Ip monitor list

[erayd]

I still use the following strategy. There are always a few IPs on the blocklist as a result - at the moment of this post, there are currently four. That’s on the lower end of what is typical for my server.

What is a reasonable limit?

I personally add anything that hits me with more than 1000 reqs/sec to a 24hr blocklist at my network edge (prevents things like the fortinet bursters sending problematic levels of traffic as far as my server, although I do still save the blocked requests for later analysis). They get a 3000 request burst before the policy is applied. Anything slower than that, I don’t worry about. If reflection abuse becomes a significant problem, then I will revise that limit downwards. My main rationale beh…