[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: another seeming attack on my server's DirPort

To: or-talk@xxxxxxxxxxxxx
Subject: Re: another seeming attack on my server's DirPort
From: Michael Holstein <michael.holstein@xxxxxxxxxxx>
Date: Thu, 20 Dec 2007 14:28:20 -0500
Delivered-to: archiver@xxxxxxxx
Delivered-to: or-talk-outgoing@xxxxxxxx
Delivered-to: or-talk@xxxxxxxx
Delivery-date: Thu, 20 Dec 2007 14:32:56 -0500
In-reply-to: <539EE696-68D5-4A4D-B468-EA4D0883BD7C@xxxxxxxxxxxxxxx>
References: <200712190846.lBJ8k4ql008543@xxxxxxxxxxxxx> <539EE696-68D5-4A4D-B468-EA4D0883BD7C@xxxxxxxxxxxxxxx>
Reply-to: or-talk@xxxxxxxxxxxxx
Sender: owner-or-talk@xxxxxxxxxxxxx
User-agent: Thunderbird 2.0.0.6 (X11/20071022)

I assume a correlation between these two events, although I wonder how(blocked) window shrinks could lead to this. My idea was toautomatically search in syslog for window shrink events and then blockthe guilty IPs for 24 hours with iptables. But I hope that anybodyunderstands what was there exactly going on...


TCP windowing foolishness can be a result of ISP "bandwidth management".

~Mike.

References:
- another seeming attack on my server's DirPort
  - From: Scott Bennett
- Re: another seeming attack on my server's DirPort
  - From: Jan-Kaspar Münnich

Prev by Author: Re: another seeming attack on my server's DirPort
Next by Author: Re: Testing bridge capabilities
Previous by thread: Re: another seeming attack on my server's DirPort
Next by thread: Re: another seeming attack on my server's DirPort
Index(es):
- Author
- Thread