Jay R. Ashworth wrote:
On Thu, Feb 22, 2007 at 08:01:04PM +0000, Tim Starling wrote:
New remote loaders are set up every day. I was thinking that it would be better to have a list of pending remote loaders that we can block in a batch, once a week or so. A bug report for each one seems a bit excessive.
Is it possible to identify such machines by their pattern of transaction activity, using something akin to an IDB, and set blocking /32 rules in the edge router?
Maybe. I'd rather not discuss the precise heuristics I'd use in a public forum, but there may be room for development along those lines.
-- Tim Starling