IIS 6.0 with Windows Server 2003. We have bot attack or scanning (low to medium) to our IIS server. Reading IIS logs, we realize that one IP loads our web page in the way shown in the picture: enter image description here

We can block that IP on the firewall, but I'm wondering if it's possible to block on IIS by behaviour or pattern, for example, blocking some IP due it's accessing one web page 4 times in a second, and continuously for 5 hours?

  • Yes. This is exactly what most IDS/IPS systems do... Look for suspicious patterns and block IPs. – Chris S Aug 16 '12 at 17:01
  • May I ask how to configure that on IIS 6.0 or some link for information? – Delmonte Aug 16 '12 at 17:17
  • 1
    IIS can't do that, you'll need an IDS/IPS appliance in addition to IIS. Typically this run on or behind your firewall. – Eric C. Singer Aug 16 '12 at 17:57

IIS can't natively do this, and this function is traditionally handled by an IPS/IDS (actually a Web Application Firewall is more appropriate that inspects Layer 7 traffic and is able to decrypt https traffic), but an ISAPI filter installed in IIS such as WebKnight from AQTRONIX (free/opensource) should be able to do what you ask. It is similar to URLScan from Microsoft, but has more functionality. The following is from the link:

Connection control/monitoring

You can block or monitor traffic coming from certain ip addresses or ranges. You can also monitor access to certain important files or limit the number of requests coming from a single IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.