Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 12:29:02 +, Walter Hurry wrote: More out of curiosity than paranoia, I have carried out a small geographical analysis of rejected intrusion attempts at my home router snip Sorry for the formatting, but I think it's just about legible, so I won't pollute the list by

Re: Intrusion Statistics

2011-08-05 Thread Camaleón
On Fri, 05 Aug 2011 12:29:02 +, Walter Hurry wrote: More out of curiosity than paranoia, I have carried out a small geographical analysis of rejected intrusion attempts at my home router (this consists of dropped TCP packets and ICMP (ping) requests). Interesting stats, indeed... Over

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 14:34:42 +, Camaleón wrote: China|483 United Kingdom | 455 Russian Federation |167 Germany | 74 Spain| 68 Hey, I'm there (Spain) :-P My e-mail and web

Re: Intrusion Statistics

2011-08-05 Thread Camaleón
On Fri, 05 Aug 2011 15:13:02 +, Walter Hurry wrote: On Fri, 05 Aug 2011 14:34:42 +, Camaleón wrote: (...) I am curious as to why the United Kingdom should figure so highly. It is my own location, which is undoubtedly relevant, but I don't really understand the reason. The Internet

Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
1. How are you figuring the source country? If you're looking at the ip in the handshake and comparing this to a db of ip / country, you're only looking at half of the story. If you're a bit smarter and have a list of border routers that country owns and are looking at that for the source country,

Re: Intrusion Statistics

2011-08-05 Thread John Hasler
Walter Hurry writes: Am I to infer then, that it is likely than a fair proportion of these do not emanate directly from the hacker, but from a bot on an innocent bystander's box which has been compromised? A fair proportion as in 99+%. -- John Hasler -- To UNSUBSCRIBE, email to

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 11:59:51 -0400, shawn wilson wrote: 1. How are you figuring the source country? If you're looking at the ip in the handshake and comparing this to a db of ip / country, you're only looking at half of the story. If you're a bit smarter and have a list of border routers that

Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
On Fri, Aug 5, 2011 at 13:03, Walter Hurry walterhu...@lavabit.com wrote: On Fri, 05 Aug 2011 11:59:51 -0400, shawn wilson wrote: 1. How are you figuring the source country? If you're looking at the ip in the handshake and comparing this to a db of ip / country, you're only looking at half of

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 13:31:37 -0400, shawn wilson wrote: imo, meaningless Of that I have little doubt. As I said, I was just curious. By the way, my router is just a cheap home DLink unit, not anything running any special software. So I don't set the rules - just tell it as part of the normal

Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
On Aug 5, 2011 12:50 PM, Walter Hurry walterhu...@lavabit.com wrote: On Fri, 05 Aug 2011 13:31:37 -0400, shawn wilson wrote: imo, meaningless Of that I have little doubt. As I said, I was just curious. By the way, my router is just a cheap home DLink unit, not anything running any special