Security Intelligence [Was: Re: Netblock reassigned from Chile to US ISP...]

2008-12-13 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sat, Dec 13, 2008 at 12:22 AM, James Hess mysi...@gmail.com wrote: An in-depth strategy with hundreds or thousands of factors examined results in a smaller (but still present) possibility of the filter/detector being fooled. IP-based

Re: Security Intelligence [Was: Re: Netblock reassigned from Chile to US ISP...]

2008-12-13 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Not in the habit of responding to my e-mail, but... On Sat, Dec 13, 2008 at 12:29 AM, Paul Ferguson fergdawgs...@gmail.com wrote: On Sat, Dec 13, 2008 at 12:22 AM, James Hess mysi...@gmail.com wrote: An in-depth strategy with hundreds or

Re: Security Intelligence [Was: Re: Netblock reassigned from Chile to US ISP...]

2008-12-13 Thread Randy Bush
If folks think that people are not doing massive correlation of criminal activity on the Internet, they would be mistaken. engineers judge by the results. and, unfortunately, we can read them in the ny times. though some recent papers sure make interesting reading. just picking on one

Dedicated server provider in LA

2008-12-13 Thread Jasper Bryant-Greene
Hi all, Apologies for the operational content, does anyone know (or is anyone) a dedicated server provider who can get a Linux server online for us in the next three hours? We urgently need to move a live site due to system failure. Preferably west coast USA, but beggars can't be

Re: Netblock reassigned from Chile to US ISP...

2008-12-13 Thread Steven M. Bellovin
On Fri, 12 Dec 2008 16:33:51 -0800 Tomas L. Byrnes t...@byrneit.net wrote: Because anyone with half a brain blocks proxies from their e-commerce site. What is a proxy? A garden-variety squid server, in the DMZ of a corporate firewall? The nasty box in some hotels that helps guests surf the

Re: Netblock reassigned from Chile to US ISP...

2008-12-13 Thread Andy Davidson
On 13 Dec 2008, at 12:39, Steven M. Bellovin wrote: On Fri, 12 Dec 2008 16:33:51 -0800 Tomas L. Byrnes t...@byrneit.net wrote: Because anyone with half a brain blocks proxies from their e- commerce site. What is a proxy? A garden-variety squid server, in the DMZ of a corporate firewall?

Re: DDOS - How much is too much?

2008-12-13 Thread Jeffrey Lyon
DDoS protection packages are generally sold with Mbps, PPS, and often TCP-SYN / UDP session limits. -- Jeffrey Lyon, Leadership Team jeffrey.l...@blacklotus.net | http://www.blacklotus.net Black Lotus Communications of The IRC Company, Inc. Look for us at HostingCon 2009 in Washington, DC on

RE: UDP DoS mitigation?

2008-12-13 Thread Ian Henderson
Rick Ernst wrote on 2008-12-13: - This instance was a DoS, not DDoS. Single source and destination, but the source (assuming no spoofing) was in Italy. Turning off netflow seemed to help, but the attack itself stopped at about the same time. Before moving to hardware based platforms,