Re: Leak in BOPM

On Sun, Aug 22, 2004 at 06:51:47PM -0400, tabris wrote:
> 	Ok, this is only after about 3 hours (as it says). I'll probably have 
> to get back to you again after 24 hours. it may also have mattered that 
> at the time, we had twice as many users, most of which various nasty 
> bots we had to setup various filters for.
> 18:40:38 <+WCProxyBot> Uptime: 2 hours, 48 minutes, 19 seconds
> 18:40:38 <+WCProxyBot> DNSBL: 10 successful lookups from dnsbl.njabl.org
> 18:40:38 <+WCProxyBot> DNSBL: 5 successful lookups from cbl.abuseat.org
> 18:40:38 <+WCProxyBot> Number of connects: 1596 (9.48/minute)
> 
> 	I'd have to estimate, but i've seen the connect rate exceed 20/second, 
> esp with lots of bots connecting/disconnecting. It's not so bad now 
> after removing most of those bots.

So what's the fdstat?  even 20/second isn't that much, hmm...

> > > One idea from a friend is a combined nmap/bopm, that first scans
> > > for open ports, filters out a couple of the more obvious non-proxy
> > > ports (say 22, 25, 110, 135-139 etc), then scans all of them. I
> > > think it might take too long to scan, but it is an idea anyway.
> >
> > Needs root.  Will generate more abuse reports.
> 	Hmm. wasn't intending to use the root only ops.

SYN scanning is a root-only operation.

> It will cause more 
> abuse reports despite the fact that only users that connect get scanned 
> (I see it as possible, but not fully sure why)?

A SYN scan of all 65534 ports looks more suspicious than a connect()
scan of several hundred.

-- 
Andy Smith -- Occasional BOPM Developer And Support Monkey.  Please copy
all BOPM support queries to the BOPM list, _not_ just directly to me!
If I've helped you with BOPM then please check my wishlist!
http://www.amazon.co.uk/exec/obidos/registry/23IJ4U7N4J3X9

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (FreeBSD)

iD8DBQFBKTKAIJm2TL8VSQsRAk/6AKDOSJYRvb38uIVx71eWoioaCchMBgCgntPK
dSq+1CiV6Jn18lJOSq1FeJw=
=/rmu
-----END PGP SIGNATURE-----