Originally by: Dabljuh

---

Edited by: Dabljuh on 03/05/2010 15:59:14

Originally by: Kolatha

---

For those who keep going on an on about "all you have to do is block ip/mac addresses" please refer to the following two documents.

IP Spoofing

MAC Spoofing

Basically it is no effort at all to have each brute force attempt use a new randomly generated address. From my understanding and experience this is how some brute force attacks already operate. I know that DOS attacks use this as well.

---

I'm sorry, but that's not how IP spoofing works. Or rather: You can't combine brute forcing and IP spoofing. IP spoofing works for dumb SYNflood/bandwidth DOS attacks, but password cracking attacks require a valid IP. There's no excuse other than gross negligence for failing to prevent brute force attacks aggressively.

Besides, mac spoofing is to my knowledge irrelevant on the internet. (that is to say, outside a LAN/WAN) Owners of dynamic internet connections can sometimes use mac spoofing to receive new IP adresses from their ISP, if said ISP is (mis)configured that way.

Originally by: Kolatha

---

See my comments above about IP/MAC address spoofing and the recent issue I had to deal with. One disgruntled attacker with a small botnet can pretty much lock out the entire eve community if you implement this level of automated IP blocking.

---

Needless to say, there is no point in blocking the attacking IPs in a simple flood attack, as they are going to be spoofed anyways. However this is very different from a password attack, where IP-level blocking is both effective and desirable. I guess either your security setup is even more screwed up than CCPs, or you do not understand the fundamental differences in requirements on the IP layer between a flood/DOS and a password cracking attack.

---