I am observing at my webserver's iislog that there are couple of IP addresses which are making multiple calls in every 2-3 milliseonds to IIS page /iisstart.htm. I am looking a work around to stop this.
I tried two things so far to trap this bombardment of iisstart.htm requests .
1. Removed iisstart.htm from defualt documents list from IIS. Now in the iis log , those distinct IPs are still hitting my webserver with blank request and getting 403.
2. Blocked those IP from directory security in IIS properties. Still results are same as step 1. Those distinct IPs are still hitting my webserver with blank request and getting 403.
Please help me getting outta it... it's significantly reducing the server's performance.
Turn on Windows Firewall if you aren't using it already and then block the IPs in question or talk to your hosting provider to block them.
I imagine this is no longer an issue but here's a great Logparser script to quickly identify the top 10 IPs that are hitting your site in case you need to block any again.
logparser.exe "select Top 10 count(*), c-ip from logfile.log group by c-ip order by Count(*) DESC" -o:csv >c:\temp\topIP.txt
SantoshK
1 Post
Bombarded with iisstart.htm requests - Need Help ::: URGENT
May 14, 2012 03:38 AM|LINK
Hello All,
I am observing at my webserver's iislog that there are couple of IP addresses which are making multiple calls in every 2-3 milliseonds to IIS page /iisstart.htm. I am looking a work around to stop this.
I tried two things so far to trap this bombardment of iisstart.htm requests .
1. Removed iisstart.htm from defualt documents list from IIS. Now in the iis log , those distinct IPs are still hitting my webserver with blank request and getting 403.
2. Blocked those IP from directory security in IIS properties. Still results are same as step 1. Those distinct IPs are still hitting my webserver with blank request and getting 403.
Please help me getting outta it... it's significantly reducing the server's performance.
IIS 6 IIS Performance IIS 6.0
fab777
925 Posts
Re: Bombarded with iisstart.htm requests - Need Help ::: URGENT
May 14, 2012 11:55 AM|LINK
Please 'Mark as Answer' if this post helps you.
Fabrice ZERROUKI
peterviola
543 Posts
Re: Bombarded with iisstart.htm requests - Need Help ::: URGENT
Jun 05, 2012 03:06 PM|LINK
Turn on Windows Firewall if you aren't using it already and then block the IPs in question or talk to your hosting provider to block them.
I imagine this is no longer an issue but here's a great Logparser script to quickly identify the top 10 IPs that are hitting your site in case you need to block any again.
logparser.exe "select Top 10 count(*), c-ip from logfile.log group by c-ip order by Count(*) DESC" -o:csv >c:\temp\topIP.txt
log parser
MCTIP SA, EST, DBA 2008
Please 'Mark as Answer' if this post helps you.
OrcsWeb: Managed Windows Hosting Solutions
"Remarkable Service. Remarkable Support."