IP blocking issues

[bigblock454]

Hi All, I have a weather station uploading to a website via FTP. It generally maintains 2 connections, one updating every 5 minutes, the other every 30 seconds.

Once in a while these processess go crazy and attempt to open 50 or more FTP connections at once. This has caused my host to block my IP, completely shutting down the weather feed to my website. Now the are refusing to unblock me without a preventive strategy, and threatening to delete my site altogether.

I am changing hosts because of the rudeness of my current host, but I wonder if anyone here can recommend a piece of software that could monitor the FTP processess on that machine, and notify me if they go nuts. I don't want my new host to end up blocking me if it happens again (it's happened 2 times in 2 years, so it's not common).

If this should be on another forum, please direct me to which one. Thanks, Dawn

 

[burtsbees]

Isn't a 454 a big block anyway, like there's no small block?

Put a sniffer on the line to see if it may be hacker wannabe's trying to brute force the ftp server, and limit the number of connections to the ftp server. What kind of ftp server is it? Windows? What is the host provider complaining about? Successful connections or connection attempts? If it's attempts, block the entire country of China, because that's where you'll find 95% of the proxy servers that are hijacked and used to brute force ftp sites. The funny thing is, most are anonymous ftp servers, so there is no need for a password, and no write access or access beyond the ftp server. Also, put a shutdown batch file on there and call it "passwords.bat"...lol

Burt

Burt

 

[burtsbees]

One more thing...try slicehost.com

Burt

 

[bigblock454]

burtsbees, we've spoken before on the cisco thread, I used to be 573dawn but was mysteriously banned and now my nic is named after the engines in our boat and my corvette

Ok, let me expand on this a little. My host banned the IP address at my house, meaning I can't see my own website from my own easy chair, and my weather feed is dead. They have done this once before, and I could clearly see that my weather station FTP process had 50-60 open windows across the taskbar. That was the first time they blocked me, and I understand that one user can't hog all the resources on a shared server.

This time, I can see nothing out of the ordinary on the box that runs the weather station at home. There was one FTP session attempting to connect. The host is claiming again that I was using up too many resources, although I have no idea what caused it this time. They wanted to know how I was going to prevent it, and since I don't know what happened, I have no idea. I asked them to tell me, but they so far have not responded.

Meanwhile, I have already initiated the process of moving, because my host is so utterly rude and arrogant, and I hate dealing with them, so I'm going to inmotionhosting, thanks for the suggestion though.

I don't want to have issues with the new host, and the only process I know of that goes nuts once in a while is the weathre station FTP. I don't have a sniffer, nor do I have access to the actual server I am uploading to, other than as a customer, so I can't really do anything on that end. All I can do is try to prevent it at home. I don't think I'm hijacked, I don't see any unusual activity, is there a good way to tell?

Thanks, Dawn

 

[burtsbees]

hijackthis! will tell you about runaway processes...

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Burt

 

[aquila125]

Normally your host would limit the number of FTP connections you can have. It seems strange (and rude) that they would block you for this.

good luck though!