WhatsUP DOS attack

[cjtjamandra]

Have you experienced this attack to apache2?

192.168.10.46 - - [21/May/2008:08:05:33 +0800] "HEAD / HTTP/1.0" 200 - "-" "WhatsUp/1.0"

It is in my apache2 log for every second. I have blocked the IP using iptables:

iptables -A INPUT -s 192.168.10.46 -j DROP
iptables -A OUTPUT -d 192.168.10.46 -j DROP

but it can still access my apache server.

any suggestions for resolving this?

thanks in advance.

[anystupidname]

Erm... That is a non-routable IP so I think you're missing something. Furthermore, if you blocked it with IPtables, it wouldn't be able to hit apache anymore.

The whatsup tool is from http://www.ipswitch.com/
I highly doubt this is an intentional denial of service.
Without knowing more about your network topology, I wouldn't want to venture any more guesses.

Good luck

[cjtjamandra]

So you mean it's not a DOS attack? Then why it is accessing my apache server?

[Monicker]

From doing a quick google search on that user agent, tt appears that is generated by an Ipswitch product called WhatsUp, which is used for network monitoring. Someone on your lan using the product?

http://www.whatsupgold.com/

[cjtjamandra]

-

[cjtjamandra]

We have several switches so i think someone is using that product. so is there any explanation why this program or software is accessing my web server (apache2) ?

[Monicker]

Sounds like a question for the people on your network who are using the application.

[lisati]

We have several switches so i think someone is using that product. so is there any explanation why this program or software is accessing my web server (apache2) ?

If you can pinpoint it to a particular machine, you might want to start asking questions. But be nice - there might be an innocent explanation.

[lisati]

So you mean it's not a DOS attack? Then why it is accessing my apache server?

BTW I'm aware of at least two meanings for the acronym "DOS" (Disk Operaging System and Denial Of Service) but the team here is probably aware of that. I remember being vaguely baffled at first by talk of "COM" files for Windows (again, more than one meaning, COMmand and COMponent)

p.s Please go easy on me - perhaps the literal-minded autistic side to my makeup is making a nuisance of itself

[cjtjamandra]

thanks for the clarifications.. now iam more aware about this WhatsUp thing.

what i have done is block that ip using iptables...

But iam still confused, can WhatsUp be used as a Denial of Service attack?