Right way to gum up CodeRed (I think)
19 Aug
2001
19 Aug
'01
1:05 p.m.
Guys- There is a neat 'tarpit' package called LaBrea. It runs off a single boot floppy (Trinux, I believe), supports vifs, and is verrrry sticky on incoming TCP/IP connections. Install it on an old clunker machine you've got lying around collecting dust. Give it some unassigned (and unadvertised) IP addresses in your block and let it cling for up to 24 minutes on each connection attempt. Slows CodeRed right down, with a minimum of bandwidth wasted. IMHO it sounds much better than 50MB 'default.ida' files. Plus, it does the same to script kiddies trying to run a port scan. David Leonard ShaysNet
8527
Age (days ago)
8528
Last active (days ago)
1 comments
2 participants
participants (2)
-
Dan Hollis
-
M. David Leonard