North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Arbor Networks DoS defense product

  • From: PJ
  • Date: Wed May 15 21:23:12 2002 
On Wed, 15 May 2002, Johannes B. Ullrich wrote:

> 
> > > Even more, I would hate to see the advocation of a hostile reaction to 
> > > what, so far, is not considered a crime.
> 
> I agree. Scanning is no crime. But blocking isn't a crime either.
> 
> 

Agreed.  But this blocking still will do no good.  My previous
questions still stand.  What about timing?  What about breaking up
segements of the network to be  scanned by different hosts?  How many
hits on the linemines constitute blocking?  Are you blocking hosts or
networks?  Either way, what about dynamic ips?  What about scans done
from different networks other than that which the supposed attacker is
originating from.  Universitys, unsecured wireless lans, etc.

PJ

-- 
Art is a lie which makes us realize the truth.
                -- Picasso