Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.

Here are the stats IIS is processing between 40 and 100 requests per second from BitTorrent clients. We have about 20% of the User Agents, but the other 75% are blank.

We want to block the blank user agents at the server level.

What is the best approach?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

If request filtering can't handle this, you can try 'URL Rewrite' a free Add-On from Microsoft and pretty helpful anyways.

Create a rule like this:

<rule name="NoUserAgent" stopProcessing="true">
    <match url=".*" />
    <conditions>
        <add input="{HTTP_USER_AGENT}" pattern="^$" />
    </conditions>
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You did not present a User-Agent header which is required for this site" />
</rule>

During a quick test this worked for both an empty User-Agent and a missing one.

I'm using the regular expression '^$' which is only valid for an empty string.

You can also return a 404 or whatever else you want rather than a 403.

share|improve this answer
add comment

40-100 requests/second does not a DoS make.

That said, if you want to block a specific user agent you can use the IIS <filteringRules> directive to do so (see http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/filteringRules).

The example below is not guaranteed to work (I have no IIS systems to test with):

<requestFiltering>
   <filteringRules>
      <filteringRule name="Block bad UAs" scanUrl="false" scanQueryString="false" scanAllRaw="false">
         <scanHeaders>
            <add requestHeader="User-agent" />
         </scanHeaders>
         <appliesTo>
         </appliesTo>
         <denyStrings>
            <add string="bad-user-agent" />
            <add string="" />
         </denyStrings>
      </filteringRule>
   </filteringRules>
</requestFiltering>
share|improve this answer
    
Note that this won't work if the user-agent header is NOT set -- I'm not sure how to filter requests that don't have a field set, but that seems like a Bad Idea anyway (I don't believe User-agent is a mandatory field - I could be wrong though) –  voretaq7 Sep 16 '11 at 16:58
    
You can't have an blank one in the filters. IIS removes it. What makes a DDOS is the fact that or normal traffic is around 5 requests per second, and our users request more than just the html of the home page, and they always have a user agent. –  Jeremy Boyd Sep 16 '11 at 16:58
    
Hmm, if IIS strips out blank strings you may be out of luck - I don't see any way to filter on "header is not set". Re: the other points RFC 2616 says User-agent it a "SHOULD", not a "MUST". Any solution that makes the header mandatory technically violates the RFC (something to be aware of, though in practice if you implement such a solution you should be fine). –  voretaq7 Sep 16 '11 at 18:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.