How to block null/blank user-agents in IIS 7.5

Question

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.

Here are the stats IIS is processing between 40 and 100 requests per second from BitTorrent clients. We have about 20% of the User Agents, but the other 75% are blank.

We want to block the blank user agents at the server level.

What is the best approach?

Answer 1

40-100 requests/second does not a DoS make.

That said, if you want to block a specific user agent you can use the IIS <filteringRules> directive to do so (see http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/filteringRules).

The example below is not guaranteed to work (I have no IIS systems to test with):

<requestFiltering>
   <filteringRules>
      <filteringRule name="Block bad UAs" scanUrl="false" scanQueryString="false" scanAllRaw="false">
         <scanHeaders>
            <add requestHeader="User-agent" />
         </scanHeaders>
         <appliesTo>
         </appliesTo>
         <denyStrings>
            <add string="bad-user-agent" />
            <add string="" />
         </denyStrings>
      </filteringRule>
   </filteringRules>
</requestFiltering>