Kirk Bocek wrote: > Scot L. Harris wrote: > >> Actually this won't reduce any bandwidth to your server. The probes >> still hit that address, you are just blocking those packets in iptables >> from begin able to get any further. > > > Are you saying that the single connect-and-drop that this scheme > introduces is going to use the same bandwidth as a brute-force password > attack on hundreds of login names? <snipped> Question, because I am not sure. Wouldn't the script that is being run have to be intelligent enough to move to the next machine without exhausting its attempts at guessing passwords in order for your firewalling scheme to effectively reduce bandwidth? What I mean is, the script attempts to connect and try a password. It doesn't get a response so it assumes that the machine simply returned a login denied and tries again. It may try this several times per username (depending on the script). If that's the case, as it's not actually bothering to keep track of success of connection you're getting the same amount of connects as previously. Is that not true? Now granted the above scenario is assuming a truly brain dead script, but they aren't all that more sophisticated than that (some of them). Curious, Alex