How do you fight an attack in progress?

Grigorof, Adrian (agrigoromobility.com)
Fri, 19 Sep 1997 11:21:45 -0400

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: MSITMI02.XZ46G8eds.com: "Re: Proxies and CHAP"
• Previous message: Chris Booth: "Re: Changing Firewall-Wizards to a Daily Digest Format"
• Next in thread: Marcus J. Ranum: "Re: How do you fight an attack in progress?"
• Reply: Marcus J. Ranum: "Re: How do you fight an attack in progress?"
• Reply: Erik Van Riper: "Re: How do you fight an attack in progress?"
• Reply: Paul Ferguson: "Re: How do you fight an attack in progress?"
• Reply: Neil Readwin: "Re: How do you fight an attack in progress?"
• Reply: Andy Howard: "Re: How do you fight an attack in progress?"
• Reply: Mark Coleman: "Re: How do you fight an attack in progress?"

Hello everybody,

As the subject line suggests, I'm interested to find how do you fight an
attack in progress. Let's say that your firewall keeps sending you
messages about a scan in progress or something similar. You have the IP
address. You look-up the domain, call the administrator that you found
for that domain and get just a voice mail or a "number disconnected"
message. Worst case: there is no domain associated with that IP address.
The firewall keeps paging you and your adrenaline level grows
exponentially.

So, how do you Wizards deal with such situations?

Adrian
Apprentice Wizard

• Next message: MSITMI02.XZ46G8eds.com: "Re: Proxies and CHAP"
• Previous message: Chris Booth: "Re: Changing Firewall-Wizards to a Daily Digest Format"
• Next in thread: Marcus J. Ranum: "Re: How do you fight an attack in progress?"
• Reply: Marcus J. Ranum: "Re: How do you fight an attack in progress?"
• Reply: Erik Van Riper: "Re: How do you fight an attack in progress?"
• Reply: Paul Ferguson: "Re: How do you fight an attack in progress?"
• Reply: Neil Readwin: "Re: How do you fight an attack in progress?"
• Reply: Andy Howard: "Re: How do you fight an attack in progress?"
• Reply: Mark Coleman: "Re: How do you fight an attack in progress?"

This archive was generated by hypermail 2.0b3 on Sat Jul 17 1999 - 07:08:57 CDT