IIS 5 & IIS 6
IIS atack every day
Re: IIS atack every day
Feb 08, 2007 07:30 PM|thomad|LINK
Did you have a look in your logfiles? The IP address of the client will be in there. You can use
logparser to do the DNS lookup of the TOP IP addresses.
The following example gets the TOP20 IP addresses and saves it in OUT.CSV. The second query does the Reverse DNS lookup:
logparser -i:W3C "SELECT TOP 20 c-ip, count(*) AS ipcount INTO OUT.CSV FROM %windir%\system32\logfiles\w3svc1\*.log GROUP BY c-ip ORDER BY ipcount DESC" -o:csv
logparser "SELECT REVERSEDNS(c-ip) FROM OUT.CSV" -rtp:-1
Hope this helps.