Forum OpenACS Q&A: Response to How to bypass rp_filter: Nimba Worm
2: Response to How to bypass rp_filter: Nimba Worm (response to 1)
Posted by Jerry Asher on 09/19/01 03:56 AM
I can't answer your question, but I do want to thank you for the filter. It's completely compatible with an nsvhr master reverse proxy, and it appears to be helpful in keeping nimda in check.
There are some other nimda requests that I'm trapping /_*, /msadc/*, /MSADC/*, /c/* /d/*, and while I understand why you try to direct the attack back against the host, I think channeling it to http://www.microsoft.com is equally reasonable.