Automatic Retaliation contra DoS

[sigipp () WELLA COM BR (sigipp () WELLA COM BR)]

Hi there,

I read the thread here about automatic retaliation in case of an attack
(automatically closing the firewall for this packets or the like) and that this
would make a nice DoS of its own. Well and then i had an idea:

Newer routers and new (future?) Linux kernels allow for some kind of priority
adjustment. So instead of simply closing the door for possibly malicious
packets, how about automatically throwing them into a lowest priority class?
This would in case of attack ensure 100% bandwith for legal packets while
allowing traffic for this "malicious" packets in case of false alarm (may be
slower). Also the detection routine could keep on checking (the malicios packets
are still arriving), and open the door again some time after the last packet of
that type. Would be somehow like "tarpitting" in mailers (in case of spam).

What do you professionals think about this?

Greetings
Siegfried Gipp