How to block null/blank user-agents in IIS 7.5

Posted by Jeremy on Server Fault See other posts from Server Fault or by Jeremy
Published on 2011-09-16T16:42:47Z Indexed on 2012/10/08 9:38 UTC
Read the original article Hit count: 172

Filed under:

iis7.5

|

ddos

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.

Here are the stats IIS is processing between 40 and 100 requests per second from BitTorrent clients. We have about 20% of the User Agents, but the other 75% are blank.

We want to block the blank user agents at the server level.

What is the best approach?

© Server Fault or respective owner

Related posts about iis7.5

Configuring IIS7 404 page when using IIS7 urlrewrite module

as seen on Pro Webmasters - Search for 'Pro Webmasters'
I've got custom errors to work for .aspx page like: www.domain.com/whateverdfdgdfg.aspx But, when no .aspx url is requested, (like http://www.domain.com/hfdkfdh4545) it results in an error: HTTP Error 404.0 - Not Found The resource you are looking for has been removed, had its name changed… >>> More
How to create a Subdomain in IIS7?

as seen on Server Fault - Search for 'Server Fault'
In IIS7 I have a site: http://www.mydomain.com/mysite How can I get the same site to appear as: http://mysite.mydomain.com ? I already have the DNS set up and can ping it, I just do not know how to configure it in IIS7. >>> More
How can I control which IP address IIS7 uses?

as seen on Server Fault - Search for 'Server Fault'
In Win2k3 I used httpcfg to tell IIS to listen to specific IP addresses on the server. I want to run Apache with VisualSVN Server on port 80 on another IP address but IIS7 binds to all ports by default. What utility for IIS7 controls the IIS7 bindings? Update: I found the answer. There is a utility… >>> More
WCF service hosted in IIS7 with administrator rights?

as seen on Server Fault - Search for 'Server Fault'
Hello, How do I grant administrator rights to a running WCF service hosted in IIS7? The problem is, my code works fine in a test console application runned as an administrator, but the same code used from WCF service in IIS7 fails. When I run the same console test application without admin rights… >>> More
authentication problem on windows vista (cookie is getting written but httpcontext.current.user is n

as seen on Stack Overflow - Search for 'Stack Overflow'
authentication problem on windows vista (iis7) (cookie is getting written but httpcontext.current.user is null) >>> More

Related posts about ddos

How long do DDoS attacks last?

as seen on Server Fault - Search for 'Server Fault'
I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last? Just trying to get an idea of how long we'll have to continue to wage this battle (going on a couple weeks now). >>> More
DDoS and Heroku

as seen on Server Fault - Search for 'Server Fault'
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do? >>> More
Brainstorm: Flood/DoS/DDoS Attack prevention ideas.

as seen on Server Fault - Search for 'Server Fault'
This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks. Do not discuss using 3rd party software, this is a place to make your own ideas and read others. Post… >>> More
DDoS and Heroku

as seen on Stack Overflow - Search for 'Stack Overflow'
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do? >>> More
Anti-DDoS Question

as seen on Server Fault - Search for 'Server Fault'
Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have no anti-DDoS mechanism, means that there is no point we get the Arbor Pravail? An DDoS attack can… >>> More