Subject: Better way to stop hammering???

From: William Henry <[email-masked]>
Date: Mon, 07 Dec 1998 00:02:43 -0500

Hi all,

Is there a better way to deal with people who insist on attempting to
connect to an FTP site every second for hours on end, then by placing them
in a deny list that uses /usr/dict/words as the message?  That's what I've
been doing, and it at least slows them down.  I know it's like hitting
yourself in the hand with a hammer to punish someone else, but I can't
think of any other way.  It at least seems to get most people to stop and
consider what's happening, at which point they eventually stop.

It also appears that some versions of some browsers like to try and retry
on a connection at some randomly devised number of tries, but I haven't
been able to figure out which ones, and if there's a consistent number of
tries or if it just picks a number and stops when it reaches it.  Any ideas
there?

William Henry
[email-masked]
http://www.primeconsult.com

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 7 Dec 1998 08:32:35 -0500 (EST)

On Mon, 7 Dec 1998, William Henry wrote:

> connect to an FTP site every second for hours on end, then by placing
> them in a deny list that uses /usr/dict/words as the message?  That's
> what I've been doing, and it at least slows them down.  I know it's
> like hitting yourself in the hand with a hammer to punish someone
> else, but I can't think of any other way.  It at least seems to get
> most people to stop and consider what's happening, at which point they
> eventually stop.

I find a filter on my router works fine and is kinder on my server.
Usually only need leave it in place for a day or so.  I see this kind of
crap with Windoze Networking (smb, ports 137 et al) more often than FTP.

> It also appears that some versions of some browsers like to try and
> retry on a connection at some randomly devised number of tries, but I
> haven't been able to figure out which ones, and if there's a
> consistent number of tries or if it just picks a number and stops when
> it reaches it.  Any ideas there?

Never had any problems with broswers doing this.

The real question which pops into my mind is _why_ are you having so many
failed connections?  If it's because you have something popular in your
site that's one thing, but a large number of failed connections could
indicate a network reliability problem.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Tue, 8 Dec 1998 14:34:43 +0100 (CET)

On Mon, 7 Dec 1998, William Henry wrote:

> in a deny list that uses /usr/dict/words as the message?

You can use the deny directive in ftphosts to block their IP... Maybe
they'll stop if they see they aren't even getting a connection.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: William Henry <[email-masked]>
Date: Tue, 08 Dec 1998 13:54:07 -0500

>they'll stop if they see they aren't even getting a connection.

Unfortunately, these appear to be some kind of unattended automated
retrievals.  They have a specific file/location they wish to recieve, and
it won't stop until they've retrieved it.  

It's gotten so bad that I've actually had to manually manipulate ftpaccess
to let them in and then move the real file to a temp file and create a
small text file with off-color words in it, and put that in it's place.  So
now they successfully download a 40 or 50 byte file, and move on.
Otherwise, it just never stops.  It's probably about 1 to 3 per hour like
this, there must be some absolutely inconsiderate ftp client developers out
there making infinite-retry automated file transfer clients.

William Henry
[email-masked]

---

From: Forrest Aldrich <[email-masked]>
Date: Tue, 08 Dec 1998 14:09:46 -0500

Someone is probably using NCFtp with the redial/reconnect option,
set at low intervals.

Forrest