[[email protected]: a suggestion]

----- Forwarded message from Stefanos Harhalakis <[email protected]> -----

From: Stefanos Harhalakis <[email protected]>
Date: Sat, 20 Mar 2004 18:51:01 +0200
To: Erik Fears <[email protected]>
Subject: a suggestion
X-Spam-Level: 
User-Agent: KMail/1.6

Can you forward this to the bopm list? mailman blocks it and noone seems to 
approve the post... (I've send it twice the during the last week)

=====

Hi there, 

	I have a suggestion about improving bopm efficiency... As we can see from 
time to time there are different ports out there that belong to different 
proxies/trojans etc. 

	Since you've already an accounting method and you determine most dangerous 
port each week (Blitzed OPM Stats Thingy) I suggest that you:

	1) Create a special zone (i.e ports.opm.biltzed.org)
	2) Add some hosts to this zone (i.e: top1.ports.opm.blitzed.org, 
top2.ports.opm.lbitzed.org, ...., topN.opm.blitzed.org) that resolve to 
something like: 1.2.X.Y, where X.Y defines the port number. This way the 
top1.ports.opm.blitzed.org whould return the first non-standard port with the 
most open proxies found out there (i.e. 65506)
	3) Make bopm resolv the first N hosts of this zone (where N is a fixed value 
or a configuration option)

	This way:

	a) Everyone out there using bopm will be scanning the most dangerous port
	b) bopms will not require manual reconfiguration each time the port-roster 
changes

	You can also make bopm to cache this values and perform a new lookup on this 
zone every 6h, day, week, etc... This way it is possible to even remove the 
default port list from bopm.conf and make the whole thing dynamic (just an 
idea).

Thanks in advance...

<<V13>>



----- End forwarded message -----