[squid-users] RE: SQUID and Welchia Worm (DoS)

From: Adam Aube <aaube01@dont-contact.us>
Date: Wed, 14 Apr 2004 08:55:09 -0400

pmquan wrote:

>> Identify the offending IP addresses from access.log and then firewall
>> these stations from using the proxy until they have been cleaned.

> But it is impossible with me, i have more than 4'000 concurrent clients
> infected with this virus. I cant firewall all of them and they are using
> dynamic ip address. Do you have another way?

Determine from Squid's access.log what the Welchia-infected stations are
requesting, and block those requests using Squid acls.

Adam
Received on Wed Apr 14 2004 - 06:54:49 MDT

This archive was generated by hypermail pre-2.1.9 : Fri Apr 30 2004 - 12:00:02 MDT