nanog mailing list archives
RE: Auto ACL blocker
From: "Mark Scholten" <mark () streamservice nl>
Date: Wed, 19 Jan 2011 00:35:15 +0100
From: Larry Smith [mailto:lesmith () ecsis net] Sent: Tuesday, January 18, 2011 8:32 PM On Tue January 18 2011 13:12, Brian R. Watters wrote:We are looking for the following solution. Honey pot that collects attacks against SSH/FTP and so on Said attacks are then sent to a master ACL on a edge Cisco router toblockall traffic from these offenders .. Of course we would require a master whitelist as well as to not beblockedfrom our own networks. Any current solutions or ideas ??Private BGP session with Zebra or Quagga on a linux box adding the selected IP to a null route.
As we currently do it by putting new rules automatically in firewalls (iptables) it should be easy to change it a little bit I think. After the change it should be able to put rules in Zebra/Quagga (or something similar based on Linux/Unix). As long as telnet access is available it should also be doable to put it automatically in routers without the need of a setup with BGP and Zebra/Quagga. We are currently looking for ways to increase the list with "abusive" systems to block. If someone wants to work together with us on increasing the mentioned options feel free to contact me offlist. How we get the data currently (from multiple sources) or how the process currently work isn't something I can currently mention here (at least not the details). Regards, Mark
Current thread:
- Auto ACL blocker Brian R. Watters (Jan 18)
- RE: Auto ACL blocker Guerra, Ruben (Jan 18)
- Re: Auto ACL blocker Roland Dobbins (Jan 18)
- Re: Auto ACL blocker Greg Whynott (Jan 18)
- Re: Auto ACL blocker Larry Smith (Jan 18)
- RE: Auto ACL blocker Mark Scholten (Jan 18)
- RE: Auto ACL blocker Thomas Magill (Jan 18)
- RE: Auto ACL blocker Ronald Bonica (Jan 18)
- Re: Auto ACL blocker Brian R. Watters (Jan 18)
- Re: Auto ACL blocker Joe Blanchard (Jan 18)
- Re: Auto ACL blocker Brian R. Watters (Jan 18)
- RE: Auto ACL blocker Thomas Magill (Jan 18)
- Re: Auto ACL blocker ML (Jan 18)
- RE: Auto ACL blocker Thomas Magill (Jan 18)
- RE: Auto ACL blocker Thomas Magill (Jan 18)
- Re: Auto ACL blocker ML (Jan 18)
- <Possible follow-ups>
- Re: Auto ACL blocker Brian R. Watters (Jan 18)