Take the 2-minute tour ×

We are going through a large scale DDOS attack, but it isn't the typical bot-net that our Cisco Guard can handle, it is a BitTorrent attack. This is new to me, so I am unsure how to stop it.

Here are the stats IIS is processing between 40 and 100 requests per second from BitTorrent clients. We have about 20% of the User Agents, but the other 75% are blank.

We want to block the blank user agents at the server level.

What is the best approach?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If request filtering can't handle this, you can try 'URL Rewrite' a free Add-On from Microsoft and pretty helpful anyways.

Create a rule like this:

<rule name="NoUserAgent" stopProcessing="true">
    <match url=".*" />
        <add input="{HTTP_USER_AGENT}" pattern="^$" />
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You did not present a User-Agent header which is required for this site" />

During a quick test this worked for both an empty User-Agent and a missing one.

I'm using the regular expression '^$' which is only valid for an empty string.

You can also return a 404 or whatever else you want rather than a 403.

share|improve this answer

40-100 requests/second does not a DoS make.

That said, if you want to block a specific user agent you can use the IIS <filteringRules> directive to do so (see http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/filteringRules).

The example below is not guaranteed to work (I have no IIS systems to test with):

      <filteringRule name="Block bad UAs" scanUrl="false" scanQueryString="false" scanAllRaw="false">
            <add requestHeader="User-agent" />
            <add string="bad-user-agent" />
            <add string="" />
share|improve this answer
Note that this won't work if the user-agent header is NOT set -- I'm not sure how to filter requests that don't have a field set, but that seems like a Bad Idea anyway (I don't believe User-agent is a mandatory field - I could be wrong though) –  voretaq7 Sep 16 '11 at 16:58
You can't have an blank one in the filters. IIS removes it. What makes a DDOS is the fact that or normal traffic is around 5 requests per second, and our users request more than just the html of the home page, and they always have a user agent. –  Jeremy Boyd Sep 16 '11 at 16:58
Hmm, if IIS strips out blank strings you may be out of luck - I don't see any way to filter on "header is not set". Re: the other points RFC 2616 says User-agent it a "SHOULD", not a "MUST". Any solution that makes the header mandatory technically violates the RFC (something to be aware of, though in practice if you implement such a solution you should be fine). –  voretaq7 Sep 16 '11 at 18:11

Your Answer


