Jay R. Ashworth wrote:
On Thu, Feb 22, 2007 at 08:01:04PM +0000, Tim Starling
wrote:
New remote loaders are set up every day. I was
thinking that it would be
better to have a list of pending remote loaders that we can block in a
batch, once a week or so. A bug report for each one seems a bit excessive.
Is it possible to identify such machines by their pattern of
transaction activity, using something akin to an IDB, and set blocking
/32 rules in the edge router?
Maybe. I'd rather not discuss the precise heuristics I'd use in a public
forum, but there may be room for development along those lines.
-- Tim Starling