About dhamlin

I'll try and clarify: If an Internet-based host sends any kind of traffic to my dark/unused subnets, then I want to block all of their traffic for 10 minutes, even if their traffic is going to legitimate subnets on my network. My addresses are publically routable, but as an example let's say I own 172.16.0.0/16. Let's say that 172.16.1.0/24 isn't in use, but 172.16.2.0/24 is. If 5.6.7.8 attempts to scan 172.16.1.0/24 then I want to block all of his traffic, including any attempts to communicate with anything on 172.16.2.0/24.  Host 5.6.7.8 has indicated that he is doing "bad things" because he is attempting to communicate with a subnet that isn't even in use.  Therefore any further network traffic from him should be considered suspect and I would like to drop all of his traffic for the next 10 minutes. It would seem that it might be possible with Zone Protection or DoS protection, but since I new to PA I'm still learning how it works. ... View more