The Internet's Immune System

Christopher X. Candreva chris at
Wed Nov 12 18:36:51 UTC 2003

On Wed, 12 Nov 2003, David A. Ulevitch wrote:

> Automated techniques are the only thing that will stop it but is your
> idea "fast enough?"  I don't think so.  Relying on user reports is good
> for compromises and spambots but it won't do anything to stop CodeRed or
> Nimda.

True -- but I did say that this was a:
>> mechanism for various firewalls, intrusion detection systems, etc to talk
>> to each other to solve problems as quickly as possible.

> I don't think anything comes close to that today.

No, nothing does. This is a start. The example I gave of a command line tool
was just that. The idea is a framework that people and tools can use to
exchange information. I think the protocol itself -- the underlying system
-- is what will be important.  The command line program would be the second
part of "Rough consensus and working code". As with DNS and web servers, I
expect there would be many implementations, from inclusion in firewall
programs to CPAN modules.

Chris Candreva  -- chris at -- (914) 967-7816
WestNet Internet Services of Westchester

More information about the NANOG mailing list