Webmaster forum - Hammering

Author

Hammering

J. A. Mc.

2005-01-28, 7:43 pm

Help ...

I'm getting hammered by a single IP. Requests every 5 minutes, day and
night.

I've blocked them in the .htaccess (that at least cools the bandwidth a
bit), but it, of course, generates 403 errors.

I've looked at codes for sending this IP to a 'null' site, but they don't
seem to be working or I'm missing something.

Can anyone offer a method of kicking their hammering into outer cyber space?
Hey, even if I turn it back to their main IP, that'd be OK too!

TIA

BruceB

2005-01-28, 7:43 pm

I'm getting hammered by a single IP. Requests every 5 minutes, day and
> night.
>
> I've blocked them in the .htaccess (that at least cools the bandwidth a
> bit), but it, of course, generates 403 errors.
>
> I've looked at codes for sending this IP to a 'null' site, but they don't
> seem to be working or I'm missing something.
>
> Can anyone offer a method of kicking their hammering into outer cyber
> space?
> Hey, even if I turn it back to their main IP, that'd be OK too!

If you're on a Linux box, you can use iptables -A to just block them from
the box. I've had to do it with a few IPs that just keep beating away
around the clock. If I recall, most of them were SEs from Europe..

There's a bunch of info on how to do this at:
http://www.linuxguruz.com/iptables/...bles-HOWTO.html

Of course, you need root access. You didn't say if this is a shared box or
not, so I assume it isn't...

GreyWyvern

2005-01-28, 7:43 pm

And lo, J. A. Mc. didst speak in alt.www.webmaster:

> Help ...
>
> I'm getting hammered by a single IP. Requests every 5 minutes, day and
> night.

Every 5 minutes is *not* hammering.

Grey

--
The technical axiom that nothing is impossible sinisterly implies the
pitfall corollory that nothing is ridiculous.
- http://www.greywyvern.com - Orca Knowledgebase: Completely CSS styleable
Knowledgebase/FAQ system

Matt Probert

2005-01-28, 7:43 pm

Once upon a time, far far away, the king summoned J. A. Mc.
<jaSPAMc@gbr.online.com> who replied:

>Help ...
>
>I'm getting hammered by a single IP. Requests every 5 minutes, day and
>night.
>
>I've blocked them in the .htaccess (that at least cools the bandwidth a
>bit), but it, of course, generates 403 errors.
>
>I've looked at codes for sending this IP to a 'null' site, but they don't
>seem to be working or I'm missing something.
>
>Can anyone offer a method of kicking their hammering into outer cyber space?
>Hey, even if I turn it back to their main IP, that'd be OK too!
>
>TIA
>

Further to what BruceB said, may I second it and say the format is:

ipchains -A input -s [ip address] -j DENY

where [ip address] is the ip address to block from the server, eg:

ipchains -A input -s 127.127.127.127 -j DENY

If in doubt, speak to your hosting company.

Matt

--
Free, high quality content for web sites. See
http://www.probertencyclopaedia.com/xcont.htm

J. A. Mc.

2005-01-28, 7:43 pm

On Wed, 26 Jan 2005 18:27:03 GMT, " BruceB" <dontwriteme@tshirts.nu> found
these unused words floating about :

> I'm getting hammered by a single IP. Requests every 5 minutes, day and
>
>If you're on a Linux box, you can use iptables -A to just block them from
>the box. I've had to do it with a few IPs that just keep beating away
>around the clock. If I recall, most of them were SEs from Europe..
>
>There's a bunch of info on how to do this at:
>http://www.linuxguruz.com/iptables/...bles-HOWTO.html
>
>Of course, you need root access. You didn't say if this is a shared box or
>not, so I assume it isn't...
>
Sorry, I'm just one user on a larger system - no root access. I'd have to do
it withing the framework allowed by a standard 'host' to a 'contract user'.

Thanks!

J. A. Mc.

2005-01-28, 7:43 pm

On Wed, 26 Jan 2005 19:53:48 GMT, comments@probertencyclopaedia.com (Matt
Probert) found these unused words floating about :

>Once upon a time, far far away, the king summoned J. A. Mc.
><jaSPAMc@gbr.online.com> who replied:
>
>
>
>Further to what BruceB said, may I second it and say the format is:
>
>ipchains -A input -s [ip address] -j DENY
>
>where [ip address] is the ip address to block from the server, eg:
>
>ipchains -A input -s 127.127.127.127 -j DENY
>
>If in doubt, speak to your hosting company.
>
Thanks, I'll probably have to do that. I was hoping that there was some code
that could go in .htaccess similar to a 'redirect'.

BruceB

2005-01-28, 7:43 pm

> Sorry, I'm just one user on a larger system - no root access. I'd have to
> do
> it withing the framework allowed by a standard 'host' to a 'contract
> user'.
>
> Thanks!
>

Maybe you can get the hosting company to do it for you. They have root
access and probably would just as soon not have someone trying toaccess the
box every 5 mins.-- unless of course, it's legitimate for some other domain
on the box..

Matt Probert

2005-01-28, 7:43 pm

Once upon a time, far far away, the king summoned J. A. Mc.
<jaSPAMc@gbr.online.com> who replied:

>Thanks, I'll probably have to do that. I was hoping that there was some code
>that could go in .htaccess similar to a 'redirect'.
>

The solution we have offered bans the IP address from accessing the
server.

If you don't mind the overheads, you can within each page test the
calling IP address, and present a rude message to certain IP
addresses, or do a redirect.

The server still gets accessed and bandwidth used, but it can be done.

Matt

--
Free, high quality content for web sites. See
http://www.probertencyclopaedia.com/xcont.htm