RE: prevent script kiddies to abuse my ppp connection

[Rowan Reid <rreid@studio3arc.com>]

,
> >
> > I left my computer for an hour and I was
> > surprised to see that the connection was still on! I 
> thought that one 
> > of my proces was using the connection so i did a quick dump 
> of ppp0. I 
> > was surprise to see that some script kiddy was looking at 
> my netbios 
> > port!
> >
> > Now I have been thinking of ways to prevent these silliness from 
> > shutting down my conneciton within 3mn. If I firewall these 
> incoming 
> > packets I believe that it won't help me. The blocked packet 
> will still 
> > traverse the ppp link. So it will still be seen as 
> "activity" to the 
> > ppp daemon. Correct me if I am mistaken.
> 

I'm no expert but the way I would go about this is to log established
outgoing connections, then have a perl script analyze this log if the
last entry is less than x minutes old and there is no existing
connection then kill your ppp deamon. Now those script kiddies are
probable nimda worms which seem to be everywhere. It shouldn’t' be hard
you may even be able to do a cat /var/log/firewall | last | grep IN=eth0
.... Get my drift ..