1
00:01:36,350 --> 00:01:48,030
I work at a network consulting company, got a bunch of letters after my name, wrote a book and been doing this a while, so a little bit familiar with IP networks.

2
00:01:49,270 --> 00:01:51,190
What is geo-IP blocking?

3
00:01:51,190 --> 00:02:04,410
Just like it sounds, it's taking big chunks of IPs and blocking them from your network indiscriminately, for no reason other than where they come from, geographically, on your firewall or it works on routers too.

4
00:02:07,150 --> 00:02:09,290
Just some statistics for you.

5
00:02:09,730 --> 00:02:17,230
This is a study done by Spamhaus of the top spamming countries and I'm not giving you the whole list here, but these are the top three.

6
00:02:17,370 --> 00:02:19,830
No surprise, USA is number one.

7
00:02:19,830 --> 00:02:22,950
We love to be number one at everything, this is no exception.

8
00:02:23,730 --> 00:02:38,810
But right behind us is South Korea, China, Taiwan right behind that, so there's a number of countries that this is concentrated in, adds up to about 21% for just those two.

9
00:02:38,810 --> 00:02:43,170
This is just spam, but it's an example of where that stuff's coming from.

10
00:02:43,170 --> 00:02:45,790
Why do this?

11
00:02:47,070 --> 00:02:49,550
First reason is it's easy, it's quick.

12
00:02:49,970 --> 00:02:53,630
You don't have to buy any new hardware or software, you can just put some entries in your router.

13
00:02:54,310 --> 00:02:56,530
Again, no cost, just typing it in.

14
00:02:56,870 --> 00:03:02,670
You might have to spend some labor to type in some of the larger blocks, but it's still not a whole lot of investment.

15
00:03:02,670 --> 00:03:16,690
You also enable you to sort of blanket avoid all kinds of attacks, not just spam or viruses or worms, we just drop everything, period, forget it.

16
00:03:16,830 --> 00:03:19,330
We're just not going to accept anything from those areas.

17
00:03:19,490 --> 00:03:26,370
It's easily reversible, so if you don't like it or it's not working, it's causing problems on your network, take it out and you're back to where you started.

18
00:03:26,370 --> 00:03:31,610
So you don't have to un-configure the software or take pieces of hardware off your network.

19
00:03:32,410 --> 00:03:36,630
Users can still get to the websites in those countries.

20
00:03:36,630 --> 00:03:40,410
We're blocking inbound connections, we're not necessarily blocking outbound.

21
00:03:40,410 --> 00:03:46,210
You can block outbound, that gives some additional benefits, but also some additional potential problems.

22
00:03:46,210 --> 00:03:48,430
So the option is there for you.

23
00:03:49,630 --> 00:03:56,450
Most companies, let's face it, don't need to have these countries accessing their network.

24
00:03:56,450 --> 00:04:11,910
Fortune 500 companies, that's not necessarily the case, but there's a lot of other companies out there that don't necessarily want or need to do business with these countries and there's no reason to accept inbound connections from these locations.

25
00:04:12,390 --> 00:04:27,590
And again, even Fortune 500 can use this on a limited basis for certain types of servers, things that, internal intranets, things like that, that aren't, they're not going to be people connecting inbound, you can still open up your website, email server and so forth.

26
00:04:27,590 --> 00:04:30,710
So it's not just for small companies, medium-sized companies.

27
00:04:31,450 --> 00:04:32,750
More reasons.

28
00:04:33,630 --> 00:04:37,910
Over time, more and more stuff will probably move offshore from the U.S.

29
00:04:37,910 --> 00:04:38,270
The U.S.

30
00:04:38,270 --> 00:04:49,950
is still just a big part of the internet and still generates most of the traffic, but as time goes on, we'll probably see that the problem or the solution would ever get worse or better.

31
00:04:50,910 --> 00:05:00,130
It also has the effect, similar to spamming blacklists, of forcing bad actor countries, as I call them, to take some actions.

32
00:05:00,130 --> 00:05:03,670
And this, in fact, has happened with China and spam.

33
00:05:03,670 --> 00:05:17,410
They've recently introduced some laws and arrested some people and God knows what in their usual way, but still they're taking action and starting to become more of a good net citizen because of this pressure.

34
00:05:20,290 --> 00:05:22,150
What can this help with?

35
00:05:22,150 --> 00:05:28,150
Well, as I was saying before, it's sort of a blanket approach so it can block spam, of course, was our example.

36
00:05:28,370 --> 00:05:37,330
Email fraud coming out of those locales, phishing attempts, viruses, worms, automated hacking tools, manual hacking, mostly script kitties.

37
00:05:37,350 --> 00:05:40,850
I know you can spoof the addresses and do all kinds of fun stuff like that.

38
00:05:40,850 --> 00:05:46,530
If someone's really concerned about getting to your servers, they can manage to do so, even with this.

39
00:05:46,530 --> 00:05:52,050
But, as we know, 90% of the stuff out there or more is kind of dumb and doesn't do that.

40
00:05:52,490 --> 00:06:00,090
And also, I say, prohibited off-site content, porn, gambling, if you block the outbound connections from your network.

41
00:06:04,060 --> 00:06:05,440
Why not?

42
00:06:05,600 --> 00:06:07,440
Well, one does not make sense.

43
00:06:07,440 --> 00:06:09,980
It's not 100% effective, what is.

44
00:06:09,980 --> 00:06:13,380
But if you're looking for a silver bullet, whatever, this is not it.

45
00:06:13,380 --> 00:06:18,340
This is just yet another tool, another layer to help with your security protections.

46
00:06:19,480 --> 00:06:26,040
Some people may have a problem with it in that it goes against the idea of global access to everything all the time.

47
00:06:27,100 --> 00:06:33,580
And again, if you're a big company, you probably can't do this on your public servers or web, your email.

48
00:06:34,680 --> 00:06:46,980
Or if you're even a small company, say, doing business in Japan or overseas areas, however, you can still block, say, China, if you're doing business in Europe or elsewhere, you can still take the effort to block the bad guys.

49
00:06:47,860 --> 00:06:52,720
And again, it's going to block emails and things like that as well.

50
00:06:52,720 --> 00:06:59,780
So, if you're expecting to get legitimate business email, you don't want to block it or you want to take a more limited approach.

51
00:06:59,780 --> 00:07:06,240
Example, my company, we primarily deal with community banks in Texas.

52
00:07:06,400 --> 00:07:13,740
There's very, very, very low possibility of anyone trying to do legitimate business with any of those countries with me.

53
00:07:13,740 --> 00:07:18,000
Frankly, if I had one customer who wanted to do business over there, I don't want them.

54
00:07:18,080 --> 00:07:21,060
So, in my case, it makes a lot of sense.

55
00:07:23,800 --> 00:07:25,040
How it works.

56
00:07:25,740 --> 00:07:27,500
Let's start at the very top level.

57
00:07:27,500 --> 00:07:42,440
Some of y'all may already know this, but IANA assigns out big address blocks to what's called the regional internet registries, or RIRs, that handle more regions, continents, what have you, and they handle assigning things regionally.

58
00:07:43,380 --> 00:07:46,940
ARIN is the RIR that handles North America.

59
00:07:47,380 --> 00:07:51,840
Has anyone ever had to file for IP space with Dennis Swift?

60
00:07:52,160 --> 00:07:53,500
Yeah, a lot of fun, right?

61
00:07:53,600 --> 00:07:56,060
So, you know all about ARIN and how they work.

62
00:07:58,940 --> 00:08:08,660
Other RIRs that we'll talk about primarily, because ARIN is not part of this talk, we don't want to block ARIN, otherwise we'd be blocking ourselves and most of the other stuff that we want to get to.

63
00:08:08,660 --> 00:08:27,900
But some of the other RIRs that may be of interest, APNIC, which is Asia, Asia Pacific Network Information Center, RIPE, which is Europe and part of the Middle East and Central Asia, LACNIC, Latin America, and AFRINIC, which is a new RIR that just got assigned for Africa.

64
00:08:29,660 --> 00:08:36,540
Talk about some of the RIRs specifically and which ones make less or more sense to block.

65
00:08:36,580 --> 00:08:47,480
APNIC, Asia, as I said, now this takes in several of my top bad actor countries, number 2 and number 3 spammers, for example.

66
00:08:47,480 --> 00:09:00,480
Just by blocking APNIC, and this is an example that I've proved to myself, you can end up blocking about 20 to 30% of your malware headed for your public servers just from APNIC, because so much stuff comes out of that region.

67
00:09:02,460 --> 00:09:12,960
However, be careful, if you do a blanket lock, Japan, a lot of business gets done over there and some other areas, so you may not want to take a blanket approach.

68
00:09:12,960 --> 00:09:17,520
I do, and it hasn't hurt me yet, but you've got to make that determination.

69
00:09:18,880 --> 00:09:22,020
Here's the IPs if you want to take a blanket approach.

70
00:09:22,220 --> 00:09:33,980
The good news is it's just not a whole lot of statements really, it's some big pieces of network, big slash 8s, and put a statement in your router firewall and drop everything.

71
00:09:33,980 --> 00:09:49,740
I have to add here, Cabot Enter, this list, not necessarily complete, you want to check with IANA and make sure that this is the latest list, and you don't need to jot this down, I don't see anyone writing down anything anyways, it's too late in the day,

72
00:09:49,740 --> 00:09:54,300
but it's on the CD and on the website, so you can get all the numbers off of there.

73
00:09:57,200 --> 00:10:14,320
Here is an example if you say you don't want to take that blanket approach, you just want to block China, you also have to take into account that many organizations, suborganizations, within a region may not necessarily have IP space that's assigned to their RIR,

74
00:10:14,320 --> 00:10:23,140
they may get it from Aron, they may have applied, they may have an American parent company, or they may have applied a while back, or just, they may have wanted to get that space for another reason.

75
00:10:23,140 --> 00:10:30,980
So , if you really want to be 100% accurate, you've got to go out there and find out all the IP addresses associated with that, including the Aron space.

76
00:10:31,540 --> 00:10:39,960
Here's an example of the China only IP blocking, if you want to do that.

77
00:10:40,980 --> 00:10:53,100
Don't worry, again, don't write all this down, it's on the CD, it's on the website, and I'm going to show you at the end a way to get this front list automatically, so, instead of having to take it all off this presentation.

78
00:10:53,100 --> 00:10:55,980
Here's Korea, same kind of thing.

79
00:10:57,460 --> 00:11:15,080
Europe, Europe's a little bit more of a mixed bag, because you've got a lot of small countries there, there's a lot of governments, there's a lot of multinationals, it's really mixed up over there, and it's pretty hard to block the whole thing, I don't recommend it.

80
00:11:15,080 --> 00:11:31,260
But you can sort of take a couple of countries that are particularly troublesome, such as Russia, and drop that, because a lot of stuff comes out of Russia, and again, a lot of companies aren't necessarily doing business with Russia, needing to provide access to their network to there.

81
00:11:32,340 --> 00:11:42,840
But, if you do want to take it out, there it is, that's the RIPE address space, again, not a whole lot of statements in your router config, type them in and go.

82
00:11:42,840 --> 00:11:44,640
I'll be giving examples at the end.

83
00:11:45,460 --> 00:11:47,680
LACNIC is Latin America and Caribbean.

84
00:11:50,380 --> 00:11:56,500
A lot of these organizations use air and space, again, because they either have a company in the U.S.

85
00:11:56,500 --> 00:12:00,000
or they want to, they've established their presence there.

86
00:12:00,320 --> 00:12:09,560
But if you want to take a rifle approach, Brazil and Argentina are the bad, the worst guys, I should say, over there, and you can take those out.

