OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Best way to filter "Nachi pings"?

From: Brett Glass (brettlariat.org)
Date: Mon Oct 27 2003 - 07:20:55 CST

At 04:23 AM 10/27/2003, Ross Wheeler wrote:

>The "best" option is to actively monitor for this worm (its NOT difficult,
>a few lines of awk and tcpdump does fine here), *DETECT* the worm on your
>customers machine, mail them, mail your support team and BOOT THEM.

That's assuming it's your customer. We're being flooded from OUTSIDE.
There seem to be approximately one zillion hacked Windows machines
out there, and zero inside our networks (because we're blocking the
appropriate ports). We've had only one infection behind that particular
router, and it came when someone brought in a laptop that had been
connected elsewhere.

--Brett

_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"