Runaway anonymous user connections

[shweta]

Hi,

We've been seeing a peculiar problem on our servers running IIS 5.0 and Windows 2000 Advanced server.

Every so often, the number of anonymous user connections jumps up and goes on increasing from the normal average 50-60 to 1100+ within an hour.

There's nothing in the log files to indicate what triggered off the increase. And it's not the website code because the same problem happened on another server for a different website.

Any suggestions/clues?

Thanks,
Shweta

 

[JohnYingling]

See

http://WWW.GRC.COM.

You could be the victim of a DRDSOS, Distributed Reflection Denial of Service attack. Someone sends out a connection request with your IP address as the requestor. They innocently respond to you.

http://www.VBResizer.com

Generate Forms/Controls Resizing/Tabbing Class

http://www.VBCompare.com

Compare Code (Text)

http://www.VBSortGen.com

Generate Sort Class in VB or VBScript

 

[hardcore69]

shweta, I am seeing a very similar situation on my web servers. I do not think it is related to the DRDOS attack that JohnYingling mentions, at least not in my case. As you noted, nothing in the logs indicate that an actual connection is being requested. Also, this same problem occurs on internal web servers not exposed to the internet that are running a web-based application.

Might I ask what (if any) type of application you are running on the servers that experience this problem? We have some custom-developed in-process dlls that were written in VB6 which are common to both sets of servers.