Search squid archive

Users spamming squid logs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

We have an issue where peoples boxes that have java installed basically hit our proxy continuously (java must get the settings from IE). The proxy requires auth so it sends back a 407. The java updater ignores this and tries again.

So our logs fill up with machines (only takes one or two) requesting the same file and getting the same response time after time. This is most cases peoples laptops so we it's hard to police the machines as they come and go so quickly.

A snip of the spam we get:

1173963552.808 1 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.810 1 128.184.118.146 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.819 9 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.822 1 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.827 3 128.184.118.146 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.828 2 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.843 4 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.843 4 128.184.118.146 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.848 1 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.853 1 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.862 4 128.184.118.146 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.863 3 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html 1173963552.880 3 128.184.46.108 TCP_DENIED/407 11494 GET http://java.sun.com/webapps/download/GetFile/1.5.0_03-b07/windows-i586/jre1.5.0_03.msi - NONE/- text/html


Does anyone know a way to stop people doing this? I don't really want to iptables them off. Can you restrict the number of requests per ip to a file?

Thanks
Daniel

--
-----------------------------------------------------------------------------
Daniel Appleby

[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux