|
||||||||||
If you want reactive, something else to consider is maybe is a NIDS that can "see" this behavior and act accordingly. Something like Bro http://bro- ids.org/ would be good for this. Or any other log parsing util that can email alert. Hmmm, maybe I should look at a port of m0n0wall that adds Bro NIDS for a reactive firewall...??? Chet Harvey Pitbull Technologies <http://www.pittech.com/> Protecting your Digital Assets 703.407.7311 Quoting Jeffrey Goldberg <jeffrey at goldmark dot org>: > [mailed and posted] > > On Oct 12, 2004, at 11:08 PM, C. Falconer wrote: > > > Then is this something that m0n0wall should address? > > > > IE, the internal IP 192.168.12.34 is spewing crap and fills up over > > 99% of > > the state table on its own. Maybe the firewall should drop that IP and > > somehow inform the admin? > > Yes and no. This sort of thing is addressed by an Intrusion Detection > System (IDS). m0n0wall doesn't have an IDS built in, but it can work > with them. All of these work by having the m0n0wall log actions onto > some other machine, This is under > > Diagnostics --> Logging --> Settings > Enable syslog'ing to remote syslog server. > > And also see > > http://m0n0.ch/wall/docbook/ref-logging.html > > The IDS will analyze those logs, and take various actions. > > I recently asked about IDSs and my summary was posted in > > > http://m0n0.ch/wall/list/? > action=show_msg&actionargs[]=97&actionargs[]=70 > > Also check Chet Harvey's follow-up with an additional tool in > > > http://m0n0.ch/wall/list/? > action=show_msg&actionargs[]=97&actionargs[]=77 > > I do not know whether traffic shaping could have actively dealt with > this problem > (I'm new to m0n0wall and sophisticated firewalls and have a great deal > to learn). But certainly implementing the kinds of rules for out-bound > traffic discussed in my summary would have prevented the problem. > > -j > > > -- > Jeffrey Goldberg http://www.goldmark.org/jeff/ > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch > For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch > > |