A nice article overall, but at least some firewalls offer some flexibility with respect to dynamically blocking traffic from hosts which behave in some undesirable fashion. OpenBSD's PF has 'overload' rules for this and similar purposes.

I have included an example of this with some discussion in my "Firewalling with PF" tutorial (tutorial home http://www.bgnett.no/~peter/pf/, bruteforcing section http://www.bgnett.no/~peter/pf/en/bruteforce.html).

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1876/680#680