The Internet Storm Center relies heavily on firewall data, to obtain an accurate measure of current Internet threats. It is in particular important to collect data from very diverse submitters, not just from a few large submitters. If you are not already submitting data, here a few tips on how to get started:

First of all: No submitter is too small. In particular cable modem / DSL user data is frequently the most interesting. We can always use more home users submitting data.

If you are able to submit from a large network, try to pick a few IP addresses and only send data from these IP addresses (e.g. a /24). A simple 'grep' may be all thats needed to filter the data, and our prewritten clients can help you with that.

We are interested in rejected packets from the outermost firewall you have access to. All rejected packets that originate from outside of your network are of interest.

We do accept logs via e-mail. It is recommended that you submit your logs about once an hour, but not less then once a day. We do provide a number of scripts to automated the process.

The best reference to get you started is http://www.dshield.org/howto.php. As a quick summary:

• Windows Users

• Unix Users

• Others

We do provide a number of customized analysis features for submitters, which are accessible via DShield.org. For a Demo, see our demo-account.