Techie query?

[rowyn]

This is on behalf of level_head, who cannot post it himself at the moment for reasons that should be obvious:

"I have a Netscreen 5XP. I'm getting barraged by someone attempting to add themselves as a user, literally more than one million times, using IPs from the outside, but would be within my subnet mask. The message that I get is "the user limit has been exceeded and (my subnet).xxx cannot be added". The "xxx" is being replaced with every possible entry in that subnet."

So, the request is: any ideas? Ideally, ways to make the attacker go AWAY. Any pain and suffering this might cause the attacker would be just fine, too.

Comments

[kagetsume.livejournal.com]

My only guess would be that if it's a single IP address or a couple of them, to go into the device config and set up a filtering rule to simply ignore/drop any packets from those addresses. Probably under 'policies' or somesuch.

-- Kagetsume

[rowyn]

Thanks, foxie. I passed the idea along to him, but, alas, all I know right now is that he's still got the same trouble. :/