On Fri, Mar 10, 2000 at 09:43:40AM -0700,
sinck@corp.quepasa.com wrote:
> And, in the FWIW department, I think 24.0.0.0/8 will block more than
> @home, which the last report on PLUG I saw was only 24.1.x.x -
> 24.14.x.x .
Yeah it also blocks speedchoice, maybe others. But the trouble is I've
never seen a definitive answer on what their subnet really is. This guy
got scanned from a 24.0 address so evidently it goes beyond 24.1 - 24.14.
>
> \_ Actually, they may wise up and start running those scans from a
> \_ nameserver. (It's what I would do.) Then you would have to allow DNS
> \_ through while blocking all other ports from that IP, instead of blanket
> \_ denying the IP.
>
> What I'm more concerened with is if they don't scan from 24.x.....
Yep. I would hope they don't get that paranoid. Anyway there's still
nothing I could do AFAIK to prevent a passive detection method (if they
simply snoop all the packets and look for tcp packets going through to
port 80 and getting a reply). But when I was on the unix@home mailing
list (now defunct AFAICT) there were a lot of people reporting that they
got portscanned. So I think that is their usual detection method.
--
_______ http://www.bigfoot.com/~ecloud
(_ | |_) ecloud@bigfoot.com finger rutledge@cx47646-a.phnx1.az.home.com
__) | | \__________________________________________________________________
Get money for spare CPU cycles at http://www.ProcessTree.com/?sponsor=5903
(text/plain)