OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: scan log and subsequent response from the host's ISP
From: sigippWELLA.COM.BR
Date: Mon Jul 10 2000 - 07:56:40 CDT

Hi,

> if so to reason,in short time all of domains will be blocked. It's no way !
> We should make a dynamic mechanism for struggle with wreckers
> Do you have any ideas with ?

basically i already wrote about an idea about this. What about the following:

1. Accept a certain amount of scans.
2. If the amount of scans exceeds that, slow them down (put them in a lower
priority queue) until the amount of scans again matches the acceptable maximum.
3. On amount of scans beeing under some minimum thresold, put them back into the
normal priority queue. Or une step further to normality.

Should be no problem with newer Linux kernels. Cisco routers should have a
similar option.

Greetings
Siegfried Gipp