{"id":966,"date":"2017-04-29T12:13:26","date_gmt":"2017-04-29T16:13:26","guid":{"rendered":"http:\/\/www.rfdm.com\/blog\/?p=966"},"modified":"2017-04-29T15:50:42","modified_gmt":"2017-04-29T19:50:42","slug":"mcblockds-latest-trick-works-drop-tcp-connections","status":"publish","type":"post","link":"https:\/\/www.rfdm.com\/blog\/?p=966","title":{"rendered":"mcblockd&#8217;s latest trick works: drop TCP connections"},"content":{"rendered":"<p>Evidence in the logs of mcblockd&#8217;s latest feature working.  It&#8217;s successfully killing TCP connections when it adds a prefix to one of the pf tables.<\/p>\n<pre style=\"font-size: 14px;\">\r\nApr 29 03:42:40 ria mcblockd: [I] Dropped TCP connection from 221.144.5.116:38440\r\nApr 29 03:42:40 ria mcblockd: [I] Added 221.144\/12 (KR) to ssh_losers for 180 days\r\nApr 29 05:02:02 ria mcblockd: [I] Dropped TCP connection from 46.118.248.195:40294\r\nApr 29 05:02:02 ria mcblockd: [I] Added 46.118\/15 (UA) to ssh_losers for 180 days\r\nApr 29 07:07:42 ria mcblockd: [I] Dropped TCP connection from 120.132.4.45:56388\r\nApr 29 07:07:42 ria mcblockd: [I] Added 120.128\/13 (CN) to ssh_losers for 180 days\r\nApr 29 10:04:23 ria mcblockd: [I] Dropped TCP connection from 95.215.2.52:50862\r\nApr 29 10:04:23 ria mcblockd: [I] Added 95.215.0\/22 (RU) to ssh_losers for 180 days\r\nApr 29 11:51:34 ria mcblockd: [I] Dropped TCP connection from 110.246.84.64:32309\r\nApr 29 11:51:34 ria mcblockd: [I] Added 110.240\/12 (CN) to ssh_losers for 180 days\r\nApr 29 12:22:42 ria mcblockd: [I] Dropped TCP connection from 183.184.133.58:3369\r\nApr 29 12:22:42 ria mcblockd: [I] Added 183.184\/13 (CN) to ssh_losers for 180 days\r\nApr 29 13:13:54 ria mcblockd: [I] Dropped TCP connection from 120.150.231.99:50357\r\nApr 29 13:13:54 ria mcblockd: [I] Dropped TCP connection from 120.150.231.99:50349\r\nApr 29 13:13:54 ria mcblockd: [I] Added 120.144\/12 (AU) to ssh_losers for 180 days\r\nApr 29 14:42:30 ria mcblockd: [I] Dropped TCP connection from 113.209.68.135:53280\r\nApr 29 14:42:30 ria mcblockd: [I] Added 113.209\/16 (CN) to ssh_losers for 180 days\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Evidence in the logs of mcblockd&#8217;s latest feature working. It&#8217;s successfully killing TCP connections when it adds a prefix to one of the pf tables. Apr 29 03:42:40 ria mcblockd: [I] Dropped TCP connection from 221.144.5.116:38440 Apr 29 03:42:40 ria mcblockd: [I] Added 221.144\/12 (KR) to ssh_losers for 180 days Apr 29 05:02:02 ria mcblockd: &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.rfdm.com\/blog\/?p=966\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;mcblockd&#8217;s latest trick works: drop TCP connections&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29,85,12],"tags":[],"class_list":["post-966","post","type-post","status-publish","format-standard","hentry","category-freebsd","category-network-security","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/966","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=966"}],"version-history":[{"count":8,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/966\/revisions"}],"predecessor-version":[{"id":974,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/966\/revisions\/974"}],"wp:attachment":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=966"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=966"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=966"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}