On Wed, Oct 15, 2008 at 10:36 PM, <[EMAIL PROTECTED]> wrote: > It's all packaged with clark connect and seems to be working ok. It's got > preaty flash stuff that shows me I've got over 80k hits from one IP alone in > the last day. > > I've emailed [EMAIL PROTECTED] to see if they can block the > traffic.
Just blackhole all the traffic from that IP, and indeed from pretty much any pwned attacker you see, if you care. Actually, if you aren't running any services on your external interface, ignore it. Only monitor services you are actually running. In theory you are still paying to receive their SYN packets, but in practice if you're both on TCL then they don't charge for it, especially if it's on the local loop. Anyway, they can hammer away for hours with just SYN packets, and it'll only add up to a couple of page loads of stuff.co.nz ... :-) -jim
