compromised machines and entire network health
Chuck Swiger
cswiger at mac.com
Thu Jul 13 18:11:47 UTC 2006
Arie Kachler wrote:
> In the past several years, we have had a few incidents of servers of
> customers that are compromised and then flood our entire network and
> bring down almost everything. The sql slammer worm for example.
>
> Is there a solution to this?
Several. Egress filtering on your routers with logging to identify infected
machines sooner rather than later is probably the single most useful thing you
could do.
You could also set up a honeynet or teergrube which will slow down worms and
reduce their rate of spread.
More complicated solutions involve bandwidth shaping via dummynet or ALTQ, etc.
--
-Chuck
More information about the freebsd-isp
mailing list