We are excited to announce that the IIS.NET Forums are moving to the new Microsoft Q&A experience. Learn more >

View Complete Thread
  • Re: IIS atack every day

    Feb 08, 2007 07:30 PM|thomad|LINK


    Did you have a look in your logfiles? The IP address of the client will be in there. You can use logparser to do the DNS lookup of the TOP IP addresses.

    The following example gets the TOP20 IP addresses and saves it in OUT.CSV. The second query does the Reverse DNS lookup:

    logparser -i:W3C "SELECT TOP 20 c-ip, count(*) AS ipcount INTO OUT.CSV FROM %windir%\system32\logfiles\w3svc1\*.log GROUP BY c-ip ORDER BY ipcount DESC" -o:csv

    logparser "SELECT REVERSEDNS(c-ip) FROM OUT.CSV" -rtp:-1

    Hope this helps.


    Thomas Deml
    Group Program Manager
    Internet Information Services
    Microsoft Corp.