[Leaf-user] LaBrea Tarpit

You have to check out this program, if you haven't heard about it already. It grabs unused IP's on your network, and uses them to slow propogation of any random scanning type worm. Rather than simply drop packets, the program completes just enough of a TCP connection to cause the remote computer

Re: [Leaf-user] LaBrea Tarpit

:-) pretty cool Charles, pretty cool!!! Charles Steinkuehler wrote: > > Of course, I've already got this running under LRP, and installed on my > firewall here. Try, for example, the following: > http://216.171.153.186/ ___ Leaf-user mailing li

[Leaf-user] LaBrea package available

The LaBrea LRP package is now available: http://lrp.steinkuehler.net/Packages/LaBrea.htm While this is currently only really useful for folks with extra IP addresses hanging around, I'd like to get a setup 'Tarpitting' any inbound connection requests that would normally be dropped by the firewall

RE: [Leaf-user] LaBrea package available

Hi Charles, Do you have any idea how much in the way of CPU time and memory would be required to implement tarpitting as part of LPR? I don't want to tarpitting to consume alll the resources of my firewall. Regards John Ridout C T A Systems Ltd http://www.ctasystems.co.uk > -Original Mess

Re: [Leaf-user] Re: [LRP] Two 3Com cards

Robert is correct. You will need to configure the adapters using 3Com's 3C5X9CFG.EXE program from DOS. I have done this a number of times with the 3Coms, and have even documented some of the details. Check out: http://nw-hoosier.dyndns.org/rlohman/linux/firewall/es-contents.html Look for the

Re: [Leaf-user] LaBrea package available

> Do you have any idea how much in the way of CPU time and memory > would be required to implement tarpitting as part of LPR? > I don't want to tarpitting to consume alll the resources of my firewall. Check out the whitepaper at the LaBrea webpage for some details. In general, tarpitting, or eve

Re: [Leaf-user] LaBrea package available

> Do you have any idea how much in the way of CPU time and memory > would be required to implement tarpitting as part of LPR? > I don't want to tarpitting to consume alll the resources of my firewall. Some recently posted stats: - Original Message - From: "jamesh" To: <[EMAIL PROTECTED]>

[Leaf-user] Newbie

By some miracle, a year ago I got LRP up and running using 2.9.7 with SSH, DHCPD, DHCLIENT on a 1440 floppy. It provides NAT from my home network (5 PCs) through a cable modem to the internet. I've been thrilled with it! Now I want to add VPN access (IPSec) so I can get to the home network whil

[Leaf-user] Couple more newbie qs

1) What is the difference between ipautofw and ipportfw? 2) My LPR doesn't have superformat or fdformat installed. Is it possible to overwrite an existing, formatted but non- blank floppy with an image (e.g. could I use the .exe file to make an eigerstein2Beta at 1660 then use something like df

Re: [Leaf-user] Newbie

> By some miracle, a year ago I got LRP up and running using 2.9.7 with > SSH, DHCPD, DHCLIENT on a 1440 floppy. It provides NAT from my > home network (5 PCs) through a cable modem to the internet. I've been > thrilled with it! > > Now I want to add VPN access (IPSec) so I can get to the home n

[Leaf-user] Slightly OT, Slightly LaBrea

Any Apache gurus: I noticed that my virtual domain in Apache does not get hammered with Code Red requests --- only the primary domain, that sits on the root IP address of the box. Would it be possible to run Apache such that there was no root domain accessible by a numeric IP address -- only acc

Re: [Leaf-user] Slightly OT, Slightly LaBrea

All requests come to the IP, but thay have no "Host" HTTP header, so they get served by your default config (i.e. not a VirtualHost) /magnus DPG wrote: > > Any Apache gurus: > > I noticed that my virtual domain in Apache does not get hammered with Code > Red requests --- only the primary doma

Re: [Leaf-user] Cacheing DNS question about 10.x.x.x zones

Charles Steinkuehler wrote: > > > I'm sort of confused, and maybe someones seen this. > > If I run a cacheing dns server somewhere on my private > > internal lan (10.x.x.x), then, by definition, it's not > > authoriative for my zone and just cache's query responses > > it gets back, correct? >

RE: [Leaf-user] Cacheing DNS question about 10.x.x.x zones

> Richard, > > Thanks for the reply. I was hoping to find a method > where I didn't have to run a master DNS, though tinydns > sounds like the best solution. > > I'm not sure one could run it on their LRP without paying > extra to Wacbell. > > But a cacheing dns server that could somehow be