Login spammer reaking havoc, any programs out there to pinpo

[Scotty]

Hello,

I've got some troubled people spamming my login server, which eventually crashes the whole server application due to the mass login attempts..

Is there a program out there for WSrv03'-x64 that will show me each connection and the current data rate of that connection, program that initiated the connection, and the source IP?

[TimeX]

I don't remember what information it shows, but most people prefer to use Wireshark to collect such information.

[Scotty]

Yeah, I found an option in the network adapter that allowed me to log all successful connections, and I found 72.46.217.206 thousands of times in the log. I blocked it using peer guardian 2, but it didn't block the IP. All seemed right, but it didn't block it.

So I googled a new way to block IPs and I found a guide for Srv03' that said to enable an IP security policy through MMC. it disconnected my remote desktop. Waiting for a reply on the ticket system now.

[Scotty]

Now I need a REAL IP blocker that wont block every connection when you run it, and that only blocks IPs I specify, and that actually blocks the IP.

[Edge100x]

I'd recommend using ipsec, which is built into Windows. One interface to it is ipseccmd. I talk about this a little here: http://www.nfoservers.com/forums/viewto ... 93&p=22646

Note that when you block something with ipsec, it will still show in packet dumps (Wireshark/windump), even if it is being dropped.

[Scotty]

If only I knew about that before I made it so my dedicated host disallows all connections. Could you help me with getting that issue fixed? I can't get on my host now due to what the guide I found on google lead me to do.

[Edge100x]

If this is a dedicated server and not a VDS, you need to be extremely careful with firewall rules, and you need to test everything before applying it (or have some automated way of un-applying it). I usually recommend to customers that they not run a firewall on a dedicated server, since it is so easy to mess up. VDSes can be recovered easily, of course.

ipsec is nicer than a regular firewall because its rules are temporary by default. Restart the machine, and you start over with a clean slate.

We will need to talk about your recovery steps further in a support request.