Re: Blocking offending IPs : How many are too many to handle for npf?

["J. Lewis Muir" <jlmuir%imca-cat.org@localhost>]

On 05/24, Mayuresh wrote:
> On Thu, May 24, 2018 at 01:55:23AM +0000, Christos Zoulas wrote:
> > You could collect data for a few days and then make some entries permanent :-)
> 
> Sure. May be I'd look forward to blocklistd to add 1 more column in its
> conf: "no. of repeat offences before being permanently blocked"! :-)

One issue with a permanent block is the whole cloud computing thing.
AWS (and I'm sure all the rest) recycle IP addresses.  They will give
out static IP addresses, and the addresses are yours for as long as
you keep them, but if you release them, they go back into a pool of
available IP addresses to be given out to the next person.  Obviously,
if you permanently block an IP address that used to be bad but now has
been released and given to a new owner, you end up blocking the new
owner when they have done nothing wrong.

Lewis