87
00:12:11,040 --> 00:12:19,180
If you're a border company, border state, or you're doing a lot of NAFTA business, you may just want to skip this.

88
00:12:19,620 --> 00:12:26,420
I don't block it myself, so it's up to you on how permissive or not you want to be.

89
00:12:27,220 --> 00:12:33,200
Pretty small set of blocks for them at any rate, so pretty easy to block, blanket.

90
00:12:34,080 --> 00:12:42,320
Here's the, these are just examples, again, I'm going to give you guys a tool to get the custom list for your network, but there's the list for Brazil.

91
00:12:43,920 --> 00:12:51,840
AFRINIC, this is a new brewer, and just a lot of bad stuff comes out of here.

92
00:12:51,920 --> 00:12:58,020
Not a lot of legitimate commerce being done, unless you're an energy company or maybe a tobacco company.

93
00:12:59,420 --> 00:13:08,400
There's just more or less a lot of offers to transfer $20 million into your bank account for a Nigerian general or something, so you may want to just go ahead and block that.

94
00:13:08,400 --> 00:13:15,540
It's one slash eight, and probably not going to cause you any problems with legitimate commerce.

95
00:13:18,040 --> 00:13:24,080
A couple of strategies you can take towards this, as I mentioned, shotgun approach, just block them all.

96
00:13:24,080 --> 00:13:27,620
Just take them all out, and if there's problems, then you can always go back again.

97
00:13:28,420 --> 00:13:33,420
Myself and a lot of companies that I've talked to, they've done it, and it just didn't seem to bother them at all.

98
00:13:33,960 --> 00:13:37,380
So you can block the entire rare space and be done with it.

99
00:13:37,580 --> 00:13:42,340
It's easy and quick, but you might end up blocking some countries that you do want to do business with.

100
00:13:42,340 --> 00:13:46,460
Example, Australia, New Zealand does use some of that space.

101
00:13:46,460 --> 00:13:49,600
Some sites do, some sites don't, so you need to be careful.

102
00:13:54,420 --> 00:14:01,000
The rifle approach, which is generally what I recommend, is taking country-by-country assignments and saying, I want to take these guys out.

103
00:14:01,000 --> 00:14:19,800
Easiest thing to do, if you want a quick hit, is those top three, China, Taiwan, and South Korea, and get a 20 or 30 percent, lessen the load on your DMZ servers, your mail servers, by 20 to 30 percent, without doing a whole lot of harm to anyone wanting to come in legitimately.

104
00:14:21,360 --> 00:14:22,800
It is time-consuming.

105
00:14:22,800 --> 00:14:30,340
You do have to kind of keep up with the configs, but there are some ways to automate that, which I'll show you in a moment, to speed up that process.

106
00:14:32,540 --> 00:14:47,440
You can also take a little more of a limited approach on a protocol level and say, well, I'm only going to block, I'm going to block everything but mail, or everything but mail and web, so the mail servers still function and the web servers still function,

107
00:14:47,440 --> 00:14:51,900
but if someone's trying to SSH or telnet, FTP, that stuff gets dropped.

108
00:14:53,860 --> 00:15:10,320
You can also block different segments, so you're going to block anything headed for your private land, but let's leave the DMZ wide open, but you don't really get any spam benefit here, or public server exploit benefit, you get, you know, zombie stuff and things coming into your network,

109
00:15:10,320 --> 00:15:14,700
your land, but you're not going to get the server benefit if you do that.

110
00:15:14,700 --> 00:15:29,960
You can decide to go the other way and allow everything, but we're only going to block interactive services, telnet, SSH, things like this, terminal services where someone could get in and possibly do some damage.

111
00:15:31,120 --> 00:15:41,980
You can pick certain servers to block, so you have a VPN server or database server, and you're just going to block it for that specific host or set of hosts, not all your other servers.

112
00:15:43,080 --> 00:16:04,900
We might decide to block the entire RIR, but leave open a certain hotel or ISP web space, sorry, web space, that should be IP space, to allow VPN access if your company has a deal with Hilton and everyone stays at Hilton, you can find out their IPs and not block that.

