Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
On Aug 5, 2011 12:50 PM, "Walter Hurry" wrote: > > On Fri, 05 Aug 2011 13:31:37 -0400, shawn wilson wrote: > > imo, meaningless > > Of that I have little doubt. As I said, I was just curious. > > By the way, my router is just a cheap home DLink unit, not anything > running any special software. So

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 13:31:37 -0400, shawn wilson wrote: > imo, meaningless Of that I have little doubt. As I said, I was just curious. By the way, my router is just a cheap home DLink unit, not anything running any special software. So I don't set the "rules" - just tell it as part of the norma

Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
On Fri, Aug 5, 2011 at 13:03, Walter Hurry wrote: > On Fri, 05 Aug 2011 11:59:51 -0400, shawn wilson wrote: > >> 1. How are you figuring the source country? If you're looking at the ip >> in the handshake and comparing this to a db of ip / country, you're only >> looking at half of the story. If y

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 11:59:51 -0400, shawn wilson wrote: > 1. How are you figuring the source country? If you're looking at the ip > in the handshake and comparing this to a db of ip / country, you're only > looking at half of the story. If you're a bit smarter and have a list of > border routers t

Re: Intrusion Statistics

2011-08-05 Thread John Hasler
Walter Hurry writes: > Am I to infer then, that it is likely than a fair proportion of these > do not emanate directly from the hacker, but from a bot on an innocent > bystander's box which has been compromised? A "fair proportion" as in 99+%. -- John Hasler -- To UNSUBSCRIBE, email to debian-

Re: Intrusion Statistics

2011-08-05 Thread shawn wilson
1. How are you figuring the source country? If you're looking at the ip in the handshake and comparing this to a db of ip / country, you're only looking at half of the story. If you're a bit smarter and have a list of border routers that country owns and are looking at that for the source country,

Re: Intrusion Statistics

2011-08-05 Thread Camaleón
On Fri, 05 Aug 2011 15:13:02 +, Walter Hurry wrote: > On Fri, 05 Aug 2011 14:34:42 +, Camaleón wrote: (...) >>> I am curious as to why the United Kingdom should figure so highly. It >>> is my own location, which is undoubtedly relevant, but I don't really >>> understand the reason. The

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 14:34:42 +, Camaleón wrote: >> China|483 United Kingdom | >> 455 Russian Federation |167 Germany | >> 74 >> Spain| 68 > > Hey, I'm there (Spain) :-P > > My e-mai

Re: Intrusion Statistics

2011-08-05 Thread Camaleón
On Fri, 05 Aug 2011 12:29:02 +, Walter Hurry wrote: > More out of curiosity than paranoia, I have carried out a small > geographical analysis of rejected "intrusion attempts" at my home router > (this consists of dropped TCP packets and ICMP (ping) requests). Interesting stats, indeed... > O

Re: Intrusion Statistics

2011-08-05 Thread Walter Hurry
On Fri, 05 Aug 2011 12:29:02 +, Walter Hurry wrote: > More out of curiosity than paranoia, I have carried out a small > geographical analysis of rejected "intrusion attempts" at my home router Sorry for the formatting, but I think it's just about legible, so I won't pollute the list by repos