I use ddos software on my linux server to prevent a ddos attack. Now I am recieving emails every few days about an ip(s) banned on the server, the software is configured to block the ip after 150 or 160 connections and I just don't believe that these are actual attacks on my server. I know that ISP's like AOL will put all their users through a proxy server so it could be all of these people from the same ISP on my server but I don't have that many accounts and I can't imagine 150 people on my server, all from the same ISP right now as I'm not so big.
Can anybody explain to me why these ip's could have so many connections?
