Educause Security Discussion mailing list archives

Re: WPAD DNS floods


From: Jeff Kell <jeff-kell () UTC EDU>
Date: Wed, 16 Jan 2008 13:20:04 -0500

Gary Flynn wrote:

Anyone seen floods to wpad.university.edu and tracked
the problem down? We've seen it intermittently in the
past but not to a significant degree but we just experienced
substantial performance impact on our DNS servers from one
student machine. We've got the machine in hand and are
investigating but I thought I'd ask.

Yes, that's Windows Proxy Automatic Detection.  If you have a captive
portal type of application, it will likewise be flooded with requests to
GET wpad.dat.

Vista must die :-)

Jeff

Current thread: