From owner-freebsd-security@FreeBSD.ORG Fri Apr 8 00:28:46 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0C82E16A4CE for ; Fri, 8 Apr 2005 00:28:46 +0000 (GMT) Received: from iron.allciti.net (iron.allciti.net [66.36.240.251]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6FFB243D45 for ; Fri, 8 Apr 2005 00:28:45 +0000 (GMT) (envelope-from jonaadam@nsu.nova.edu) Received: from localhost (localhost [127.0.0.1]) by iron.allciti.net (Postfix) with ESMTP id EAA1133C0E for ; Thu, 7 Apr 2005 20:29:46 -0400 (EDT) Received: from iron.allciti.net ([127.0.0.1]) by localhost (iron.allciti.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 70089-01 for ; Thu, 7 Apr 2005 20:29:44 -0400 (EDT) Received: from [192.168.1.4] (pcp09122379pcs.arlngt01.va.comcast.net [69.143.1.250]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by iron.allciti.net (Postfix) with ESMTP id EF56733C0D for ; Thu, 7 Apr 2005 20:29:16 -0400 (EDT) Message-ID: <4255D022.9040205@nsu.nova.edu> Date: Thu, 07 Apr 2005 20:28:18 -0400 From: Jon Adams User-Agent: Mozilla Thunderbird 0.9 (Windows/20041103) X-Accept-Language: rs1_4f1c29d98c6, rs2_246f19c3bce, rs3_81d0880ece MIME-Version: 1.0 To: freebsd-security@freebsd.org References: <200504061549.j36Fn8Y5082507@dc.cis.okstate.edu> <425406ED.5060400@withagen.nl> <4100.212.12.51.89.1112804356.squirrel@212.12.51.89> In-Reply-To: <4100.212.12.51.89.1112804356.squirrel@212.12.51.89> X-Enigmail-Version: 0.89.0.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at iron.allciti.net Subject: Re: What is this Very Stupid DOS Attack Script? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2005 00:28:46 -0000 Marian Hettwer wrote: >On Mi, 6.04.2005, 17:57, Willem Jan Withagen sagte: > > >>I've build some swatch-rules that after two of these hits, I dump >>the host into ifpw-deny space. >> >> >> >Aye. I thought about writing a script, doing the same like yours, too. >Could you post this script somewhere, so that I could add some >functionality or just use it ? > > > This is similar to what I do... except I just run a cronjob every so often... daily.. weekly.. what have you.. that will restart ipfw... probably there is a cleaner solution, but it does the job for me.... as far as cleaning out the dozens of IPs that get blocked for connecting to ports they shouldnt on my boxes