Attacked from Outside the Country
Posted on 2:33 pm by brianI have been running a wiki web server on my computer for 3 or 4 years now. I noticed about a year ago that my system would slow down for no apparent reason. It was intermittent and not a real problem so I didn't worry to much about it.I have been using OpenWiki and it works well for my needs which basically boil down to using it as an enhanced favorites tracker and for information I need on a semi-regular basis. I noticed about 5 months ago that the little Access Database had grown to about 50megs which was far more than I would have created. More researched showed that I was being attacked by some automated update bots so I just password protected the wiki, cleaned out the database and continued on.This morning I tried to access the site but got the message that too many people were accessing the site, try again later. I got a little more interested and started looking around. After some digging I found that an IP address from Iran had 10 windows (my limit) open. A bit more digging showed access from China, Denmark and the Netherlands. None of which looked like valid traffic and really isn't my target market anyway.I then logged into my Dlink router and set it to reject traffic from these IP addresses and the system speed has returned to normal.As a technical note I used the following resources to figure this out:
- netstat -an - a command line utility to show current network activity.
- www.geobytes.com - Online free utility to show where the IP address is physically located.
- www.google.com - Used to search for the IP address which turned up www.projecthoneypot.org which let me know the kind of activity seen from the IP adress.
- IIS Log files - I pulled the log file into Excel so I could sort all the IP addresses access my site and determine if more needed to be removed.
Hope this helps someone else resolve similar problems. BTW - I believe this has also helped my Vonage phone service improve.Drop me a line if you need more information regarding how this was done.Brian.