Developer Forum

Hi Folks;

I'm running ISA 2004 and am getting DOS attacks against my DNS server. The
good news is that ISA notices this because the attackers exceed 160
connections per second and ISA sets an alert.

What I'm seeing though is that the attack then slows down but continues. The
good news is that the attack is not saturating our connection but the bad
news is that it still goes on.

My question is this, is there any way to cause ISA to outright block a user
they trigger an alert from making too many connections? To me, this would be
useful and save me from doing it manually. That way, all packets coming from
them would be dropped.

Best (and thanks!)
Dave