expiration time of INTRUDER

[Davor_7]

nope~ Miller, i donot think so
John said:
"Each time a new suspect event occurs, the expiration time for that source is incremented by a random time period (between 0.5 and 1.5 times LGI_BRK_TMO). "
it's talking about the SUSPECT and LGI_BRK_TMO.
here, my data is all about INTRUDER and HID_TIM, different scope :)

what's your idea about it?

[Peter Barkas]

John G's explanation works for me.

Presumably the intruder timings are added to the suspect timings and therefore the suspect timer randomness applies to the intruder as well? For there to be randomness for suspects but not for intruders would seem illogical.

[Davor_7]

but Peter
after my several testing, the SUSPECT timer has no randomness problem. it stictly increases the LGI_BRK_TMO(30 mins) per trial
SUSPECT 1 16:30:34
SUSPECT 2 17:00:36
SUSPECT 3 17:30:40

i only find the randomness on INTRUDER...

[Wim Van den Wyngaert]

Don't understand it either.

I did a test generating an intruder in a script.

For suspect it works as described but for intruder ? After 50 intrusions the penalty is still only 1 minute.

John : what do you exactly mean with sliding window ?

Why ?

Wim

[Wim Van den Wyngaert]

Oeps. The intervals are not added. After each login failure 60 seconds are re-applied.

But the 60 seconds seem to be randomized with a value between 1 and 6 seconds (or is it 10% ?), not 0.5 and 1.5.

Wim

[Davor_7]

Yes Wyngaert!
you got the same question i want to ask~

[Wim Van den Wyngaert · Accepted solution]

It sure seems to be 10%, I tested with other lgi_hid_tim values.

But it never is negative. So, Davor, in your test it should be between 30 and 33 minutes.
I guess there is some delay between your show time and the intruding time that decreased.

Wim

[Davor_7]

oh~ i'm not so sure about it
but i can do further testing tomorrow and give you the result in time :)

thank you for your reply to clarify my question.
i appreciate that:)

[John Gillings]

Davor, Wim,

Good, I'm glad you find it difficult to predict the expiration time, that it the INTENTION of the algorithm.

All you need to know is higher values of LGI_BRK_TMO and LGI_HID_TIM will cause the expiration time to be longer, and lower values shorter. The exact result is deliberately chaotic and subject to change.

Why? So that even folk who know what's happening cannot predict in advance when they can start trying again.

[Davor_7]

thanks John~!
thanks all!

i will do some further investigation on Oct.
this month i will work on SLS

sincerely thanks to your reply~ :)