Educause Security Discussion mailing list archives

Re: HEOA Question


From: Cal Frye <cjf () CALFRYE COM>
Date: Mon, 31 Jan 2011 16:58:14 -0500

On 1/31/11 2:27 PM, Jacobson, Dick wrote:
We handle the time differentials similarly.

If the reported time does not show a connected user, and I can be
assured that our server time is (and has been) accurate, and the network
folks do not have anywhere else to check (netflow, other logs) then I
will ask the reporting party to check their timestamps (and suggest they
synch against one of the official time servers) since “I have no user
connected to that IP number at that time.”

Yep. The best effort I do here is to check for timezone errors, i.e.
reporting a timestamp in GMT which is actually EST or vice-versa.
Outside of that, if the time doesn't match, it's not a valid notification.

-- 
Best regards
-- Cal Frye, Network Administrator, Oberlin College
   Mudd Library, x.56930 -- CIT will NEVER ask you for your password!

   www.calfrye.com,  www.oberlin.edu/cit/

"The best reason to give a child a good school . . . is so that child
will have a happy childhood, and not so that it will help IBM in
competing with Sony." -- Jonathan Kozol.


Current thread: