Home page logo
/

nanog logo nanog mailing list archives

Re: M$SQL cleanup incentives
From: "Doug Clements" <dsclements () linkline com>
Date: Sat, 22 Feb 2003 12:40:39 -0800


On Sat, Feb 22, 2003 at 09:25:24AM -0500, William Allen Simpson wrote:
Doug Clements wrote:
Which is it? Where do you draw the line between something that's big
enough
to block forever and something that's not worth tracking down?

Where it causes a network meltdown.  The objective reality is pretty
clear to some (many? most?) of us.

I see. So you're still filtering port 25 from the Morris sendmail worm.

The issue I had with your argument is "forever". You should realize as well
as anyone that the course of software development and implementation will
mitigate the threats of the slammer worm until it's nothing more than a bad
memory.

Filtering is not fun.  That's why I'm trying to get everyone to
cooperate in eradication of this particular problem, so that we could
drop filters.  (Look at the subject line.)

The first step in eradication is detection. I presume that since you're
taking this stance, you're checking your filter logs and attempting to
notify the appropriate partys for each hit.

If you're not, then our buddy trying to infect all the machines on his
network every so often is being more effective in wiping out the worm.

Right now, whether you know it or not, filtering is all that's holding
the Internet as a whole together....  If you didn't filter, you're
actually depending on the good graces of the rest of us that did!

If you "didn't" filter or "don't" filter? We definately filtered when the
worm first came out. We don't block port 1433 anymore (nor does any of our
upstreams), but we still report suspicious traffic. Regardless of what
everyone else is doing, the worm is not causing a meltdown anymore. The
correct course of action is to remove filters as resources allow, and
investigate infected machines as they are noticed.

I'm sorry, but I'm not seeing your case for implementing permament filters
for this or anything else.

--Doug


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]