Messages in this thread | | | From | Eric.Schenk@dna ... | Subject | Re: SYN flooding.... | Date | Mon, 26 May 1997 14:16:39 +0200 |
| |
Rogier Wolff <R.E.Wolff@BitWizard.nl> writes: >My personal opinion is that logging useless information is less >harmful than throwing information away. If the stupid fools didn't >forge their source address, or are behind a router that correctly only >allows "internal IP addresses" to go out, you would at least have >the ISP that they operate from....
On the other hand, if we report the address and the attacker was clever enough to pick an internal unroutable address on someone elses router, then it only servers to make trouble for an innocent party. Attacker: 2, Victims: 0. Perhaps a sufficiently strongly worded kernel message would fix this problem, but I'm still wary of logging more information than the port number.
-- Eric Schenk www: http://www.dna.lth.se/~erics Dept. of Comp. Sci., Lund University email: Eric.Schenk@dna.lth.se Box 118, S-221 00 LUND, Sweden fax: +46-46 13 10 21 ph: +46-46 222 96 38
| |