> -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[email protected]] On Behalf > Of No Name Available > Sent: 24 April 2009 00:28 > To: [email protected] > Subject: Re: [FW-1] Issues with Conficker/DownadUp Virus > > Thank you for your response. Sorry I should have mentioned > there is a delay in receiving these messages and by the time > we do we no longer have the log files for the time in the > notices as they have been cleared. > Ideally I would like to use whatever they are to detect the > botnet activity. I have tried contacting my ISP but have not > been successful. > > Scott Wiebe, IT Specialist, Telvent Outsourcing 200 -10333 > Southport Rd. S.W., Calgary, AB, Canada, T2W3X6 > Tel: +1 (403)212-2292 Fax: +1 (403) 253-7634 > Email: [email protected] > Calgary, Alberta, Canada > > >
Can you enable logging, or at least retain/archive logs from here on out until you have this issue sorted? If you don't have logs, then you are going to have run something like "fw monitor -o <filename>.out" from the firewall and use Wireshark or something similar to analyse the data in <filename>.out. Are you familiar with fw monitor? It's going to be a bit of a tedious process, mind. You can use the -e switch to specify a filter so specify the IP of the NIC that's defined as your externally facing interface. Something like fw monitor -o monitor.out -e "accept src=1.2.3.4;" should work I believe. Use Wireshark then to see if any of the source ports from your ISP are listed in monitor.out and begin with those machines. Might not get all compromised machines but you should get a few. One thing to note is, you better have some decent space available where you are running this command, because if the logs from your ISP are anything to by, you are going to need to let this run for at least 10 minutes. Depending on how much traffic goes through the firewall, you could be generating a huge file here. later, eamonn Confidentiality Notice: This electronic message contains information that is privileged or confidential, is the property of QC Data, and is intended only for the use of the intended recipient. If you are not the intended recipient, you are hereby notified that disclosure, copying, distribution or use of this information is prohibited. If you have received this message in error, please delete the original message and any copy of it in your possession and notify us by telephone or email immediately. QC Data (Ireland) Limited Registered in Ireland, Number: 158091 VAT Registration No.: IE 6556091K Registered office: 90 South Mall, Cork, Republic of Ireland. Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
