Re: Does it really take so long to get a bite?

[marc <marc () zounds net>]

On Mon, 9 Dec 2002, Anton A. Chuvakin wrote:

> And it got me thinking again of how it might depend upon the IP address.
> Would it not make sense to try to compare scans for the same service for
> various honeypots running on different IPs?  The question is how to make
> the comparison without disclosing the honeypot IP address?

        thats a good idea.  but it depends on how the -hackers- label the
different ip ranges.  this seems like information that should be gleened
from them, they must have lists of ips and ip ranges broken down by dialup
users/ dsl/ businesses/ schools/ etc.  perhaps some of these lists are
posted, or have been recovered from a compromised system?

marc bayerkohler
GCIA

> > Best, > --
>   Anton A. Chuvakin, Ph.D., GCIA
>      http://www.chuvakin.org
>    http://www.info-secure.org

"Bush should take up t'ai chi. He'd be a lot more relaxed and not so
invady."

- www.theonion.com

        ***                              ***
        *** ATTENTION CHRISTMAS SHOPPERS ***
        ***                              ***

To assist your xmas shopping, i now present (heh) marc's gift list:

        nothing

Please by me nothing for xmas.  If i cant convince you of that, make a
donation in my name to http://www.epic.org/ .  Or wrap an empty box and
fill it with love (love can be inserted into wrapped presents using a
syringe).  At the very least, dont spend more than two dollars (velcro,
potato chips, etc).  C'mon, you know im not appreciative anyway.