to SQUID but my SQUID didnt respone till i restarted itself). > And it going down again after 5mins ;( Your clients are performing a Denial of Service (DoS) attack on your Squid. Identify the offending IP addresses from access.log and then firewall these stations from using the proxy until they have been cleaned. Most OS:es have good firewalling capabilities which can be used for this purpose. Linux and *BSD for certainly does. Regards Henrik