113
00:16:06,820 --> 00:16:14,380
Some examples, and this is not rocket science, you're all probably familiar with IP chains, just a simple deny statement.

114
00:16:15,020 --> 00:16:25,480
You do have to enter one of these for every block, every contiguous block, so you can't, at least in IP chains and IP tables, there's no easy way to block them all with one quick statement.

115
00:16:28,660 --> 00:16:41,360
This is the IP tables example, ignore that it says IP chain, sorry, I edited this this morning and was not expecting to have to go until Sunday, so there may be some typos, but there's the IP tables example.

116
00:16:42,520 --> 00:16:46,580
Cisco, if you're into Cisco, there's the Cisco example.

117
00:16:49,320 --> 00:16:58,040
SonicWall, and so on, just whatever particular router or firewall that you happen to like, figure out the syntax and the numbers.

118
00:16:59,660 --> 00:17:14,400
Here's an example on IP tables, I was talking about letting web through, so we're using the not operator to deny everything except it's not web, we're going to deny it if it's not web, if it's web, it comes through.

119
00:17:14,980 --> 00:17:19,560
And you can add D ports and add additional ports if you want to, web, mail, whatever.

120
00:17:22,280 --> 00:17:25,580
Automation, what makes all this make sense?

121
00:17:26,460 --> 00:17:40,400
Well, there's a site out there, excellent site, ip.ludos.net, and there's actually a couple of sites, I happen to find this one to be the easiest to use and it's free, and they're not trying to sell you any products.

122
00:17:41,660 --> 00:17:48,480
It has a script that will generate country-specific lists and you can import that straight in using the script I'll give you in a minute.

123
00:17:48,800 --> 00:17:56,140
You just pull a text file, or you can pull their whole file and parse it yourself if you want to do that, if you want to get fancy with your own script.

124
00:17:56,680 --> 00:18:04,520
And there's also commercial companies that will actually generate your configs or your files for you for a fee, if you want to do that.

125
00:18:04,520 --> 00:18:12,360
I think one of them is called country, ip2country.com, it's not on there, but that's an example of one of those.

126
00:18:13,260 --> 00:18:25,840
Starting to see some, especially in Europe, some ISPs are doing this, large website search engines, we're starting to see some of the bigger companies actually use this technique.

127
00:18:26,980 --> 00:18:33,360
Kind of interesting on their part that they would do that, but they're obviously, they see the value in avoiding all that bad stuff.

128
00:18:36,420 --> 00:18:48,840
Here's a quickie script, again, forgive me any syntax errors since I jammed this out this morning, but this basically will grab your text file you pulled off Ludost site and drop it into IP tables.

129
00:18:49,680 --> 00:18:59,940
Go line by line and create the entry, so all you have to do is grab the file and run the script, you can automate that in cron and, you know, it'll get all your IPs updated.

130
00:18:59,940 --> 00:19:04,780
That Ludost site updates daily, so they have pretty current information on them.

131
00:19:08,660 --> 00:19:24,580
Resources, this is a good list, a blocking list, this also includes not country specific, but other things like big spammers and so forth, so if you don't want to just do geo, you can also block by types of bad things like spam and so forth.

132
00:19:24,580 --> 00:19:28,100
And that's the Ludost IP to country database.

133
00:19:31,900 --> 00:19:38,360
Got a little extra for you guys, since you're having to watch this presentation, so the one you're expecting.

134
00:19:39,600 --> 00:19:50,460
We were going to originally, we proposed to do a full session on hacker related humor, they did not elect to let us do it, but you guys are going to get it anyway, so I have some extra time.

135
00:19:50,880 --> 00:19:51,900
A shortened version.

136
00:19:52,520 --> 00:19:54,420
I've got a top ten list for you.

137
00:19:54,940 --> 00:20:00,400
This is the top ten pickup lines overheard at DEF CON 13 in the home office.

