Re: "honeyports"
David Nicol <[email protected]>
| Newsgroups | gmane.network.djbdns |
|---|---|
| Message-ID | <[email protected]> |
On Thu, May 28, 2009 at 3:03 AM, George Barwood <[email protected]> wrote: > David, > > I saw your proposal. > > I don't think it's necessary to dedicate specific ports, all you need to do is to take note when an incorrect ID is detected in the packet header, for example keep a count of the number seen over a fixed time period ( say the last 20 seconds ). > > Then "additional measures" are taken according to how high the count is. Oh. You're right. With your approach, the happy path (response contains the correct ID) is not affected at all.