🚀 go-pugleaf

Winston Edmond wrote:
> 

> 
> First, let's make sure we're all talking about the same thing.  To me,
> "port scanning" means attempting connections to most or all of the likely
> service ports to discover which ones accept connections, not just trying
> to connect to one port.
> 
I don't care if someone is probing one port or a thousand.  My system
ignores a single source IP probing one port on ONE target system
(determining intent here is unreliable).  However, if someone probes
even one port (e.g. Sub7) on 3 different sensors...that will get
escalated.  You can call single port "sweeps" what you want (I do call
it port scanning), the bottom line THAT probe pattern is 99.9%
indicative of unfriendly activity.  Yeah, maybe someone made an innocent
mistake...fine apologize when the Abuse dept. calls you and move on.


Agree we don't need laws to ban scanning, the ISPs policy to terminate
port scanners sufices for my needs.


> Lastly, how exactly are you going to define "authorized"?  If I set up an
> SMTP server on port 25, who's "authorized" to connect to it? 

YOU define who is authorized.  If you put up a firewall which blocks
port 25, then you have established a policy that 25 is not authorized. 
If you receive unsolicited scans against port 25, then report it.
If you block port 25 AND have your public mail server behind this
firewall, then you are a perplexing individual indeed.

If you leave port 25 open, then at your option you are free to (or not
to) implement an intrusion detection/spam detection system which detects
and reports what YOU define as unfriendly activity.

All of the above is hard to do individually because you have limited
context information to conclusively identify unfriendly activity...hence
the whole reason for 'collective awareness' systems such as
myNetWatchman (security aggregation) and SpamCop (spam aggregation)
http://spamcop.net .

I actually DON'T advocate escalating every port probe activity an
individual user sees...our system statistics indicate that 80-90% of
attack data can't conclusively identify an attack.  

See: http://www.mynetwatchman.com/listincidentsummary.asp

I do advocate that anyone who wants to forward ALL attack to an
aggregation filter.  This is a responsible way to be proactive without
risking crying wolf all the time.

lb.
-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?