Re: Active Snort Log Analyser
Hi!
> You're right and I already block unusual things...
> So, how can I block the attack once I've detected the scan ?
I don't really see your problem here. Your firewall either is secure or it
is not. If it is not, you should not increase security for some short
period, you should increase it for ever. If it is secure, you can sit back
and watch the scan since it cannot harm you.
When is your firewall secure? When you don't allow anything that you don't
explicitly want to be allowed. Forbid everything and take your time before
making the exceptions. Really think about them and keep in mind that every
opening means another possibly buggy service is prone to attacks.
If you do this and you do this well, you're through. Portscans mean no harm
anymore, unless someone uses them as a DoS-Attack on you log partition.
It is this simple.
Jörn
Reply to: