Re: FW: Redirecting closed port connections

[Paul D. Robertson <proberts@clark.net>]

On Fri, 12 May 2000, Steve Coleman wrote:

> This reminded me I a somewhat (legally) flawed idea I had in the past
> which was to redirect all the probes back at the host that they were
> coming from. This way the perpetrator would be scanning the machine that
> (s)he is sitting on and wasting their time trying to break into their
> own system. 
> 

And if they're spoofing source addresses, you'll be sending packets at an
innocent victim, and if they're doing the same thing...

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280

-
[To unsubscribe, send mail to majordomo@lists.gnac.net with
"unsubscribe firewalls" in the body of the message.]