DNS Attack via HTTP

[Roman_Gelfand]

I am running squid reverse proxy behind my firewall. It appears someone sends me these bump requests. What can I do to block them? Is there an ips that looks at http headers and blocks the requester? ..............E..dm.@.....|...`9.....P..].-..#P....H..GET.http://www.asd818.com/.HTTP/1.1..Accept:.*/*..Referer:.http://www.asd818.com/..Accept-Language:.zh-cn..Accept-Encoding:.gzip,.deflate..User-Agent:.Mozilla/4.0.(compatible;.MSIE.6.0;.Windows.5.1;Windows.5.5;Windows.6.0)..Host:.www.asd818.com..Proxy-Connection:.Keep-Alive..Pragma:.no-cache..Cookie:.Keep-Alive... Thanks in advance

[Sumanth_FTNT]

Better solution for time being is using a custom signature.. config ips custom edit " HTTP.DNS.Custom" set signature " F-SBID( --name \" HTTP.DNS.Custom\" ; --protocol tcp; --default_action pass; --service HTTP; --flow from_server; --pattern \" CompanyLongName\" ; --context body; --no_case; --pattern \" ..............E..dm.@.....|...`9.....P..].-..#P....H..GET.http://www.asd818.com/.HTTP/1.1..\" ; --context body; --no_case; --within 100;)" next This is just a sample.. you can modify as per your needs..See if this works..