Hi All,

I've just updated to Protector 2.31 (yet to update to 2.32 for MySQL debug fix) and I've noticed somethng that doesn't seem to be working, or I've got myself a little confused.

I have the "Watch time for high loadings (sec)" set to the default of 60 seconds, and the DoS F5 attack defense set to a count of 10 for this period with the "Action against F5 Attack" option set to blank screen . To my mind what this means is that if any one IP refereshes the page more than 10 times in a 60 second period, then they are given a blank page. Is this correct?

The reason I ask is that I use a tool called EyeOnSite which polls my website once every 60 seconds to make sure it is still online. When I woke up this morning I found that this EyeOnSite utility had been logged over 700 times for a DoS attack and all I got were blank pages. To me this shouldn't be so as this tool only polls my site once every 60 seconds and the trigger for being considered a DoS attack is 10 refreshes every 60 seconds. Is something wrong, or have I misunderstood these settings?

hi brash.

Everytime a request passing mainfile.php, it is counted up.
eg) Fetching RSS also counts up its IP.

Thus, you access the site only 10 times intentionally, mainfile.php can be passed 30 times.

The best solution is set exit instead of IP bans against F5 Attack or Bad Crawlers, I think.