[Dshield] Need some help testing

[Tomas L. Byrnes]

I think he's confusing the fact that you have multiple MTAs with having
a dynamic IP address.

IE: He may receive the dshield posts from any one of a number of IPs,
but all of those IPS are statically assigned.
 

> -----Original Message-----
> From: list-bounces at lists.dshield.org 
> [mailto:list-bounces at lists.dshield.org] On Behalf Of Johannes 
> B. Ullrich
> Sent: Friday, July 06, 2007 12:31 PM
> To: General DShield Discussion List
> Subject: Re: [Dshield] Need some help testing
> 
> Mar Matthias Darin wrote:
> 
> > I have made every attemp possible to prevent false positives.  Plus 
> > several very nice people have contributed whitelists of IP 
> > addresses/domains that should be exclude from testing.  The SANS 
> > server that sends out the DShield list is a good example of 
> a dynamic IP address that should not be filtered.
> > Haphazard use of DynaStop will only lead to massive mail loss. 
> 
> SANS server using Dynamic IP? Sorry if I am jumping in here 
> half way into the discussion. But that caught my attention 
> ;-). All SANS servers should use "static" IP addresses.
> 
> 
> 
> --
> Johannes Ullrich, SANS Institute, (www.sans.org)
> 
> SANS Network Security 2007 in Las Vegas September 22-30. 39 
> courses, SANS top instructors.  http://www.sans.org/info/9346
> 
>