[42709] in North American Network Operators' Group
Re: Worm probes
daemon@ATHENA.MIT.EDU (Brett Frankenberger)
Wed Sep 19 11:48:48 2001
Message-Id: <200109191454.JAA15844@rbfux.rbfnet.com>
To: mdl@equinox.shaysnet.com (M. David Leonard)
Date: Wed, 19 Sep 2001 09:54:00 -0500 (CDT)
From: "Brett Frankenberger" <rbf@rbfnet.com>
Cc: iljitsch@muada.com (Iljitsch van Beijnum), nanog@merit.edu
In-Reply-To: <Pine.3.89.10109191017.A25634-0100000@equinox.shaysnet.com> from "M. David Leonard" at Sep 19, 2001 11:02:52 AM
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
>
> should make these attacks slow down like they're wading through
> molasses. Now, if most or all ISPs installed tarpits like this it would
> seriously reduce the virulence of the attacks.
Actually, if most or all ISPs installed tarpits like this, it would
lead exploit developers to implement timeouts that would quickly kill
off connection attempts that were progressing at the expected rate.
-- Brett
