Hi All,

I have recently put up a small website to help some friends and as I'm bored today I watch the logs... I see quite a few attempts to break in - all of which are Microsoft exploits so they aren't really important at all. On a daily basis, I also receive quite a few spoofed ip addresses or other forms of scans/attacks captured by the syslog and iptables.

Now, what do you folks do with MINOR attacks on your systems? Do you report them to the ISP, attack them back, do nothing because they are futile against your machines? (We're talking minor attacks here)

So far, I only report abuse when I'm bored on Saturdays or late evenings... What's the 'norm'?

J.

ignore them... its waaaay too much effort to chase them all up.
if anyone is persistant in attempting to break in or annoying, then main there ISP with the important parts of your server logs.

Most attacks like that are automated nowdays, scripts, bots, worms, zombies.. It simply does not make sense to report them. Report real crime in your neighborhood not white noise that flows over the internet everyday.

mostly ignore.
if I see an attempt at SSH or similar then they get IP blocked.
If there is a persistant attempt ...
eg I've been probed for 3 hours straight, every 5 -10 secs, by one guy ( usr/moron ) after the same port ( ooh duh ) , then I get annoyed, do a who-is and report if possible.
sometimes works sometimes not.
Definately works if the usr/moron is a customer of same ISP as yourself as is usually a breach of rules- email off your logs as proof.

If youre running in stealth then attacking someone else kind of gives the game away, blow your own cover etc. Not recommended !

live long and prosper
floppy

I report them if they are outlandish attempts. For example, a few days ago someone tried to Brutessh their way into one of our boxes for 4 hours. Somthing like 1500 failed login attempts. I'll report them and anyone else that tries repeatedly for a period of time.

Of course it also depends on where they are coming from. If they are coming from China or Japan or Korea, I won't even bother b/c I know I won't get a response from their ISP. Some European ISPs have been responsive (I've had a few experiences with schlund.de and found them to be very responsive). Domestic (US) ISPs are usually very responsive when you send them logs.

So I guess if I'm bored and care enough I'll report them.