WebApp Sec: Re: Combatting automated download of dynamic websites?

[Achim Hoffmann <kirke11 () securenet de>]

On Mon, 29 Aug 2005, Matthijs R. Koot wrote:

!! In specific, I was wondering if it's possible and sensible to limit the
!! allowed number of requests for certain pages per minute/hour.

how about using iptables (if available on your system/router in front):

iptables -A FORWARD -p tcp --dport 80 -d <IP>   --syn -m dstlimit --dstlimit-mode srcipdstip-dstport --dstlimit 1/sec 
-j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d <IP> ! --syn -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d <IP>   --syn -j DROP
# allows an average of 1 syn/sec and max. 5 syns in a burst, see iptables'
# man-page for more details

{-: Achim