Posted by Steve on 02/01/07 14:50

"Christoph Burschka" <christoph.burschka@rwth-aachen.de> wrote in message
news:52doerF1o6c2iU1@mid.dfncis.de...
| J.O. Aho schrieb:
| > Nu wrote:
| >
| > You can use smoothwall, there are extensions that bans a ip for a while
| > if it does hammer the server, but of course requires a real OS instead
| > of that you seems to use.
| >
|
| Just a note: From what I've seen, most web servers mentioned here run
| remotely (and the OP didn't say otherwise), and there is no way to find
| out the server's OS from the mail headers of the post. I use XP locally,
| myself.
|
| So as awful as Outlook Express is, you can't conclude that the webserver
| must be trash.

isn't it illogical to say 'from what i've seen, most web servers mentioned
here run remotely', and then assume you can tell what webserver is being
used based on the headers of the op's post (usenet clients run locally)? it
is safe to assume that the op is running his site rather than having it
hosted, instead of assuming he's found a web host that allows him to freely
alter their server's configuration...and assume that same host has crappy
servers that run into these problems (not having adequate security in place
already). i'd say it is very appropriate for aho to infer that the op is
running windows since his headers indicate OE. and since most of his (aho)
non-php solutions won't work on windows, it is fair to mention it.

as for his opinion of what constitues a 'real' os, that is all a matter of
preference. were it not, then over 90% of desktops would be running on,
well, 'nothing'. as it is, there are plenty of 'smoothwall' bandwidth genre
applications for windows.

finally, we *can* conclude the web server is trash...the op makes that
clear. all of the suggestions you and aho made regarding configuration,
back-end applications, and coding patterns will help to ease to problem. as
it is, if someone is going to 'bang' on a server, it is best to let them.
create a means to track it in php so that you have evidence, can track them
to their isp, and have their service dropped and/or bring litigation against
them. any attempt to lessen the threat makes it harder for you to detect and
may even seem, through your php tracking, to be less than abusive since
'smoothwall' has a direct impact on the site hits by ip. this, of course, is
under the assumption that the op owns his own server and dos attacks have
medium to low impact...a web host would use a combination of techniques that
are far from the op's paygrade of understanding.

[Back to original message]