General question

[msgopala]

Sorry to be posting this here but I am at a loss. How do I prevent brute force attack .

Problem:

After going live with my IW dll we have had insane amount of ping requests t non-existant folders and files. We are a very small shop and I have tried changing IP bindings, blocking IP and IP ranges on the server firewall and IIS. Pings have reduced but still there. The failed request trace logs show IPs from China, Brazil, Russia etc.

IIS goes down after repeated pings and our intraweb dlls stop working when users are logged in. 

I appreciate any advice I can get. 

Sorry about posting this here.

[kudzu]

DOS attacks are a persistent problem in any web framework. While there are some things you can do in IW, you will likely need to use external methods as well such as firewalls which help prevent DOS attacks.

The first step is to determine exactly what kind of resources they are trying to access and if possible why. For those prevent sessions from starting.

If your users log in, you can also use a static or non session log in page to filter access.

[Jose Nilton Pace]

Hi. In new iw15.1 it has a new property ServerController.BlockedDocExtensions, he block a lot of things like *.php, no session is created. Try use this new version to block all income request.
Check it here.

[Alexandre Machado]

Sorry to be posting this here but I am at a loss. How do I prevent brute force attack .

Problem:

After going live with my IW dll we have had insane amount of ping requests t non-existant folders and files. We are a very small shop and I have tried changing IP bindings, blocking IP and IP ranges on the server firewall and IIS. Pings have reduced but still there. The failed request trace logs show IPs from China, Brazil, Russia etc.

IIS goes down after repeated pings and our intraweb dlls stop working when users are logged in. 

I appreciate any advice I can get. 

Sorry about posting this here.

What's the version you are using?

IW 15.1 branch has some advanced features to block lots of "pre-fabricated" attacks, specially the ones that target PHP sites....