Discussion Locked

FRAG Attack

0 helpful
3 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Some genius is running a DoS Attack on my IIS Proxy 2.0 server. The packetfiltering log is rejecting it but it has been going on all day. We are still working fine but I wish they would stop! Is there any way to luanch a counter attack since I have the current IP and they are doing it as we speak?

3 replies

by some guy in seattle

The best way is to contact your ISP and have them investigate and block the source IP or IPs at an upstream router. Even if you block it at your router it is subject to a DoS since it has to analyze the traffic to decide whether to dump it or not.It may also be that this attack is happening to other people too, in which case your ISP would be better able to help.

I would suggest against a counter attack because it is possible that the IP is spoofed or the attack is launched from a compromised box and you may be taking it out on another innocent party. If possible, try to contact a sysadmin of the owning network (use arin.net whois search for that info). It is possible if it is a compromised box that he/she is unaware of it.

There was an incident a few years ago with a NASA worker in which he initiated countermeasure techniques against an attacker for hacking some NASA servers, but didn't reckon that the attacker had lots more time and was way more dedicated in making this guy's life a nightmare than the NASA guy was willing to spare. Apparently this vendetta lasted months (years?). So, unless you're willing to dedicate a lot of time to this, then don't risk beginning a war.

Apologies if this isn't the answer you wanted to hear.

Hope that helps,

This discussion is closed to new replies.