RE: Scanning hosts connecting to a linuxbox.

["Dragos Ruiu" <dr () v-wave com>]

It seems to me that having an autorespond scanner creates
a lot of potential DoS and smurflike looping problems.  How about
feeding the addresses in question to a third host - the 
security server, which does the scanning.  A couple of benefits
is that it tips off your hand less to the other side,
and having scan requests queue up at a common server
avoids network flooding with map traffic.

I toyed with the idea of automatic scans a couple of months
back, and as I brought two of them up my network bogged
and both hosts started sucking wind, mapping each other.
I kinda left it alone after that... 

cheers,
--dr