[Dshield] Dshield listing of load-balancers / proposal for LB registry

Johannes B. Ullrich jullrich at euclidian.com
Thu Oct 28 16:20:14 GMT 2004


One of the design lemmas behind DShield is that we will get more
meaningful data if we leave it up to our submitters to filter the
data. Very little filtering is done by the system itself, in order
to prevent any operator bias.

We do maintain a very short list of common 'false positive' sites.
Examples are port scanners (e.g. grc.com), IRC servers that perform
proxy scans, and a couple of these load balancers. This was done to 
prevent fightbacks being sent for these reports (which kept annoying
some of the people that run these load balancers).

In the (short?) future, I hope to provide the ability to add comments
to sources. This way, if we could add a comment that a given source is
a load balancer.


-- 
Johannes Ullrich                     jullrich at euclidian.com
contact: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20041028/16d7d94c/attachment.bin


More information about the list mailing list