[186631] in North American Network Operators' Group
Re: de-peering for security sake
daemon@ATHENA.MIT.EDU (Baldur Norddahl)
Sat Dec 26 10:21:19 2015
X-Original-To: nanog@nanog.org
In-Reply-To: <567EADA8.2090307@satchell.net>
Date: Sat, 26 Dec 2015 16:19:15 +0100
From: Baldur Norddahl <baldur.norddahl@gmail.com>
To: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 26 December 2015 at 16:09, Stephen Satchell <list@satchell.net> wrote:
> On 12/26/2015 06:19 AM, Mike Hammett wrote:
>
>> How much is an acceptable standard to the community? Individual /32s
>> ( or /64s)? Some tipping point where 50% of a /24 (or whatever it's
>> IPv6 equivalent would be) has made your naughty list that you block
>> the whole prefix?
>>
>
> My gauge is volume of obnoxious traffic. When I get lots of SSH probes
> from a /32, I block the /32. When I get lots of SSH probes across a range
> of a /24, I block the /24.
>
Do you people have nothing better to do than scan firewall log files and
insert rules to block stuff that was already blocked by default?
Hint: if ssh probes spams your log then move your ssh service to a non
standard port.
Regards,
Baldur
