Arbor Networks DoS defense product

Thu May 16 01:19:00 UTC 2002

On Wed, 15 May 2002, Johannes B. Ullrich wrote:

> 
> > > Even more, I would hate to see the advocation of a hostile reaction to 
> > > what, so far, is not considered a crime.
> 
> I agree. Scanning is no crime. But blocking isn't a crime either.
> 
> 

Agreed.  But this blocking still will do no good.  My previous
questions still stand.  What about timing?  What about breaking up
segements of the network to be  scanned by different hosts?  How many
hits on the linemines constitute blocking?  Are you blocking hosts or
networks?  Either way, what about dynamic ips?  What about scans done
from different networks other than that which the supposed attacker is
originating from.  Universitys, unsecured wireless lans, etc.

PJ

-- 
Art is a lie which makes us realize the truth.
                -- Picasso