Re: scan log and subsequent response from the host's ISP

[sigipp () WELLA COM BR (sigipp () WELLA COM BR)]

Hi,

> if so to reason,in short time all of domains will be blocked. It's no way !
> We should make a dynamic mechanism for struggle with wreckers
> Do you have any ideas with ?

basically i already wrote about an idea about this. What about the following:

1. Accept a certain amount of scans.
2. If the amount of scans exceeds that, slow them down (put them in a lower
priority queue) until the amount of scans again matches the acceptable maximum.
3. On amount of scans beeing under some minimum thresold, put them back into the
normal priority queue. Or une step further to normality.

Should be no problem with newer Linux kernels. Cisco routers should have a
similar option.

Greetings
Siegfried Gipp