Re: DoS Local machines

[tee () DIRECTO CL (TeeSPy)]

> > I am a network admin that is willing to take the next step in preventing
> > machines from attacking other machines on my network.  Let's say that IDS
> > such as LIDS detects an attack, I am planning on an offensive attack upon
> > the attacker (provided that the 'attacker' is an ip not coming from
> > outside of my router). I have control of over 2500 machines in several
> I kinda like your idea, but if an attack was automatically triggered,
> couldn't I, for example, start and attack to IP1, but attacking you [IP2]
> spoofing IP1, so my 'attack' would be completely anonymous? IP2 would be
> really attacking IP1.
>
> see my point or is it a very stupid idea?

Somebody has already thought about it.
See http://packetstorm.securify.com/papers/IDS/ACF48CB.doc

Cheers-

TeeSPy
CDLR / Security Team - www.cdlr.org

-----------------------------TeeSPy------------------------------