From mboxrd@z Thu Jan 1 00:00:00 1970 From: hbeaumont hbeaumont Subject: blocking irc + botnets Date: Tue, 2 Aug 2005 10:41:14 -0500 Message-ID: Reply-To: hbeaumont hbeaumont Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Can anyone help me with the proper method to block outgoing requests to=20 botnets + irc? Or point me in the direction of searchable list archives (I could only find= =20 the non-searchable archives) or other FAQ that answers this? Problem: We have servers that could get infected via poorly wrote user scripts. I=20 want to prevent these servers from being used as part of botnets or general= =20 connections to=20 IRC (most scripts I run across seem to try to connect to IRC). I want to=20 take the best preventative measures I can in case one of the machines would= =20 become infected or otherwise compromised. Also, interested in any other popular method of stopping general outgoing= =20 DOS attacks (rate limiting UDP perhaps? I'm not real up on the techniques= =20 used by the DOS'ers). I'm interested in the recommended rules to add to prevent this type of thin= g=20 should it occur. Thanks.