Forum Discussion
bago_7909
Nimbostratus
NimbostratusOn blocking port scans.
What would be a good irule for blocking 0 byte tcp connections? Aka port scans?
Kai_Wilke
MVP
MVPHi Bago,
if you want the attacker to become pissed, then respond on each single TCP-connect with an HTTP 200 OK including IIS6.0 Server-Banners. This procedure will confuse his automated tools so that the attacker will a.) require a decent time to rule out all the false positives or b.) very soon look for easier targets...
Well, the more serious answer is just drop the unwanted TCP-sessions via the [drop] command or add some tarpits via
[after 3000][drop]Note: Keep in mind, that a Virtual Server will perform the full 3-way handshake before you can
the connection. Putting a network firewall infront of your Virtual Servers will allow you to [drop]
even the initial 3-way handshake...[drop]
Cheers, Kai
