Re: Displaying SSH password attempts

On Fri, 07 Jul 2006 20:29:23 +0300, ader_at_ait.edu.gr said:

> I would say that any attacker that tried to breach a system with such a
> poor security policy and failed, is under no circuimstances a threat for
> modern Network Security. I mean you left the door unlocked and a note
> saying you are not there... If the guy cant open the door he is
> incapable of harm and most probably a victim himself.

So tell me.. if you saw a flood of 62,497 totally lame ssh password probe
attempts from the same set of 4 IP addresses, what are the chances that
you'd be more likely to totally *fail* to notice a 4-packet zero-day
from one of those 4 addresses?

It's called "flying under the radar"....