If you do detect threats, be sure to DNS the IP and find out the ISP and report it to them, even if you don't know who it is or not.
this is where you might be able to help me out
in zonealarm, i have at least 20 "high-rated" intrusions a day, but some are from irc networks proxy scanners, it's really quite hard to tell whether certain intrusions were malicious or not.
most of the intrusions have TCP flags: S (i'm guessing this is a syn packet?), and i can never really decide whether to report it or not.
any ideas?
