Security Incidents mailing list archives

Re: scan log and subsequent response from the host's ISP


From: Michal.Nazarewicz () SAYDK CO UK (Michal.Nazarewicz () SAYDK CO UK)
Date: Mon, 10 Jul 2000 12:58:05 +0200


Saturday, Pauel Loshkin wrote:

PL>We should make a dynamic mechanism for struggle with wreckers
PL>Do you have any ideas with ?

Such list *MAY* be a good thing, with some cautions:

1. You can't block all the "rogue" providers on the list -- there's a big
chance, that you'll find your ISP there, or your customer -- it's not a
good thing in business, to disable access to your customer -- isn't it?

2. There should be a way to apply only a part of such list to our system
-- eg. providers from foreign country, but not from my country (see no. 1)

3. There should be a way to 'score' each of these 'rogue' providers
individually -- for example, to disable only hopeless ones, not these who
can sometimes react.

Having such a system is not a simple thing. It can do more damages than
good things, anyway. All of it depends on how we would use/create this.
Any suggestions? Welcome.

--
Michal 'CeFeK' Nazarewicz   / CAOL, DK GROUP SYSADMIN ^ NETADMIN         B
ICQ 47171266 / +48 (601) CEFEK 0 / http://www.dkgroup.pl/index.html      O
mailto:cefek at saydk dot co dot uk / MN4735-RIPE / Pengiun #164007      F
The best way to accelerate a Macintoy is 9.8 meters per second, squared. H



Current thread: