Hi all,
wanted to let everyone hear know about a cool service I just ran across,
myNetWatchman
they have a few different clients [Win32 and Perl] and can read logs from a bunch of different sources [ZA|BlackICE|WinXP ICF|PIX|etc] - basically, this agent runs in your systray, reads your firewall log, and uploads incidents to the mynetwatchman database. If you take a look at the site you can look at incidents from around the world; if enough corroborating reports are received, they escalate it to abuse contacts at ISPs, some of who monitor the database themselves anyway to look for signs of attacks coming from their networks. If you're running a personal firewall anyway, why not share the information and help stamp out network abuse? Dshield has a similar service, but this one actually has a working query-able database and seems a bit more reputable. I'd urge everyone who does packet filtering to give this tool a shot.
wanted to let everyone hear know about a cool service I just ran across,
myNetWatchman
they have a few different clients [Win32 and Perl] and can read logs from a bunch of different sources [ZA|BlackICE|WinXP ICF|PIX|etc] - basically, this agent runs in your systray, reads your firewall log, and uploads incidents to the mynetwatchman database. If you take a look at the site you can look at incidents from around the world; if enough corroborating reports are received, they escalate it to abuse contacts at ISPs, some of who monitor the database themselves anyway to look for signs of attacks coming from their networks. If you're running a personal firewall anyway, why not share the information and help stamp out network abuse? Dshield has a similar service, but this one actually has a working query-able database and seems a bit more reputable. I'd urge everyone who does packet filtering to give this tool a shot.
