Turn on the following events: IRC_Join IRC_Join_Attempt IRC_Msg
These events are port independent. Monitor these events to see if any legitimate IRC traffic is on the network. If not, set these to block. Otherwise, tune them to your environment. Our MSS organization has used these successfully. There are other IRC events that you may wish to investigate. Good luck. -jason -----Original Message----- From: [EMAIL PROTECTED] On Behalf Of McLean, Michael R Sent: Thursday, March 16, 2006 12:35 PM To: [EMAIL PROTECTED] Subject: [ISSForum] Blocking bots G400 Anyone have any experience on this, other than just filter the IP address? MRM _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
