: If you want to deny them you need to see what signature you can identify them by. If you can identify something simple you can deny at router level you would ideally drop them at the external

If you want to deny them you need to see what signature you can identify them by. If you can identify something simple you can deny at router level you would ideally drop them at the external router, or choke router, before they get any further into your infrastructure - best bang for buck.

However it sounds like they are all very different, so you'll need something a little more intelligent to identify them.

What type of firewall do you have inboard of choke router? If it can do deep inspection and you can translate your Apache rules into something you can configure in your firewall you are again reducing the load on infrastructure further in towards the centre of your network.

iptables is unfortunately not very intelligent - it's more along the lines of your choke router, so to be honest, if you wanted to drop packets using iptables I would suggest dropping them at that router.

Final option - if you can only drop these requests in Apache, you could always configure it not to log these specific actions...I wouldn't recommend it though. It's usually best to have the data there so that if you need to analyse a change you can.

10% popularity Vote Up Vote Down