138
00:20:00,820 --> 00:20:01,800
Number ten.

139
00:20:03,100 --> 00:20:05,100
Want to go war driving out by the point?

140
00:20:09,750 --> 00:20:12,510
Hi, I'm with tech support, can I have your password?

141
00:20:13,590 --> 00:20:15,370
That didn't go over very well.

142
00:20:16,290 --> 00:20:18,650
I'm serious, I really need your password.

143
00:20:20,010 --> 00:20:22,630
Got the password, but no date.

144
00:20:24,370 --> 00:20:28,830
Hosting a private version of the TCP IP drinking game later in my room.

145
00:20:29,770 --> 00:20:30,970
Just you and me.

146
00:20:32,210 --> 00:20:33,610
Hey, snarf this.

147
00:20:36,270 --> 00:20:37,590
Number five.

148
00:20:37,590 --> 00:20:39,890
Hey, mind if I try to pick the lock on your bra?

149
00:20:43,370 --> 00:20:45,890
Try to spot my little federal buddy.

150
00:20:49,130 --> 00:20:52,610
Hey, I heard there was a really cool PGP signing over at Caesars.

151
00:20:52,770 --> 00:20:53,430
Want to go?

152
00:20:55,850 --> 00:20:58,550
Number two, this is for the ladies in the crowd.

153
00:20:59,590 --> 00:21:00,870
Figured to give this to you.

154
00:21:00,870 --> 00:21:02,070
It's kind of complicated though.

155
00:21:02,070 --> 00:21:03,350
You really have to master it.

156
00:21:03,350 --> 00:21:04,190
It's difficult.

157
00:21:05,230 --> 00:21:05,890
Hi.

158
00:21:08,490 --> 00:21:09,290
Works.

159
00:21:11,050 --> 00:21:15,010
Finally, number one pickup line overheard at DEF CON 13.

160
00:21:15,710 --> 00:21:18,010
Hey, did you know I'm a speaker at DEF CON 13?

161
00:21:19,850 --> 00:21:20,810
That's it.

162
00:21:20,810 --> 00:21:33,410
If you have any questions on this or anything else, my email is thallett at netsecuritiesservices.com and the presentation will be posted to my site as well as it's on the DEF CON site.

163
00:21:33,790 --> 00:21:37,190
And feel free to email me abuse, comments, questions.

164
00:21:37,190 --> 00:21:39,730
Any questions right now?

165
00:21:39,730 --> 00:21:41,850
Since we're done pretty early.

166
00:21:42,950 --> 00:21:43,730
Yes.

167
00:22:00,450 --> 00:22:03,430
You said there's...

168
00:22:03,430 --> 00:22:10,150
The question was he was blocking Korea and he found legitimate hotmail traffic coming from Korea.

169
00:22:12,030 --> 00:22:14,050
Yeah, I've not heard of that.

170
00:22:14,050 --> 00:22:14,670
I mean...

171
00:22:15,530 --> 00:22:17,430
Yeah, I've not seen that at all.

172
00:22:17,430 --> 00:22:19,430
Some people might say that blocking hotmail is...

173
00:22:19,950 --> 00:22:21,590
A lot of companies block hotmail anyways.

174
00:22:21,590 --> 00:22:25,430
But I block it and I have hotmail and never had a problem.

175
00:22:25,430 --> 00:22:26,990
But it's interesting.

176
00:22:26,990 --> 00:22:28,490
I'll have to check that out.

177
00:22:28,790 --> 00:22:29,470
Yes.

178
00:22:55,240 --> 00:22:56,200
Like a...

179
00:22:57,160 --> 00:23:00,080
Kind of like a honey net, sort of, kind of.

180
00:23:05,470 --> 00:23:08,990
And how do you determine if it's invalid SMTP connections?

181
00:23:09,190 --> 00:23:10,930
From those by IP?

182
00:23:12,550 --> 00:23:12,910
Or...

183
00:23:27,320 --> 00:23:28,040
Okay.

