Re: [cobalt-users] China Attacks Question

[Roman Sainz <rsainz@xxxxxxxxxxxxxxxxxx>]

At 10:43 PM 4/29/01 -0700, you wrote:
> I added the very complete list given here the other day to my hosts.deny 
> file but...
> even though I added the list as posted here with entries such as:
>
> # CHINANET-CN China Telecom
> ALL: 202.96.0.0/255.240.0.0
>
> I'm still seeing new hosts added to the list by portsentry from this 
> particular block of addresses... specifically this one just now hitting 
> port 98 202.107.226.92 shouldn't they be showing as "already blocked 
> ignoring" rather than added?


If I understand correctly, you got them block from the services, but 
nothing will stop them from trying (unless there is another block before at 
the router level or a firewall).

If you run the following command, should se a similar result.

[rsainz /rsainz]# tcpdmatch sshd 202.107.226.92
client:   address  202.107.226.92
server:   process  sshd
matched:  /etc/hosts.deny line 7
access:   denied



Román Sainz
Gerente de Tecnología
rsainz@xxxxxxxxxxxxxxxxxx
http://www.emtechnologies.net