<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1226" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Arial; MARGIN-LEFT: 2px">
<DIV>Thanks for that explanation. So in essence what you are saying is if there
was such a device or product that could filter the http traffic it could only do
so after the hit thereby affecting the traffic at a certain point. This
being the case have a look at <A
href="http://www.riverhead.com">www.riverhead.com</A>. I got a call
from Israel explaining their product and it works after the
router filtering out spoofed packets, dns, icmp, http attacks. The use a
MVP architecture (Multi-Verification Process). What it does is filter the
packets coming in to only allow the "good stuff" into the local network.
Based on this setup wouldn't the network already have felt the hits? I
mean if you have a 5M connection to the Internet surely this would experience
degradation down from the packets coming into the router to these systems.
The whole MVP does packet filtering, then Anti-Spoofing, Anomaly Recognition,
Protocol Analysis and then last Rate limiting. Can't all of this be setup
on a gateway server? BTW they stated they use RHL in the router
cases.</DIV>
<DIV> </DIV>
<DIV>Jon</DIV>
<DIV> </DIV>
<DIV>Jon L. Miller, MCNE, CNS<BR>Director/Sr Systems Consultant<BR>MMT Networks
Pty Ltd<BR><A
href="http://www.mmtnetworks.com.au">http://www.mmtnetworks.com.au</A></DIV>
<DIV> </DIV>
<DIV>"I don't know the key to success, but the key to failure<BR> is trying
to please everybody." -Bill Cosby</DIV>
<DIV> </DIV>
<DIV><BR><BR>>>> devenish@guild.uwa.edu.au 12:01:21 PM 20/09/2003
>>><BR>In message <sf6c3f2c.091@mmtnetworks.com.au><BR>on Sat,
Sep 20, 2003 at 11:51:03AM +0800, Jon Miller wrote:<BR>> > Unlike
mail servers where one can setup blacklist/blackholes/rbl list<BR>> > is
there such a service for web servers?<BR>> <BR>> Absolutely. There are
many ways of doing this. For example:<BR>> <BR>> - packet and connection
filters (e.g. ipchains, tcpwrappers)<BR>> - web server configuration (consult
documentation for your web server)<BR>> <BR>> Apache has directives such
as Allow and Deny. It is possible to make it<BR>> much more sophisticated
than that, though.<BR>> JLM> You stated absolutely to the web server
question using ipchains,<BR>> etc, but wouldn't this have to be constantly
updated with new IP<BR>> addresses as they become available?<BR><BR>This is
effectively what happens with SMTP blacklist/blackholes/rbl<BR>lists (though it
happens transparently). Although I don't use ipchains,<BR>I assume there it
wouldn't have a problem with a script that updates the<BR>filter list when hosts
are identified. But, how does this<BR>"identification" occur? -- I'm now
guessing that you are effectively<BR>asking "does anybody keep track of hosts
that attempt to find insecure<BR>web forms to send spam". I had not realised
that you meant "service" in<BR>that sense. I don't know whether anyone attempts
it.<BR><BR>> > I've noticed the following:<BR>> > <BR>> >
/var/log/httpd/error.log<BR>> > [Sat Sep 20 10:01:12 2003] [error] [client
61.139.60.84] File does not exist: /var/www/html/tmpad/banner/itrack.asp<BR>>
> [Sat Sep 20 10:01:13 2003] [error] [client 61.139.60.84] File does not
exist: /var/www/html/a.htm<BR>> > [Sat Sep 20 10:01:22 2003] [error]
[client 210.83.18.98] File does not exist: /var/www/html/search.php<BR>> >
[Sat Sep 20 10:01:35 2003] [error] [client 61.139.60.84] File does not exist:
/var/www/html/Affiliate/SB/search1.js<BR>> <BR>> So what? Does this bother
you in some way? Could you elaborate?<BR>> JLM> Yes as this just is a
small amount, in the log files this goes on<BR>> for hours on end, thus
limiting our services. We use a 2M/@M<BR>> connection and at times it feels
like a a 56kb connection. The logs<BR>> are flooded with these
errors.<BR>[...]<BR>> So what I'm trying to understand is there must be a way
to get our<BR>> bandwidth back and eliminate this type of traffic from
consuming the<BR>> bandwidth or am I batting my head up against a hard
wall?<BR><BR>Sorry to hear it. But at least this explains what you are talking
about.<BR><BR>It will be very difficult for you to filter HTTP data to solve the
above<BR>problem. The reason is: in order to analyse HTTP data, you need to
have<BR>received it in the first place (and thus the resource limitation
has<BR>already occurred). You would need to filter at the IP level (e.g.
by<BR>recognising IP addresses) so that the TCP connections don't proceed.
Be<BR>warned, of course, that if the rate of connection attempts
increases<BR>then you will be basically under a denial-of-service type of
"attack"<BR>and you would need your upstream service provider to do the
filtering<BR>for you.<BR><BR>> JLM> Yes, these may be legitimate entries
meaning they are looking at the clients web pages, no problem here, but the
client tracks the number of hits to their site, these we know will count, but
does the one such as these below count also?<BR>> 61.139.60.84 - -
[20/Sep/2003:11:43:26 +0800] "GET <A
href="http://www.uccinema.com/a.htm">http://www.uccinema.com/a.htm</A> HTTP/1.0"
404 199<BR>> 220.113.15.29 - - [20/Sep/2003:11:43:33 +0800] "GET <A
href="http://a.as-eu.falkag.net/dat/dlv/aslmain.js">http://a.as-eu.falkag.net/dat/dlv/aslmain.js</A>
HTTP/1.1" 404 224<BR>> 61.139.60.84 - - [20/Sep/2003:11:43:35 +0800] "GET <A
href="http://ad.trafficmp.com/tmpad/banner/itrack.asp?rv=1.2&id=2873">http://ad.trafficmp.com/tmpad/banner/itrack.asp?rv=1.2&id=2873</A>
HTTP/1.0" 404 217<BR>> <BR>> Since they are 404 codes I know they are not
completing their GET<BR>> command because the pages or files do not exists,
but the traffic they<BR>> consume is immense.<BR><BR>Looks as though you had
an "open proxy" and thus your web server has<BR>become "popular" for mischevious
deads. Although you have closed the<BR>proxy, the "attackers" are continuing
their attempts (they haven't<BR>caught on to the fact that you no longer provide
the proxy
service).<BR>:(<BR><BR><BR>_______________________________________________<BR>plug
mailing list<BR>plug@plug.linux.org.au<BR><A
href="http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug">http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug</A><BR><BR></DIV></BODY></HTML>