Re: best approach for blocklist

[Weedy <weedy2887@gmail.com>]

Mart Frauenlob wrote:
> On 05.03.2010 17:17, netfilter-owner@vger.kernel.org wrote:
>> Hi,
>> I'm wondering what the most efficient way to implement a blocklist is.
>> We are basically talking about blocking a few thousand IPs. Does
>> iptables do some internal optimizations when blocking based on a source
>> address or would it be better to, say, create a chain for each class A
>> net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class
>> to make the matching more efficient?

There is a PDF I'm too lazy to google for about how the university of 
florida mitigated a DDOS from a worm using TARPIT. Point being they had 
to TARPIT hundreds of thousands of IPs and had to deal with the 
performance issues behind that. It's a good read.