> I see requests for login.cgi, etc. but that doesn't help me if there > were 10,000 in the last couple days-- I have no way of seeing > "failures" and no way of identifying failures for the users who I > know are being attacked.
Like I said, repeated hits on login.cgi from the same IP indicate repeated failures. If you have other (innocent) people failing enough to get their accounts logged out in the last couple of days. wouldn't you already know who these people are (and so could research their IPs for exclusion from your survey)? --Sandy ------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
