How to block null/blank user-agents in IIS 7.5

Question

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.

Here are the stats IIS is processing between 40 and 100 requests per second from BitTorrent clients. We have about 20% of the User Agents, but the other 75% are blank.

We want to block the blank user agents at the server level.

What is the best approach?

Answer 1

If request filtering can't handle this, you can try 'URL Rewrite' a free Add-On from Microsoft and pretty helpful anyways.

Create a rule like this:

<rule name="NoUserAgent" stopProcessing="true">
    <match url=".*" />
    <conditions>
        <add input="{HTTP_USER_AGENT}" pattern="^$" />
    </conditions>
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You did not present a User-Agent header which is required for this site" />
</rule>

During a quick test this worked for both an empty User-Agent and a missing one.

I'm using the regular expression '^$' which is only valid for an empty string.

You can also return a 404 or whatever else you want rather than a 403.

Answer 2

If you use IIS GUI for this instead of web.cofig, you can use the provided IIS templates to achieve the same result:

Go into IIS -> URL Rewrite -> Add Rule(s)... -> Select "Request Blocking" from the templates. Then just fill in your rule using the available drop-down menus:

• Block access based on: User-agent Header
• Block request that: Matches the Pattern
• Pattern (User-agent Header): ^$
• Using: Regular Expression
• How to block: Abort Request

Rule will be the same as other replies given with the caveat that you don't seem to be able to rename it. Also, my example uses Abort Request rather than custom response, although you can choose other 40X responses from the template if you wanted to.

Answer 3

40-100 requests/second does not a DoS make.

That said, if you want to block a specific user agent you can use the IIS <filteringRules> directive to do so (see http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/filteringRules).

The example below is not guaranteed to work (I have no IIS systems to test with):

<requestFiltering>
   <filteringRules>
      <filteringRule name="Block bad UAs" scanUrl="false" scanQueryString="false" scanAllRaw="false">
         <scanHeaders>
            <add requestHeader="User-agent" />
         </scanHeaders>
         <appliesTo>
         </appliesTo>
         <denyStrings>
            <add string="bad-user-agent" />
            <add string="" />
         </denyStrings>
      </filteringRule>
   </filteringRules>
</requestFiltering>