Re: compromised machines and entire network health

[Chuck Swiger <cswiger_(_at_)_mac_(_dot_)_com>]

Arie Kachler wrote:
> In the past several years, we have had a few incidents of servers of 
> customers that are compromised and then flood our entire network and 
> bring down almost everything. The sql slammer worm for example.
>
> Is there a solution to this?

Several.  Egress filtering on your routers with logging to identify infected 
machines sooner rather than later is probably the single most useful thing you 
could do.

You could also set up a honeynet or teergrube which will slow down worms and 
reduce their rate of spread.

More complicated solutions involve bandwidth shaping via dummynet or ALTQ, etc.

--
-Chuck
_______________________________________________
freebsd-isp_(_at_)_freebsd_(_dot_)_org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe_(_at_)_freebsd_(_dot_)_org"