2

We have a server that is making calls to a specific url, such as https://this.server.name/folder/folder2/...

The devs do not know what code is making calls to this location and want me to block it in order to generate errors in the logs that we can follow.

This is on a Windows 2008 R2 server and I'm trying to figure out how to block calls to this specific location. We still need to make calls to https://this.server.name/ We just want to block calls to .../folder/folder2/...

My first thought was to edit the hosts file to point that location to 127.0.0.1 but I didn't think it could get that granular and block all the way down to .../folder2/...

I also don't see any method within Windows Firewall to block a URL. Any help on where to turn would be greatly appreciated. Thank you.

Improve this question
3
  • 1
    You don't really mentioned how you know it is making calls to that URL. What's it doing? How do you know? This should help you deduce what is accessing that URL or at least help the experts here offer up a way to handle it.
    – TheCleaner
    Dec 9, 2013 at 14:12
  • The guys on the other end notified us. Their logs are telling them that they are getting requests from our server IP. That's where the confusion comes from, nobody on the dev team knows what is making calls to that location and can't find it in any of their code. So we are trying to create a way to throw an error by blocking this location so we can get more info to track it down. I'm also open to more elegant solutions on finding what on this server is calling that location.
    – Tony
    Dec 9, 2013 at 14:16
  • 2
    Is it constant or at least on a "schedule"? If so, you could use wireshark during a timeframe to capture traffic to that IP and see what process is calling it.
    – TheCleaner
    Dec 9, 2013 at 14:37

1 Answer 1

Reset to default
1

Since you don't have access to the server to block it there, things are a bit more difficult. The best idea I can come up with (and there are probably better ideas available, I just can't think of them) is to put a transparent proxy in front of your server and configure Squid (or a similar software package) to block that URL. If you're not sure which server the request is coming from, you'll need to put said proxy in front of your entire network, which would be a lot more work.

In all honesty, though, I'd be putting a lot of pressure on your developers to do a full code audit and figure out where in the code this call is being made.

Improve this answer
2
  • Actually, we were able to get the guys on the other end to block access to that folder from us (or at least they said they did). However I'm not seeing any errors in Windows event viewer so this isn't really helping me like I thought it would. Unfortunately, the devs have been trying to find it for a while now and passed it off to me (the admin) today, I can't really go back to them and say "audit your code" after I was tasked to do it by my lead.
    – Tony
    Dec 9, 2013 at 14:31
  • If the app doesn't log errors properly, you probably won't ever be able to find it short of auditing the code yourself. Unfortunately, it looks to me like you've been wedged squarely between Rock and Hard Place.
    – John
    Dec 9, 2013 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.