Server stops responding

[Hal Burgiss]

On Wed, Jul 29, 2009 at 12:10 PM, Siggy Brentrup<ubuntu at psycho.i21k.de> wrote:
> You say so, maybe you are subject to a DoS attack?  Is your content by
> any means related to China?

No Chinese content that I know of.

This is a small local university website. Its a rural school in Kentucky.

Two possibilities: its some obscure bug in the site code, and these
guys are crawling
the site, and tripping the bug, or there is some scriptable
vulnerability in Apache and
these guys are working that. I've run all their requests manually, and
they don't do anything
unusual. So its just wierd at this point.

> - If these weird entries always come from one netblock, craft some
>  iptables rules to forward connections from there to a honeypot.

Right now 123/8 has no access to that domain's ip address, which is
were the last 2
suspect ip's originated.


-- 
Hal