RE: denial of svc in wwwerror

My guess, IP 66.20.54.145 tried to do too many connections too fast, so it
was seen as a DOS attack.

Interesting that they forgot to interpret the 1108620945 into dotted IP
notation, which is the same as the 66.20.54.145.

Just my guess though.

Regards,

Jim Langston

-----Original Message-----
From: Jim Franz [mailto:franz400@triad.rr.com]

i had never seen this in logs before (at V4R5)

15:58:44 +0000]Input timer expired 66.20.54.145
15:58:48 +0000]                                                Denial of
service attack detected from IP 1108620945
15:58:48 +0000]Input timer expired 66.20.54.145
15:58:49 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945
15:58:52 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945
15:59:15 +0000]OK                  66.20.54.145                Denial of
service: new connection accepted for attacking IP 1108620945

any details on what triggers this?

jim