RE: [Snort-users] Country blocking?

You can check out the Ip-to-country database at
http://ip-to-country.webhosting.info. It isn't perfect
but at least there is the hope of update in the near
future.

If you use it to preemptively block IPs, then you
should consider the chance of blocking someone on
accident. But this is a risk you take with any
non-perfect database. I tried searching for a free and
complete mapping but couldn't find one. If anyone
knows of a flawless free/paid database please let me
know.


-Vents

--- "Donofrio, Lewis" <donofrio@umich.edu> wrote:

> Anything from RIPE.NET could be blocked as far as I
> can tell....
>
> --just my 2 cents.
>
__________________________________________________ ____________________
> Lewis Donofrio@umich.edu College of Literature,
> Science, & Arts
> 1007 East Huron, Room 201, BetaID:243340
> Cell: (734) 323-8776
> Ann Arbor,MI 48104-1690 www.umich.edu/~donofrio Fax:
> (734) 647-8333
>
----------------------------------------------------------------------
> () ascii ribbon campaign - against html mail
> /\ [http://arc.pasp.de/]
>
> -----Original Message-----
> From: snort-users-admin@lists.sourceforge.net
> [mailto:snort-users-admin@lists.sourceforge.net] On
> Behalf Of Alex Kirk
> Sent: Tuesday, January 18, 2005 8:56 AM
> To: mdpeters
> Cc: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Country blocking?
>
> That's probably a task that's better suited for your
> firewall, if you're
> just dropping all connections from a country,
> irrespective of what they
> contain.
>
> That being said, though, it can be difficult to
> block based on
> geographic region, let alone a specific country. IP
> address ranges are
> somewhat fluid, and geolocation is still an inexact
> science. Unless I'm
> unaware of some new technology out there, chances
> are good that your
> attempt to block by country will result in some
> connections from it
> still getting through, along with the blocking of
> some things that
> aren't from that country -- especially since there's
> nothing in most
> packets that associate them with a specific country.
> I mean, it's not
> like you could to try to use Snort to block anything
> that contained the
> Chinese character set, since you'd miss messages
> coming from China in
> English, but zap messages in Chinese from, say,
> Cambodia, Vietnam, or
> even America. It gets worse when dealing with
> straight TCP/IP -- you
> wouldn't even have that kind of a clue.
>
> If anyone else has a solution to this, I'm all ears,
> but I have a
> feeling you're out of luck here.
>
> Alex Kirk
> Research Analyst
> Sourcefire, Inc.
>
> > Could anyone advise me on how to block a large IP
> address space using
> > Snort-inline? For example, I would like to drop
> all connections
> > originating from China.
> >
>
>
>
>
-------------------------------------------------------
> The SF.Net email is sponsored by: Beat the
> post-holiday blues Get a FREE
> limited edition SourceForge.net t-shirt from
> ThinkGeek.
> It's fun and FREE -- well,
> almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or
> unsubscribe:
>
https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
>
http://www.geocrawler.com/redir-sf.p...st=snort-users
>
>
>
-------------------------------------------------------
> The SF.Net email is sponsored by: Beat the
> post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt
> from ThinkGeek.
> It's fun and FREE -- well,
> almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or
> unsubscribe:
>
https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
>
http://www.geocrawler.com/redir-sf.p...st=snort-users
>


=====
Fair-weather friends are no friends at all. If you have done something that some people find distasteful then expect them to tell you so. A true friend will let you know how they feel but respect your right to choose, while a fair-weather friend will judge you by your actions and leave.

"Knowing others is wisdom, knowing yourself is Enlightenment." -Lao Tzu




__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users