Text 10382, 94 rader
Skriven 2013-09-23 16:45:02 av Michiel van der Vlist (2:280/5555)
     Kommentar till en text av mark lewis (1:3634/12.0)
Ärende: Connecting 2:280/5555...
================================
Hello mark,

On Monday September 23 2013 09:52, you wrote to me:

 ml>> sounds like someone either unplugged the cable between their
 ml>> router and their switch/system or they turned it off for a minute
 ml>> or more ;)

 MvdV>> Not at my end...

 ml> exactly! especially since you didn't know when he was going to try ;)

And guessing would be hard. Especially when he made a successful connect a few
minutes before...

 ml>> of course, one cannot discount the ISP working on the lines or
 ml>> equipment and causing the outtage...

 MvdV>> It can not be ruled out, but then again if it were at my ISP,
 MvdV>> Ward would have gotten some other error than a  DNS resolving
 MvdV>> error.

 ml> possibly...

Not likely. The name service is not run by my ISP. It is run by Eurodns, their
name servers are in Luxemburg. My ISP fiddling with the connection would not
result in a DNS error for a third party. At least I don't se how...

 ml> but that depends on your name service,

www.eurodns.com

 ml>  how long it retains entries after an update

"forever"..

 ml> to the entry and how often entry updates have to be made to keep an
 ml> entry alive...

Never. It is kept alive as long as I keep paying the yearly fee...

 MvdV>> In the case of Bart, he would not have gotten a password error.
 MvdV>>

 ml> that's true :)

That was a clear case of PEBKAC. ;-)

 MvdV>> Now that you mention firewalls, my educated guess is that if I
 MvdV>> were to hammer your system with this:

 MvdV>> % 01:16:08  (395) BinkP: 2:292/907@fidonet.org
 MvdV>> ? 01:16:08  (395) Remote sent incorrect password.

 MvdV>>      ... each and every minute for two days, I WOULD have a
 MvdV>> problem connecting you for some time to come as my IP would be
 MvdV>> blocked by your firewall. Wouldn't it?

 ml> yes, i believe so... anyone doing that would have the same problem and
 ml> it may not take any more than 5 or 10 minutes...

It was suggested that I do something similar and lock out his IP. But I decided
on the less drastic measure of asking him to stop. It worked.... after a
while..

 ml>  it could take even less time than that if there were more than one
 ml> attempt per minute... if you change IPs and kept doing it, it would
 ml> simply apply the block to each new IP...

I haven't set up an automated defence like that. I did not feel the need. I may
change my mind...

 ml> in any case, once the block went into effect, it would appear on your
 ml> end as if the system simply didn't exist... the packets would be
 ml> dropped into the bitbucket and your end would have to wait for the
 ml> configured timeout period to elapse... one of the goals of this is to
 ml> slow down the 'attack'...

A call once a minute is annoying because it pollutes the log. Otherwise it is
pretty harmless.

 ml> the situation with my firewall is that once blocked, there it a
 ml> expiration time given... each additional attempt to connect that
 ml> raises another alert extends that expiration time... depending on
 ml> certain things, the extension could be linear or exponential... based
 ml> on the severity of the attack and other factors...

That is what I gathered from previous postings of yours.


Cheers, Michiel

--- GoldED+/W32-MINGW 1.1.5-b20110320
 * Origin: http://www.vlist.org (2:280/5555)