From owner-freebsd-security  Mon Jan 24  9:30:31 2000
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2])
	by hub.freebsd.org (Postfix) with ESMTP id B48D614DAB
	for <security@FreeBSD.ORG>; Mon, 24 Jan 2000 09:30:25 -0800 (PST)
	(envelope-from brett@lariat.org)
Received: from workhorse (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2])
	by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id KAA25086;
	Mon, 24 Jan 2000 10:30:13 -0700 (MST)
Message-Id: <4.2.2.20000124102833.01dd02d0@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 
Date: Mon, 24 Jan 2000 10:30:12 -0700
To: Steve Mickeler <steve@neptune.on.ca>,
	"mr. t" <n8412060@cc.wwu.edu>
From: Brett Glass <brett@lariat.org>
Subject: Re: attack notification via email
Cc: security@FreeBSD.ORG
In-Reply-To: <Pine.LNX.3.96.1000124092523.28150B-100000@triton.neptune.o
 n.ca>
References: <Pine.SOL.4.05.10001212327040.29499-100000@titan.cc.wwu.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

At 07:32 AM 1/24/2000 , Steve Mickeler wrote:

>The first is PortSentry which is designed to detect and respond to port
>scans against a target host in real-time.

The Web page claims that it only detects stealth scans under Linux,
alas. It apparently will detect scans that involve opening a normal
socket under FreeBSD, but most experienced crackers won't do
this -- too conspicuous.

--Brett



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message