11 Mar
2009
11 Mar
'09
9:52 p.m.
Hi, please avoid HTML in a maillist and use plain text instead ;)
Reply inline:
El Miércoles, 11 de Marzo de 2009, Juan Perez escribió:
Hello
I need some clarification here; the Help file for this module says this:
///////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////
The module keeps trace of all (or
selected ones) incoming request's IP source and blocks the ones that
exceeded some limit. Works simultaneous for IPv4 and IPv6 addresses.
The
module does not implement any actions on blocking - it just simply reports
that there is a high traffic from an IP; what to do, is the administator
decision (via scripting).
///////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////
I understand from the first part that it blocks the IPs, but last sentence
says otherwise. How is it supposed to work?
You can reject, drop or whatever after checking if the source IP is doing a
flood by testing:
if (!pike_check_req()) { # do_something };
Using an external script you can list the blocked IP (using the module MI
command called "pike_list") and do whatever you wish with that information
(send a mail to the admin, store the IP's in a DB...
--
Iñaki Baz Castillo