A: In a DoS attack, malicious software or agents send a large number of HTTP connection requests to a web server in an attempt to overload the server and make it unresponsive. IIS 7.0 doesn't include a feature to product against such attacks out of the box, but Microsoft recently released the beta for an extension called Dynamic IP Restrictions for IIS 7.0 to protect IIS 7.0 better against DoS attacks.
Microsoft provides the Dynamic IP Restrictions extension as a replacement for the IIS 7.0 IPv4 and Domain Restrictions feature. IPv4 and Domain Restrictions can be used to block requests from certain IP addresses and domain names in a static way—you have to explicitly define the IP address or domain name of a malicious machine or agent in the IIS console.
The Dynamic IP Restrictions extension can block incoming connections from certain IP addresses based on the number of concurrent requests—if an HTTP client makes many concurrent requests, that client's IP address is temporarily blocked. It can also block connections based on the number of incoming requests over a period—if an HTTP client makes many requests over a short period, that client's IP address is temporarily blocked.
The extension can block connections in these two ways without explicitly defining the IP address or domain name of the malicious machine in the IIS console. You simply set a connection limit and IIS will automatically block machines from making new connections if they exceed the limit.
The extension also allows you to define different deny actions. It's possible to specify what response to return to an HTTP client whose IP address is blocked. The module can return status codes 403 and 404 or just drop the HTTP connection and not return any response.
In addition to the new functions listed above, the Dynamic IP Restrictions extension also provides the functionality that exists in the legacy built-in IIS 7.0 IPv4 and Domain Restrictions.
As of the time of writing, the IIS 7.0 Dynamic IP Restrictions extensions are only available as beta code and it's not clear when a final version will be officially released. You can download an x86 version and a 64-bit version. See this IIS.net article for a more detailed description on how to configure the Dynamic IP Restrictions extension.
ISA Server 2006 includes a feature similar to what the Dynamic IP Restrictions extension offers called flood mitigation, which is available out of the box. Flood mitigation lets you define limits for the number of concurrent TCP connections and HTTP requests from a given IP address. For a more detailed description of this ISA Server 2006 feature and how to set it up, see this article and this article.
Related Reading:- Q: What is the easiest way to set up access control restrictions on the content of our intranet websites that are hosted on an IIS 7.0 web server?
- Q: Do I still need to install the URLscan tool on my Microsoft IIS 7.0 Web server to filter malicious data from incoming HTTP requests?
- Twitter Shut Down by DoS Attack
- How To Help Secure HTTP Data Without SSL
