Member Avatar for cfwebdeveloper

I was reviewing my IIS logs and noticed a single IP accessing the same file multiple times within seconds of each other. There are other IP addresses that do the same and cannot figure out why this is happening. This is on a closed network and thought maybe it was a Google Search indexing but they are not GSA's. One request lasted 6 mins and up to ~100 requests within that time period. Their browser agent are what a normal browser would be also. The servers are setup on a cluster with only two servers set to passive/active I believe.

  • 2 Contributors
  • 4 Replies
  • 307 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by lasitha2005d

Dani AI

Generated

Short summary of likely causes and quick checks (building on and ): repeated hits on the same PDF usually come from one of a few patterns — partial/ranged downloads (many 206 responses), multi-threaded download managers or previewers (Outlook/Explorer preview pane), antivirus/proxy/inspection appliances pulling the file, client retries because of slow responses, or duplicated logging when a cluster/load‑balancer replays or aggregates requests. The next steps are to prove which of those is happening and then fix it.

What to look for in the IIS W3C logs: check c-ip, cs-uri-stem, sc-status, sc-substatus, sc-win32-status, time-taken, sc-bytes/cs-bytes, cs(User-Agent) and cs(Referer). Important signals:

  • lots of sc-status = 206 (Partial Content) -> clients are requesting byte ranges (previewers or accelerators);
  • many 304 entries -> client caching behavior;
  • long time-taken values with retries -> client giving up and re-requesting;
  • differing timestamps for the same IP across both servers -> log consolidation or LB retries.

Quick LogParser queries to get started (adjust path/filename as needed):

LogParser.exe -i:W3C "SELECT c-ip AS ClientIP, cs-uri-stem AS URI, COUNT(*) AS Hits FROM 'C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log' WHERE cs-uri-stem LIKE '%file.pdf' GROUP BY c-ip, cs-uri-stem ORDER BY Hits DESC"
LogParser.exe -i:W3C "SELECT sc-status, COUNT(*) AS Count FROM 'C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log' WHERE cs-uri-stem LIKE '%file.pdf' GROUP BY sc-status ORDER BY Count DESC"

How to prove/correct the cause: capture one session with a packet trace or FREB to confirm a Range header or repeated GETs; check the user agent string and referrer to spot previewers; verify whether your cluster or log-aggregation is duplicating entries (compare server-specific logs by timestamp); add/verify Cache-Control/Expires and correct Content-Length/Content-Disposition headers so previews or repeat downloads are reduced. If the pattern looks like abusive traffic rather than legitimate clients, apply rate limits or an appliance/web application firewall. Test changes in a non-production environment first.

Recommended Answers

All 4 Replies

Member Avatar for lasitha2005d

Can you please describe the functionality of this file?

Member Avatar for cfwebdeveloper

The IIS log file logs all web activity, gets to images, html pages, whatever is needed to make the page view correctly. So if I had an html page with 2 images and 2 javascript files inside it, there will be a total of 5 calls therefore 5 logged events.

IP address of remote user
website url/location
when it was accessed etc

Member Avatar for cfwebdeveloper

If you are talking about the file they are accessing lol, it is a pdf file.

Member Avatar for lasitha2005d

Yes that is what exactly I was asking (not about the log file). So you are using an asp or asp.net page? Is there any possibility that the users use Outlook to download the file? It fires up such events. Can this pdf file be downloaded without errors? Have you correctly coded the Handles in the page? Is the download done with variable bits? What do you mean by a closed network? No one able to access the IIS from outside?
If non of these are giving errors:
May be a DDOS as well or an SQLI (since you do not run any indexers or robots to do the indexing).
Cannot say exactly what the cause without viewing logs. So I recommend to run the LogParser to identify and filter the threat.
a good article on this:
http://www.symantec.com/connect/articles/forensic-log-parsing-microsofts-logparser
You have to patch the adobe plugins and configure extensions to mitigate the attacks. Make sure there are no scripts or cookie scripts which are from outside (and no Trojans inside the server of course... )

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.