RE: Re: Detecting Network scans

>From: Steve McKay [mailto:steve.mckay@xxxxxxxxxxxxxx] 
>But, alas, I am but a small department in a large company.  I don't "own"
>the corporate firewall, so I'm looking for insurance. 

Ever see The Recruit? Al Pacino's character has a great line about
CIA/Langley. He states that the CIA is based on perimeter security. It's
impossible to get in, but once you're in you can go anywhere, it's assumed
you're allowed.

Corporate LANs in large (and small) companies are no different. Companies
spend huge sums of money on high-end firewalls (rightly so) for there
perimeter and have no internal firewalls. It would NOT be unreasonable to
install a simple firewall in front of your iSeries only allowing the correct
traffic in. 

As others have pointed out, this can be done w/packet filtering and a
journal, but the iSeries is an expensive packet filter. Given that a Cisco
506E can be had for <$1000 I think you'd be better off putting a dedicated
box in the middle.

-Walden

------------
Walden H Leverich III
President
Tech Software
(516) 627-3800 x11
(208) 692-3308 eFax
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com 

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)