Re: Port scan detection with pf

hi;

Yep - i know - thats the main prb (spoofing/DoS) with dynnamic rules. But i think its worth the risk if config options are flexible enough (time hosts are blocked, threshold (#ports / time) forwarding of alerts, #of scanning attempts etc.). 'Information gathering' would be rather difficult/frustrating and (i think/hope?) most attackers will simply give up and select a new target. Nothing is for free ...  

hb    

On Sat, 30 Nov 2002 18:59:57 +0100
Robert Waldner <waldner@waldner.priv.at> wrote:

> On Sat, 30 Nov 2002 11:55:44 CST, Gordon Grieder writes:
Received on Sat Nov 30 14:29:51 2002