Dns-operations mailing list

[Martin C <martin AT mchomenet.com>]

> Any time I see one or two specific IP's slamming me, I'll just block 
> them outright.
That's what I was doing at the start, and maintaining a simple script 
of:
iptables -A INPUT -s IP -j DROP

that worked its way up to 10 IP addresses. Then this morning, 3-4 would 
hit at a time, all different, so I would block them. Then 5 new ones 
appeared and burned through the bytes.

I may go back to specifying them, but for now, your instructions at:
http://permalink.gmane.org/gmane.network.opennic.general/4733
with a more limited burst rate seems to be discouraging them, so 
services are back up.

I'm looking out for repeat offenders though, to block specifically.

Martin