3 ms·
"to check counters ratio in a background - if it exceeds some value (i.e. 1.5) we will execute user-defined action and reset counters for triggered IP" Interes
by tyingq 5y ago
"to check counters ratio in a background - if it exceeds some value (i.e. 1.5) we will execute user-defined action and reset counters for triggered IP"
Interesting approach, though it seems like it should have a "floor/minimum" count first. Otherwise, 2 syns, 1 syn-ack is 2:1. Fairly easy to trigger accidentally with bad timing.
- jimsi 5y agoThis ratio is only applied if there are more than 1000 SYNs, forgot to mention that in the README (https://git.encryp.ch/g00g1/no-portscan/src/branch/master/cmd/no-portscan/main.go#L79 https://git.encryp.ch/g00g1/no-portscan/src/branch/master/cm...)
- tyingq 5y agoAh, of course. Guess I should have checked first :)