Re: Am I under a DOS Attack?

[GKern@xxxxxxxxxxxxxxxx]

Thanks Don - interesting read.

Larry:

"One thing you can do (and I have done this for a few) is to tell either 
Domino or in your case Symantec to deny connections from that servers IP 
address.  Usually a few seconds after that the hits stop entirely as they 
can't get in. 

We did deny the connection in Symantec. It didn't end right away but by 
5pm the spam appeared to stop altogether. 

"So basically things are working normally." 

Yes - Gotta love Domino! No one even noticed any performance hit. I just 
happened to check the misc logs and noticed all the entries. We did tell 
Symantec to stop sending a message denied reply to the spam source. I 
wonder if once the spammer realized we were on to them they stopped their 
effort altogether.

"Watch carefully though as they may change their source IP once they see 
the connections fail." 

Yep - I usually check the misc log at least once a day mostly to ensure 
our Scanmail AnitVirus is updated every hour. It just so happend that I 
didn't check the logs for two days - and this thing crept into the picture 
(murphy's law I guess).

Ahhh - back to a normal Friday afternoon. Thanks again for the input.

Regards, Jerry

Gerald Kern
MIS Project Leader, Lotus Notes/Domino Administrator
IBM Certified RPG IV Developer, RPG IV Programmer
The Toledo Clinic, Inc.
4235 Secor Road
Toledo, OH 43623-4299
Phone 419-479-5535
gkern@xxxxxxxxxxxxxxxx