[Dshield] Need some help testing

[Johannes B. Ullrich]

Mar Matthias Darin wrote:

> I have made every attemp possible to prevent false positives.  Plus several 
> very nice people have contributed whitelists of IP addresses/domains that 
> should be exclude from testing.  The SANS server that sends out the DShield 
> list is a good example of a dynamic IP address that should not be filtered.  
> Haphazard use of DynaStop will only lead to massive mail loss. 

SANS server using Dynamic IP? Sorry if I am jumping in here half way
into the discussion. But that caught my attention ;-). All SANS servers
should use "static" IP addresses.



-- 
Johannes Ullrich, SANS Institute, (www.sans.org)

SANS Network Security 2007 in Las Vegas September 22-30. 39 courses,
SANS top instructors.  http://www.sans.org/info/9346

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 249 bytes
Desc: OpenPGP digital signature
Url : http://lists.sans.org/pipermail/list/attachments/20070706/743c3152/attachment.bin