DDOS Attacks

[jraake]

They are using some sort of IP or mac spoofing program, so we have no way to determine who is doing this. If we can't record the correct IP of the attacker, I doubt the police would be able to do anything to help us. Our datacenter isn't being very helpful, either. They gave us a tool called IISIP (http://www.hdgreetings.com/other/Block-IP-IIS/) which seemed like a band-aid fix, at best. It blocked the IP of the attacker, but he changed his IP quick enough that it didn't matter.

We are thinking a high-quality firewall program would resolve the situation due to the type of attacks used. Unfortunately, we can not install one on the datacenter computer without losing access to it. The firewall would block remote desktop programs as soon as it is installed. The datacenter charges for software firewalls, so I would imagine they would not assist us, or just uninstall it if we locked ourselves out by installing one of our own firewall programs.

The decision has been made: we are moving our server back to residential bandwidth. The attacks are not using enough bandwidth to choke up anything faster than dialup internet. They are only exploiting a vulnerability in Windows Server 2003 or NIC drivers/hardware. It will be easier to maintain a server if we have physical access, plus cheaper per month if we pay for residential bandwidth.