Re: [[email protected]: a suggestion]

> =====
> 
> Hi there, 
> 
> 	I have a suggestion about improving bopm efficiency... As we can see from 
> time to time there are different ports out there that belong to different 
> proxies/trojans etc. 
> 
> 	Since you've already an accounting method and you determine most dangerous 
> port each week (Blitzed OPM Stats Thingy) I suggest that you:
> 
> 	1) Create a special zone (i.e ports.opm.biltzed.org)
> 	2) Add some hosts to this zone (i.e: top1.ports.opm.blitzed.org, 
> top2.ports.opm.lbitzed.org, ...., topN.opm.blitzed.org) that resolve to 
> something like: 1.2.X.Y, where X.Y defines the port number. This way the 
> top1.ports.opm.blitzed.org whould return the first non-standard port with the 
> most open proxies found out there (i.e. 65506)
> 	3) Make bopm resolv the first N hosts of this zone (where N is a fixed value 
> or a configuration option)
> 
> 	This way:
> 
> 	a) Everyone out there using bopm will be scanning the most dangerous port
> 	b) bopms will not require manual reconfiguration each time the port-roster 
> changes
> 
> 	You can also make bopm to cache this values and perform a new lookup on this 
> zone every 6h, day, week, etc... This way it is possible to even remove the 
> default port list from bopm.conf and make the whole thing dynamic (just an 

My thoughts on this:

It would be better to make bopm read this data from a page served off http. The protocol pairs read off that page are read into a special scanner called 'bopm'. The URL itself is configurable on the bopm, so networks could either use the 'central list' from bopm, or create their own central list for their network (which would allow them to update all the bopm's port pairs at once from a single file).

-Erik