[PLUG] 70% something on 'net connection due to tarpits?

["kaze" <kaze@voicenet.com>]

Something Chris Mann's boss said during the last presentation is intriguing
me. It was due to either tarpits or honeypots, tarpits I think. He said they
regained 70% or their bandwidth, or their bandwidth use dropped 70% due to
this. Sounds great to me, but why does this happen? The connections are
mostly still there. It's not like the crackers were getting in and then
moving huge files on and off the servers. Is it just the overhead of
establishing and breaking down all those sessions which made such a
difference? What's the downside to running these proactive-anti-cracking
programs?

_________________________________________________________________________
Philadelphia Linux Users Group        --       http://www.phillylinux.org
Announcements - http://lists.netisland.net/mailman/listinfo/plug-announce
General Discussion  --   http://lists.netisland.net/mailman/listinfo/plug