Re: router syn/syn-ack/ack alarming...
Michael Dillon <michael@memra.com> wrote:
This ratio detection doesn't need to shutdown anything, just syslog the fact so that admins have something in their logs like SYN/ACK RATIO 33:1 POSSIBLE HACKER ATTACK which will make them sit up and take notice.
Ah, you're an optimist. Most sysadmins would simply ignore whatever warnings they get as long as their internal users aren't complaining. And half of them wouldn't know what SYN/ACK ratio is. --vadim
On Wed, 18 Sep 1996, Vadim Antonov wrote:
This ratio detection doesn't need to shutdown anything, just syslog the fact so that admins have something in their logs like SYN/ACK RATIO 33:1 POSSIBLE HACKER ATTACK which will make them sit up and take notice.
Ah, you're an optimist.
*smile*
Most sysadmins would simply ignore whatever warnings they get as long as their internal users aren't complaining.
And half of them wouldn't know what SYN/ACK ratio is.
That's why the word "HACKER" has to be in the message. Over time we can get the word out that if you are having wierd problems you should make sure your router is pointed to a syslog host and then try grep HACKER /var/log/* Besides, some admins do browse through logs from time to time. I can't count how many times the Linuxisp mailing list has seen the question: I was looking through my logs and I see these messages about named and recvfrom failed... This is a rather innocuous problem caused by running an old beta version of BIND and doesn't generally cause any other symptoms. Maybe more people read logs than you think.... Michael Dillon - ISP & Internet Consulting Memra Software Inc. - Fax: +1-604-546-3049 http://www.memra.com - E-mail: michael@memra.com
In message <199609182057.NAA00879@quest.quake.net>, Vadim Antonov writes:
Michael Dillon <michael@memra.com> wrote:
This ratio detection doesn't need to shutdown anything, just syslog the fact so that admins have something in their logs like SYN/ACK RATIO 33:1 POSSIBLE HACKER ATTACK which will make them sit up and take notice.
Ah, you're an optimist.
Most sysadmins would simply ignore whatever warnings they get as long as their internal users aren't complaining.
And half of them wouldn't know what SYN/ACK ratio is.
--vadim
As long as the attacks were logged another provider (like their upstream provider for example) can come along and say "we traced the attack to your network, what sort of traps were logged". If they are totally clueless they can at least set up the traps and traplogs (possibly with some help) at that point and get the next attack. Curtis
participants (3)
-
Curtis Villamizar -
Michael Dillon -
Vadim Antonov