Security Incidents mailing list archives

Re: IP Black list?


From: DLuff () IITSCDM COM AU (Luff, Darryl)
Date: Tue, 16 May 2000 10:03:43 +1000


Most of the scans I see come from dialup IP addresses. The machine doing the
scans may only be onlyine for a couple of hours. I think by the time you
blacklisted them they're probably offline. How do you un-blacklist them?

Darryl Luff.

On Thu, 11 May 2000, Stuart Staniford wrote:

I'm curious to know what folks think of the idea of a real-time
blacklist
for misbehaving IP addresses/blocks.  Some reputable person/organization
could maintain it, trusted folks known to the co-ordinator could
recommend
IPs to blockade, and then anyone who chose to could implement the list
into
router or firewall rules.



Current thread: