We are having extensive (thousands per minute) GET /wpad.dat HTTP/1.1 requests at our Linux server, causing traffic problems and slowing down access to the websites we host.

What does it stand for and how to prevent it?



It's what browsers will search for if you have 'auto-detect proxy settings' enabled.

Thousands per minute does sounds a little on the high side. How big is your network? It may be an intentional DoS attack.

If it's the server unable to keep up with the connection requests (as opposed to traffic congestion), it may help to configure your firewall to drop such requests.

If you control all machines on the network, set their browsers to not search for a proxy, either by specifying no proxy, a PAC file or a specific proxy address.

It may also be worth taking a look here.

  • It's a cloud based web hosting service with hundreds of active web sites. We have stopped the requests in our firewall from coming through and it is not affecting the servers functionality in any way. But the intense requests are still coming in and probably causing congestion in our outgoing traffic. – spielbrot May 24 '13 at 11:20
  • We have temporarly set up an automatic script adding the IP-numbers from those requests to a blocking list. It helps, but isn't really a good sollution. – spielbrot May 24 '13 at 14:23
  • @spielbrot You may find the answers here to be of interest. – Bob May 24 '13 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy