Topic: Pls help - seven days of port scans/DOS

[BoZz]

There are some bad dudes around so don't try to get them back? I own and run a ISP in Australia and had a hack attack a few years ago. we track him down and trashed his PC    A day later started 3 months of DOS attack that all but used our 45mb link    Nearly sent me to the wall   Best to let them play and go away so you can live to surf another day  

Brett

[Brave Dave]

Why don't you get on to your upstream providor

a few years back I had someone going crazy with DNS on my Telstra OnRamp - and it was pay by the megabyte - 19c

I got onto telstra and they blocked it upstream

[drywalldude]

I found Ipcop to be easy to install and effective on my network. It is more functional as a gateway firewall than the contribs server and it takes the load off my web/mail server heres some shots :

http://www.ericswww.com/rpm_bay/ipcop_contribs.PNG
http://www.ericswww.com/rpm_bay/ipcop_graph.PNG
http://www.ericswww.com/rpm_bay/ipcopnetwork.png

[drywalldude]

The ipcop setup is on a old ausus 400mhz AMD with 4 nics(wifi support on blue!! ) also if you look in the addons there is something about intergration with Dans Gaurdian that may assist with your problem.

Ah finaly found something to do with that old piece of junk in the closet.

[CharlieBrady]

This will black list people who port scan or violet snort rules and ban/drop their ip for 5 or so days.

Note that because source IP addresses are forgeable, this allows  a pretty easy DoS. Any of your server's real customers can be black listed, just by an attacker faking a scan apparently coming from their IP address.

[SMEmike]

Have a look at myNetWatchman.com, they collect log information from firewalls around the Internet and automatically notify ISPs whose members are sourcing excessive port scans.

I did find this older howto to integrate the myNetWatchman client into SME 5.2.  Don't know if it is still valid.

- http://www.wellsi.com/sme/mnwclient/mnwclient.html

The idea is a great one, but I have not yet used myself.

SMEmike.