Script to block IPs
 

Hi!
Anybody know of a script that can block IPs receiving a 401 response from the webserver for a certain time? To slow down a DDOS...

.htaccess

Yes. But something needs to detect that. I'm looking for a script that does this.

A DDOS comes from a lot of IPs....

try:

/sbin/route add -host XXX.XXX.XXX.XXX 127.0.0.1

Come on guys... I know how to block an IP. :-)

I'm looking for a script that watches HTTP response 401, builds a table, counts the 401s and then pulls the plug for that IP.

if the http response is 401 it didn't read the script silly. so how exactly did you want to the script to run? locally parcing your log files? hows the script gonna block those ips when it never gets a chance to respond to the http request to begin with? do you have a firewall that reads configuration constantly from a text file or SQL database?

I've found a solution using a custom error handler recording the failed attempts and telling the firewall what to block. But it needs to be developed furtther.

If anybody knows a solution ready to use, please drop a line.

That was a good one. Thanks!