Wmi Event for Denial of Service attack

[sakthikumarb]

Hi,

There is any wmi event for deniel of service attack.if not,there is any other procedure to get a event for Denial of Service attack .

Thanks in advance,

Regards,
Sakthi

[cloud255]

I think your best bet here is to get some security package, the attacks range from simply to highly advanced and it has taken several years of work in the security sector to develop counter measures, and still attacks occur.

And by the way if you want to do it yourself, look into network traffic, this is the trademark of a DOS/DDOS attack. your server is just bombarded with requests, you would then need to block the IPs from which the attack is originating. this is more advanced than a simple event being raised...

[PRR]

Hi,

There is any wmi event for deniel of service attack.if not,there is any other procedure to get a event for Denial of Service attack .

Thanks in advance,

Regards,
Sakthi

Can you plz clarify more?
if you are asking whether WMI event can lead to denial of service attack? yes... if polling for wmi events occur very frequently...as far as "dos" is concerned its not a single event ...to recognize dos probably takes some AI too...

[sakthikumarb]

Can you plz clarify more?
if you are asking whether WMI event can lead to denial of service attack? yes... if polling for wmi events occur very frequently...as far as "dos" is concerned its not a single event ...to recognize dos probably takes some AI too...

sorry, i'm not asking wmi event lead to a denial of service attack....my query is..if denial of service happen in some system..then how can i notify (by sending events) to my server..that "dos" is happen in host on this port.... there is any wmi or non-wmi mechanism available...

[PRR]

sorry, i'm not asking wmi event lead to a denial of service attack....my query is..if denial of service happen in some system..then how can i notify (by sending events) to my server..that "dos" is happen in host on this port.... there is any wmi or non-wmi mechanism available...

As cloud255 said you need to get some 3rd party security software...for your server ....or at the very basic check if your server is bombarded with requests, then block the IPs from which the attack is originating... though dos recognizing and response ( action such as notifying admin n shuttin down server temporarily)is in itself a very large area...
It will be diffcult to do it in a restricted time frame and limited resources .. Look for security software...specific to DOS..

"any wmi or non-wmi mechanism available"
As far as i know there is no wmi mechanish available for this...
quote from msdn
"WMI uses the Common Information Model (CIM) industry standard to represent systems, applications, networks, devices, and other managed components. CIM is developed and maintained by the Distributed Management Task Force"
WMI