full-disclosure - Comcast using IPS to protect the Internet from their home user clients?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0403110502170.27704@o9>
From: thomas at 88.net (Thomas Lakofski)
Subject: Comcast using IPS to protect the Internet from
 their home user clients?

On Wed, 10 Mar 2004, Exibar wrote:

>             Filtering should not be done by the ISPs, they should provide a
> pipe, and that's it.  Ok, there are some circumstances, like a DoS against
> your equipment, where the ISP is the only means of blocking the traffic,
> that's a different story.

Filtering is one thing, and I agree that it's a bad step to take for all
sorts of reasons.  Maybe, though, there are other ways to trap bad
traffic at the ISP level?  I ran LaBrea for a few months on the 3 spare
IPs in my /29, which tended to seize several thousand scanning threads
from all over the place, most of them indefinitely.  Some hosts
afflicted with particularly stupid scanners snarled hundreds of threads
for weeks.  This was at the cost of a staggering 1kB/s upstream
bandwidth.

I wonder if it would be worth it for ISPs to take a /16 or even a
/15s-worth of addresses, and channel all the traffic to a few hefty boxes
running something like LaBrea.  With judicious interleaving of the
tarpitted address space with subscriber pools, most scanners which
operate tiered scanning (local net, then /24, /16, /8 etc.) will fairly
quickly get their threads stuck in the local ISP tarpit.  The tarpit
would also make an ok compromised host detector too...

I'm not sure what the downsides are besides wasted address space, and
some (additional) wasted bandwidth within each ISP (or externally, if
they expose the tarpits).

Any opinions?

cheers,

-- 
Thomas Lakofski
gpg: 1024D/81FD4B43  2B72 53DB 8104 2041 BDB4  F053 4AE5 01DF 81FD 4B43