everfresh1 wrote
And what is solution for this ?
Good question. Thinking about it now, what do you see as being your available options. I can see two realistic options.
(i) Real-time traffic monitor. When client is doing bad behavior, the system will cut client connection (with IPTABLES or certificate revocation).
(ii) Logging. When your datacenter notifies you of a bad behavior from client, you sort through traffic logs (if you keep traffic logs), and ban the user manually. Report back to the datacenter that you have terminated the client's account.
Ideally, you would want to have both methods in place. Real-time monitor would be useful for high-risk activity such as DOS and PORTSCAN attack detection. Logging would be useful for copyright infringements. If you value your client's privacy, then you might want to log in a way which doesn't link to their real IP.
