Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Ken Simpson
Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount the CPU benefits of that approach too quickly. I'm not sure where today's technology is in regards for caching the first 1 to 10kB of a sessiononce enough information is garnered to

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Frank Bulk - iNAME
PROTECTED] Cc: 'Christopher Morrow'; nanog@nanog.org Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Frank Bulk
, June 23, 2008 9:16 AM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] On Mon, Jun 23, 2008 at 6:01 PM, Frank Bulk - iNAME [EMAIL PROTECTED] wrote

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Joel Jaeggli
: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] snip dpi boxes from a number of vendors can do that sort of thing... whether they can do it fast enough to be inline with your compute cloud is another question

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Christopher Morrow
On Mon, Jun 23, 2008 at 10:31 PM, Frank Bulk - iNAME [EMAIL PROTECTED] wrote: Ken: Thanks for the info, but that still requires the domain owner to change their MX records. I was wondering if there was something that could literally be placed in the flow of traffic, like an FWSM in