ons 2003-01-08 klockan 19.03 skrev Monah Baki:
> The server resides in an ISP, and that class is part of their network.
> I noticed that the host IP on that network (128.52.41.xx) changes with
> the error that I mentioned.
> My ACL allows only the IP address that the ISP has given me, and denies
> everyone else.
Most likely there is several users who are infected by viruses who uses
the same vulnerabilities to spread themselves, or by script-kiddie
robots who uses cracked unsuspecting user machines as "jumpgates" for
scanning for other hosts to crack..
If Squid is running as a transparent proxy then it will intercept these
"hackers", and usually denies them due to malformed HTTP requests.
This should not by itself cause the machine to reboot, but may cause
substantially increased load downgrading the service level.
Almost certainly there is some other issue with the machine which causes
it to reboot. Possibly triggered by the load on Squid put by these
viruses/hacker robots.
See the system messages file, the administrators at the ISP etc (in case
they reboot the server due to poor performance).
Regards
Henrik
Received on Wed Jan 08 2003 - 11:17:52 MST
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:12:35 MST