Re: Experience with Qualys Guard (cross posted on web400 as well)

[Scott <scottgcampbell@xxxxxxxxx>]

Do you have access to the logs (access.log/php.log/error.log)?  That 
would tell you where the requests are coming from (which can be spoofed) 
and what they are requesting, then you could use that as backup to ask 
them why it is doing what it is doing, or it might show you that the 
requests aren't coming from where you think they are.

Scott

On 9/11/2014 8:22 AM, Jim Oberholtzer wrote:
> Folks:
>
>   
>
> I got a call yesterday from a customer that is having trouble with a Qualys
> Guard scan.  Apparently it scans systems for vulnerabilities but when it
> comes to a port that has a PHP server on it (in this case Zend Server), it
> starts sending over 1000 transactions a second at it, so it becomes a DOS
> attack.    Qualys firmly denies doing a DOS but I can't understand why the
> burst of transactions.  Any thoughts?
>
>   
>
> --
>
> Jim Oberholtzer
>
> Chief Technical Architect
>
> Agile Technology Architects
>
>