Re: Port Scan Flood

["Aaron D. Turner" <aturner pobox com>]

-----BEGIN PGP SIGNED MESSAGE-----


There's also a Strobe protection patch for the 2.0.36 kernel that will
protect you.  Very cool actually. :-)


- -- 
Aaron Turner           | Either which way, one half dozen or another. 
aturner pobox com      | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed.  Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80  59 6E 60 BF 45 1B 20 E8


On Thu, 18 Feb 1999, James Michael Keller wrote:

> hUnTeR wrote:
> > 
> > I just spent the past hour fighting a what i call a port scan flood. By
> > this i mean my server was sererely port scanned (all possible ports)
> > from multiple IPs (like one IP per port being scanned). Now i have NEVER
> > heard of a protection from this sort of attack, but does anyone have any
> > idea how to prevent this? I have tcp_wrappers running, sentry, tripwire,
> > have reduced my services to only those required. But i have never seen
> > or heard of sentry being able to STOP such an attack and block, let
> > alone drop the route to ALL those IPs.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNsyEszM3jpXy1kJtAQGoGQQAk1aCdSWNy+hEkSFHYZ4vWs/2j6BCmLio
SS+a9SfXOBrZb3MbBYOgxcOs/Yy94hCM+dr5Ref3ps/i/22B8KHU+kbAkpn8oFt+
d9GW/pRUrp/p+WhA4BCfuPcPA+vtTB3nG0r/NtlII3p23hJU588lJuPpt3KutlQJ
s4BICHC+5Ss=
=hc0K
-----END PGP SIGNATURE-----