0004133: disabling a poisoned IP address

Viewing Issue Advanced Details [ Jump to Notes ]

[ View Simple ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0004133

[Resin]

minor

always

07-21-10 08:39

07-22-11 15:40

Reporter

ferg

View Status

public

Assigned To

ferg

Priority

normal

Resolution

fixed

Platform

Status

closed

Projection

none

OS Version

ETA

none

Fixed in Version

4.0.21

Product Version

4.0.8

Product Build

Summary

0004133: disabling a poisoned IP address

Description

(rep by Aaron Freeman)

Just wondering if anybody has ever worked through a scenario where you
could automatically firewall off an IP address that requested a
"poisoned" URL?

There is an attacker continuously scanning all of our servers for a
specific URL, but from several different IPs. It would be nice to be
able to automatically firewall them off.

Has anybody done anything like that before?

Steps To Reproduce

Additional Information

Attached Files

Relationships

Notes
(0005393) ferg 07-22-11 15:40	server/1893

Issue History
Date Modified	Username	Field	Change
07-21-10 08:39	ferg	New Issue
07-21-10 08:50	stbu	Issue Monitored: stbu
07-22-11 15:40	ferg	Note Added: 0005393
07-22-11 15:40	ferg	Assigned To	=> ferg
07-22-11 15:40	ferg	Status	new => closed
07-22-11 15:40	ferg	Resolution	open => fixed
07-22-11 15:40	ferg	Fixed in Version	=> 4.0.21

Mantis 1.0.0rc3[^]

30 total queries executed.
26 unique queries executed.