|
That
will obviously be much better. However, I still would hesitate to allow my
provider complete control over my router. I have quite a few "Tweaked"
routers, we run wccp, cef and a few other things that I need to know are running
correctly. Just my .02, Not being a smart ass or
anything.
Scott
Well that is true if I had a Cisco router I would
be able to do that but megapath gave me this cheesy Siemens router and they
did not install any kind of firewall software installed so I cant make any
rules in it or I would have done this long ago. The attack stopped so I am not
to worried anymore.. but you are right with the new managed router from
AT&T I will request certain IP schemes to be blocked..
----- Original Message -----
Sent: Thursday, September 11, 2003
10:15 AM
Subject: RE: [smartBridges] HELP net
traffic and where is it coming from
It
is not really your providers problem. If you are an ISP, you need to
know how to manage your router. That is not meant to be a slam or
anything, but if you have traffic coming into your network, you need to know
where it is from and how to manage it.
Scott
I don't have ping.exe in there?? I also tried
ICMP I am calling my provider to block both their class C blocks from ever
getting to me. My partner went to go pay them a visit OHH man I feel sorry
for them HE IS PISSED!
----- Original Message -----
Sent: Thursday, September 11, 2003
9:25 AM
Subject: Re: [smartBridges] HELP
net traffic and where is it coming from
On your Win2K box, go to 'Services' and
look for ping.exe.
----- Original Message -----
Sent: Thursday, September 11,
2003 9:42 AM
Subject: Re: [smartBridges] HELP
net traffic and where is it coming from
Well it does not appear to be the mail
linux box as much as it is the dns server win 2000 what's strange is I
can physically unplug the cable from the box and the outgoing traffic
stops yet the incoming is still going??? I unplug the wan and it goes
away..
----- Original Message -----
Sent: Thursday, September 11,
2003 8:30 AM
Subject: RE: [smartBridges]
HELP net traffic and where is it coming from
If you are running an old linux box that you don't have a
root password for, that means it is more than likely out of date as
far as patches go. That means it could possibly be "Rooted"
and that is not a good thing!!! There are alot of DNS DDOS
attachs out there, I would download ethereal and watch the traffic
VERY closely for a couple of hours.
Scott
I have Brilan bandwidth control and
for kicks I put my servers behind it and just yesterday I noticed
that I have a steady 250kbps up and down on my DNS and my mail
server I unplug the Lan connection to my T-1 and the problem goes
away so I know it is not my wireless customers? I did a sweep and
found nor worms on my 2000 machine I do have Linux 6.4 machine
that I don't know root so cant run any kind of scan but it appears
that it is coming from the WWW? how can I tell what IP or where
this is coming from its almost like a DNS??? things are
functioning normal but a little slow since this is taking some of
the bandwidth?? can or would my ISP (megapath) be able to tell
where it is coming from???
I have a strange feeling the WAR has
started between me and the competition since they threatened to do
something for their 3 customers jumping ship and coming to me
because of their poor service!
I have TCP IP Dump but cant really
see any thing specific to those IP addresses??
|
