Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

IIS 6.0 with Windows Server 2003. We have bot attack or scanning (low to medium) to our IIS server. Reading IIS logs, we realize that one IP loads our web page in the way shown in the picture: enter image description here

We can block that IP on the firewall, but I'm wondering if it's possible to block on IIS by behaviour or pattern, for example, blocking some IP due it's accessing one web page 4 times in a second, and continuously for 5 hours?

share|improve this question
    
Yes. This is exactly what most IDS/IPS systems do... Look for suspicious patterns and block IPs. –  Chris S Aug 16 '12 at 17:01
    
May I ask how to configure that on IIS 6.0 or some link for information? –  user316687 Aug 16 '12 at 17:17
1  
IIS can't do that, you'll need an IDS/IPS appliance in addition to IIS. Typically this run on or behind your firewall. –  Eric C. Singer Aug 16 '12 at 17:57

1 Answer 1

up vote 2 down vote accepted

IIS can't natively do this, and this function is traditionally handled by an IPS/IDS (actually a Web Application Firewall is more appropriate that inspects Layer 7 traffic and is able to decrypt https traffic), but an ISAPI filter installed in IIS such as WebKnight from AQTRONIX (free/opensource) should be able to do what you ask. It is similar to URLScan from Microsoft, but has more functionality. The following is from the link:

Connection control/monitoring

You can block or monitor traffic coming from certain ip addresses or ranges. You can also monitor access to certain important files or limit the number of requests coming from a single IP address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.