[no subject]

On Fri, 2005-12-16 at 14:15, Jason Day wrote:
> On Thu, Dec 15, 2005 at 09:46:52PM -0500, Bob Toxen wrote:
> > Second, generally it's best just to DROP all that you don't allow rather
> > than trying to get "clever".  You probably don't know enough about networking
> > to outsmart nmap or other very clever scanners and thus just will "tip your
> > hand".
> 
> I thought it was better to REJECT all that you don't allow, on the
> grounds that that's the expected behavior for an unbound port.
> 
> In other words, if I REJECT packets to, say, port 25, then to an
> attacker running a scan it looks like I don't have a daemon listening on
> port 25.  But if I DROP packets to port 25, then he knows I have some
> kind of firewall in place, and might think I would make a more
> interesting target.
> 
> Granted, if an attacker is specifically targeting my box, then it
> doesn't really matter.  But if he's running a general scan over a bunch
> of IPs, then the IPs that DROP packets will stand out, because the scan
> will come to a screeching halt while waiting for the connection attempts
> to timeout.



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00076" href="msg00076.html">[ale] Nmap + filtered ports</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
<li><strong><a name="00077" href="msg00077.html">[ale] Nmap + filtered ports</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="00195" href="msg00195.html">[ale] Nmap + filtered ports</a></strong>
<ul><li><em>From:</em> transam at verysecurelinux.com (Bob Toxen)</li></ul></li>
<li><strong><a name="00206" href="msg00206.html">[ale] Nmap + filtered ports</a></strong>
<ul><li><em>From:</em> jasonday at worldnet.att.net (Jason Day)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00207.html">[ale] Nmap + filtered ports</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00209.html">[ale] changes to ftp.ale.org</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00220.html">[ale] Nmap + filtered ports</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00078.html">[ale] Nmap + filtered ports</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00208"><strong>Date</strong></a></li>
<li><a href="threads.html#00208"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>