Re: Reject Nimda generated request

[davidlfliang]

Just recently, my server (NT 4.0/IIS 4) has received some strange requests in the

http://www log

files.
After some research, I'm sure the requests were made from the NIMDA worm. I checked source IP addresses.

They are from different countries all over world. my server has the latest service pack and firewall proteciton.
Also, after more checking, I'm sure my server is not affected. This is not a problem.

However, my problem is:
My server is connected via DSL line to my isp and they charge us based on the traffic on both directions.
This means any request made from outside world to our server, we need to pay for this traffic.

Then, my sever receives these worm generated requests(nomally 16 requests together in each group, 5 or 6 groups per day) everyday,
I think all these requests contribute to the traffic workload.

How could we solve this problem?

Any suggestion will be welcomed.

Thanks in advance

David Liang

 

[KimberTech]

You can not control requests from an outside source from your location. If you are running firewall you are controlling what requests are validated and which are ignored.

If I were you, I would contact your ISP and talk to them about it.
There are tons of port scanners and requests generated every minute. If you are billed per network traffic, they may have an allowance for that built in.

Have you asked them? I would be interested in the reply.
It might be pertinent to find out what percentage of traffic is legitimate, and if this is costing the company money you may be better off with a different billing plan. Kimber

The more I learn,I realize how much more there is to know!