Re: Firewall(s) "maxed" out

[Joseph S D Yao <jsdy () cospo osis gov>]

> During the past two days, both of these firewalls became "maxed" out, for
> lack of a better term.  Specifically, both machines had reached their
> maxtask limits and could no longer fork any new processes.  A check of the
> systems revealed very large numbers of HTTP connections from individual
> internal client workstations.  
>
> Does anyone know of some "new" browser plug-in or service pack which could
> be responsible for this ??  ...

Tell your users to keep JavaScript turned off when browsing the
publicly accessible Internet, especially when browsing their porn
sites.  ;-}  We had noticed in our firewall logs that some users
visiting sites meriting reprimand had all of a sudden blossomed dozens
within seconds.  We also found out why.

Also, make sure that your users have internal domains in their
Exceptions or No-Proxy lists.  Otherwise, all attempts to hit internal
Web sites will be mediated by the Web proxy.

--
Joe Yao                         jsdy () cospo osis gov - Joseph S. D. Yao
COSPO/OSIS Computer Support                                     EMT-B
-----------------------------------------------------------------------
        PLEASE ... send or Cc: all "COSPO/OSIS Computer Support"
                     mail to sys-adm () cospo osis gov
-----------------------------------------------------------------------
      This message is not an official statement of COSPO policies.