nanog mailing list archives
Re: router syn/syn-ack/ack alarming...
From: Vadim Antonov <avg () quake net>
Date: Wed, 18 Sep 1996 13:57:52 -0700
Michael Dillon <michael () memra com> wrote:
This ratio detection doesn't need to shutdown anything, just syslog the fact so that admins have something in their logs like SYN/ACK RATIO 33:1 POSSIBLE HACKER ATTACK which will make them sit up and take notice.
Ah, you're an optimist. Most sysadmins would simply ignore whatever warnings they get as long as their internal users aren't complaining. And half of them wouldn't know what SYN/ACK ratio is. --vadim - - - - - - - - - - - - - - - - -
Current thread:
- Re: router syn/syn-ack/ack alarming..., (continued)
- Re: router syn/syn-ack/ack alarming... Michael Dillon (Sep 18)
- Re: router syn/syn-ack/ack alarming... Guy T Almes (Sep 18)
- Re: router syn/syn-ack/ack alarming... Justin W. Newton (Sep 18)
- Re: router syn/syn-ack/ack alarming... Vern Paxson (Sep 18)
- Re: router syn/syn-ack/ack alarming... Michael Dillon (Sep 18)
- Re: router syn/syn-ack/ack alarming... Larry J. Plato (Sep 18)
- Re: router syn/syn-ack/ack alarming... George Herbert (Sep 18)
- Re: router syn/syn-ack/ack alarming... Mark A. Fullmer (Sep 18)
- Re: router syn/syn-ack/ack alarming... Michael Dillon (Sep 18)
- Re: router syn/syn-ack/ack alarming... Michael Dillon (Sep 18)
- Re: router syn/syn-ack/ack alarming... Michael Dillon (Sep 18)
- Re: router syn/syn-ack/ack alarming... Curtis Villamizar (Sep 18)
- Re: router syn/syn-ack/ack alarming... George Herbert (Sep 18)