a new idea to prevent DoS attacks

18 May 2006 8:29 AM

Eng.Rana

Dear ALL,

i was wondering if there exists any plugins or filters for IIS that
will allow me to limit the number of requests from a specifi IP
address.
or to automatically decrease the number of requests achieved from a
single clients that we doubt that he is trying to carry a DoS attack
due to his excessive number of requests.

any ideas???????????

thanx in advance

18 May 2006 10:40 AM

Daniel Crichton

Eng.R***@gmail.com wrote on 18 May 2006 01:29:16 -0700:

> Dear ALL,
>
> i was wondering if there exists any plugins or filters for IIS that
> will allow me to limit the number of requests from a specifi IP
> address.
> or to automatically decrease the number of requests achieved from a
> single clients that we doubt that he is trying to carry a DoS attack
> due to his excessive number of requests.
>
> any ideas???????????
>
> thanx in advance

Surely this is better implemented in a dedicated firewall device between the
IIS server and the internet. Stopping a DoS at IIS doesn't prevent it tying
up TCP/IP resources at the OS level.

Dan

19 May 2006 2:07 PM

Egbert Nierop (MVP for IIS)

<Eng.R***@gmail.com> wrote in message

news:1147940956.813258.158820@i40g2000cwc.googlegroups.com...
> Dear ALL,
>
> i was wondering if there exists any plugins or filters for IIS that
> will allow me to limit the number of requests from a specifi IP
> address.
> or to automatically decrease the number of requests achieved from a
> single clients that we doubt that he is trying to carry a DoS attack
> due to his excessive number of requests.
>
> any ideas???????????
>
> thanx in advance

ISA Server does completely deal with this and at a deep level!
http://www.microsoft.com/isaserver/default.mspx

21 May 2006 7:39 AM

Ken Schaefer

Hi,

A DoS attack can take many forms. An excessive number of requests can simply
saturdate your available bandwidth. Even if IIS is rejecting the requests,
the sheer number of requests can flood your available internet connection,
denying service to legitimate users.

Typically the best way to deal with this involves:
a) having a dedicated firewall server or appliance that has the
functionality to block requests that tie up resources (e.g. connection open
requests from spoofed IP addresses)

-and-

b) involving your upstream bandwidth suppliers - only at the point where the
upstream provider has more bandwidth than the attacker can the problem
really be resolved. That upstream provider needs to take steps to dispose of
the malicious traffic (either by blocking it, dropping it, or similar).

Cheers
Ken

<Eng.R***@gmail.com> wrote in message
Show quoteHide quote

news:1147940956.813258.158820@i40g2000cwc.googlegroups.com...
> Dear ALL,
>
> i was wondering if there exists any plugins or filters for IIS that
> will allow me to limit the number of requests from a specifi IP
> address.
> or to automatically decrease the number of requests achieved from a
> single clients that we doubt that he is trying to carry a DoS attack
> due to his excessive number of requests.
>
> any ideas???????????
>
> thanx in advance
>