[Xitami] Re: default.ida?XXXXXXXXXXXXXXXXXXX

[Joachim Benjamins]

On Tue, 07 Aug 2001 20:28:39 -0700, john.uhlig@coconutcomm.com wrote:

>If there's a solution, I as well as everyone else would love to hear it. I am
>getting hit every 5-10 minutes, multiple times. There are a lot of hits from
>the 63.196.xxx.xxx class. Wish my firewall could block whole IP blocks...

You can set it up in your IP stack (at least on OS/2) by using the following trick:

Banning certain IP addesses from your server can be usefull if some client is overloading you 
with IP requests (certain web-indexers appear to behave like this - and Code Red apparently) 

You can achieve this by adding the following statement to x:\MPTN\BIN\SETUP.CMD (on an OS/2 
system!)

route add -net 209.67.229.138 -netmask 255.255.255.255 127.0.0.1 -blackhole 

This causes a request from 209.67.229.138 to be ignored by the server. Since it will not get any
response, they may want to stop attacking... 
The bad thing is that i don't think you can use wildcards so you may want to add a whole bunch 
of addresses, or scan your log and automatically add the IP address of the default.ida? 
requester.

Of course it assumes the availability of a localhost (ifconfig lo 127.0.0.1) 
It's the result of some experimenting with BSD-like commands for routing, on Warp Server for
eBusiness.

Good luck,

Joachim Benjamins.