184
00:23:28,500 --> 00:23:31,440
So you sort of built a white list of IPs, huh?

185
00:23:31,620 --> 00:23:32,480
It's interesting.

186
00:23:43,420 --> 00:23:49,040
Yeah, I mean, you can do all kinds of interesting things with your IP table statements about what you do with it and where you send.

187
00:23:49,040 --> 00:23:50,260
I mean, drop, deny.

188
00:23:50,520 --> 00:23:53,280
And you can get really fancy with it and do fun stuff with it.

189
00:23:53,540 --> 00:23:55,740
In the simplest form, you just drop it.

190
00:23:55,740 --> 00:23:56,180
But...

191
00:23:56,180 --> 00:23:59,880
And again, the scripts can get a lot fancier in terms of the importing.

192
00:23:59,880 --> 00:24:01,940
You could actually go out to the website.

193
00:24:02,360 --> 00:24:05,520
We could build a PHP script to type in what countries you want to block.

194
00:24:05,520 --> 00:24:06,020
You know.

195
00:24:06,120 --> 00:24:08,200
We haven't done that because we don't need it.

196
00:24:08,200 --> 00:24:11,320
But someone out there could probably whip it up pretty quickly, I'm sure.

197
00:24:20,420 --> 00:24:23,100
You blocked all email addresses except for...

198
00:24:26,120 --> 00:24:27,000
Huh.

199
00:24:31,560 --> 00:24:32,200
Yeah.

200
00:24:33,840 --> 00:24:34,720
Yeah.

201
00:24:34,780 --> 00:24:35,800
I mean, that would work.

202
00:24:35,800 --> 00:24:37,920
You don't get any complaints about that?

203
00:24:38,740 --> 00:24:39,420
Good.

204
00:24:39,420 --> 00:24:40,340
Good for you.

205
00:24:40,820 --> 00:24:42,200
Question back here somewhere?

206
00:24:45,060 --> 00:24:46,260
Good question.

207
00:24:46,820 --> 00:24:48,140
I don't know.

208
00:24:48,680 --> 00:24:52,380
Since it's not really a reality yet, I haven't dealt with that.

209
00:24:52,380 --> 00:24:54,580
And again, I don't try to oversell this.

210
00:24:54,580 --> 00:24:56,980
This may only work for a year or two.

211
00:24:57,240 --> 00:25:01,960
But to me, if it takes me 15 minutes and it works and it does something, it's worth doing.

212
00:25:01,960 --> 00:25:04,900
But yeah, I mean, IPv6 could throw a wrench in that.

213
00:25:04,900 --> 00:25:08,240
Because I don't think they're going to be assigning things regionally anymore with that.

214
00:25:08,920 --> 00:25:12,700
Also, I didn't mention this, but some other fun things you can do with...

215
00:25:12,700 --> 00:25:15,360
You can do geo-IP detection.

216
00:25:16,060 --> 00:25:21,700
And write some snort rules to detect Chinese IP addresses on your network for some reason.

217
00:25:21,900 --> 00:25:23,320
So we've done that too.

218
00:25:23,500 --> 00:25:28,740
Well, if it did get through, it's on our network now, let's throw up an alert.

219
00:25:28,740 --> 00:25:32,420
So there's some other advanced topics.

220
00:25:32,700 --> 00:25:37,700
But again, this is just something down and dirty that you can do that might save you some grief.

221
00:25:37,700 --> 00:25:41,780
And anything that lowers the percentage chance of me getting exploited.

222
00:25:41,900 --> 00:25:47,620
And that cost is low and the benefit is relatively high, is a good thing to me.

223
00:25:48,120 --> 00:25:49,280
Any other questions?

224
00:25:51,540 --> 00:25:52,500
Great.

225
00:25:52,660 --> 00:25:53,360
Thanks for coming.

226
00:25:53,360 --> 00:25:54,400
I really appreciate it.

227
00:25:54,400 --> 00:25:56,040
And have a good show.