18 Sep
2001
18 Sep
'01
1:45 p.m.
On Tue, Sep 18, 2001 at 09:51:43AM -0700, Joseph McDonald wrote:
One idea: Once a probe is sent, the prober's IP# is stored in a hash (perhaps in shared memory or a mmap'd file that all children can share) and new connections from that IP are no longer accepted.
Better yet, set a host route for them with next hop set to 127.0.0.1. That assumes that you don't want infected hosts talking to your host at all. -- Jeff Gehlbach, Concord Communications <jgehlbach@concord.com> Senior Professional Services Consultant, Atlanta ph. 770.384.0184 fax 770.384.0183