The tracked IP discussion,how to fill sentinel with junk

Sells PC To Pay For Divorce Joined: Posts: 5661

ok this is a discussion in whitch i hope get some clear answers so feel fee to hop in anytime..

Im watching the tracked ip of sentinel for a week now and im amazed at a few things...

First ,if a country,an ip,or range is banned,should sentinel still track visits?

Reason i ask is this..i just noticed belarus was visiting again.
But the whole country is banned,.
I saw it had 137 hits covered over 3 pages,all full of spam links.
And then they start with urls like l..

Quote:

modules.php?username=snoopy&user_password=Bassett

Following after that with the whole spamlist.
And now the bad part...
This visit (3 pages tracked junk) was 3 mb !
I copied all content into a textfile to see how big it was...
very frustrating.

So question is,if a country is banned,ip or whatever...why the tracking?
And with a litle imagination .....3mb ?....times whatever.....that realy puts some weight into your db.

So who can explain all this?...and why this is even possible..

Worker Joined: Nov 22, 2004 Posts: 208 Location: Italy

Not sure, but if a ip range is permanently banned and set to .htaccess, it should not even reach Sentinel.
on my site Turkey is banned, and ip range are on .htacess. If i try to get the site thru a turkish proxy I get my (not so) nice 403 Forbidden page and do not have the chance to see the website.
Guido

Posted: Mon May 08, 2006 7:37 am

well ,sentinel doesnt write ranges to the htaccess.
only individual added or caught ip's.

Posted: Mon May 08, 2006 9:08 am

I see..
My ranges were, manually added when i was running the previous sentinel version (2.1.2) that had no import feature..

Posted: Mon May 08, 2006 9:36 am

well and as we continue this topic belarus visited me again...leaving 1,2 mb of junk..

Posted: Mon May 08, 2006 11:52 am

time to put hands on .htaccess... LOL

Posted: Mon May 08, 2006 12:22 pm

well im still hoping bob or raven will reply here....
like to know whats going on...

Posted: Mon May 08, 2006 2:16 pm

And again....
Belarus visited and left spam behind of almost 700kb in sentinel tracked ip's.
Making that a total of 4.1 mb in less then 24 hours.
But guess what....the country is banned,the ip is banned (and in htaccess) but he still reaches my site...
This looks bad..

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

hitwalker wrote:

well ,sentinel doesnt write ranges to the htaccess.
only individual added or caught ip's.

Yes it does Smile

Posted: Tue May 09, 2006 10:34 am

I thought I had already explained this to you, but here goes again. Unless an IP or range is in .htaccess, it WILL hit your site. At that point NS traps it and performs whatever action you have set up in the blocker configuration. You can block entire countries or ranges.

Posted: Tue May 09, 2006 12:02 pm

Sentinel writes a full range into the htaccess ?
Since when is that..?
As far as i know it puts it only in the db,bot the htaccess file.
If so shouldnt it be in there?
Only ip's in there are the individual ones...
Maybe next time belarus comes along i can make a screenshot of its visit,dumping a few mb of junk...lol

Posted: Tue May 09, 2006 12:18 pm

Use the Blocked Range menu option. It should write the cidr to .htaccess.

Posted: Tue May 09, 2006 12:25 pm

I hoped i could give a more positive response raven but its not added to the htaccess...
And this is as long as i use sentinel...
it always showed the blocked ip's,these are the individual ones athat are put in by myself or by sentinel,so that means the writing works ..
But ranges ?...it never did that...
All start with deny from xxx.xxx.xxx.xxx
thats it.

Posted: Tue May 09, 2006 3:12 pm

Then just manually add it.

Posted: Tue May 09, 2006 3:14 pm

yeah i figured that would be the case..
And a sample in what format should that be done raven ?

Posted: Tue May 09, 2006 4:01 pm

deny from IP.IP.IP.IP/?

Where ? is the netmask to cover the range. For instance, if I wanted to ban all the IP's from IP.IP.IP.0 - IP.IP.IP.255, I would enter

Deny from IP.IP.IP.0/24

Posted: Tue May 09, 2006 4:03 pm

ah i see,i saw a few different formats on this and all were different..
ill give this a try..

Posted: Tue May 09, 2006 4:07 pm

That's the only way to do a range that crosses net masks. You could also use
Deny from IP.IP.IP. , in this case, but if you were not at an entire range but you crossed ranges, then you have to use the cidr /? method.

Posted: Wed Aug 02, 2006 7:17 am

I have verified in NS 2.5.0 that it is in fact writing to .htaccess the CIDRs corresponding to the range that you enter into the Blocked Ranges.