So via hackernews I recently learned about fight code, and my efforts have been fun. Currently my little robot is ranked ~400, but it seems to jump around a fair bit.
Otherwise I've done little coding recently:
- slaughter has had its code moved to github.
- The bookmark code got one patch and has had some interest
I'm pondering libpcap a little, for work purposes. There is a plan to write a deamon which will count incoming SYN packets, per-IP, and drop access to clients that make "too many" requests "too quickly".
This plan is a simple anti-DoS tool which might or might not work in the real world. We do have a couple of clients that seem to be DoS magnets and this is better than using grep + sort against apache access logs.
For cases where a small number of source IPs make many-many requests it will help. For the class of attacks where a huge botnet has members making only a couple of requests each it won't do anything useful.
We'll see how it turns out.
Tags: bookmarks, coding, github 2 comments
You could simply use the match "hashlimit" in iptables. There is no need to write a daemon.