[KLUG Members] WTF is going on?

[Bruce Smith]

> No! They weren't.  And, if I start the old server and make the request,
> the only thing it really returns is the main page.  Well, I guess I dont'
> know.  That' definately not a valid page on my server (Mm.. webcams on a
> DNS server).  I looked through older logs, and this has been happening for
> a while.  However, not to this extent:  www.glaven.org/images/hack2.jpg

If the traffic is all coming from the same IP, subnet, or small number
if IP's, then BLOCK THEM.  Use ipchains/iptables to drop them, or add
ACL's in your router to drop those addresses.

You also might want to contact your ISP and get their help.  Your ISP
may be able to block those addresses before they tie up traffic on your
connection.

--------------------------------------------
Bruce Smith                bruce@armintl.com
System Administrator / Network Administrator
Armstrong International, Inc.
Three Rivers, Michigan  49093  USA
http://www.armstrong-intl.com/
--------------------------------------------