🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.firewalls
Article #308

Re: sub-7 - 24.112.208.13; netbus - 216.112.169.221 (Was: Smurf amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13.3...

#308
From: John Navas
Date: Sun, 27 Feb 2000 00:00
31 lines
2799 bytes
[POSTED TO comp.dcom.modems.cable]
Spam Trap <usenetspamtrap@newsguy.com> wrote:

>I did that, and received two contradictory replies (not including the
>auto-acks from @Home's abuse department):
>
>1. A personal reply from the NOC (at a few minutes past midnight):
>"Thank you for bringing this to our attention. I have gone through and
>disabled all of the offending customers. My apologies for the delay.
>The abuse department will follow up with each of these customers."
>
>2. A from letter Customer Service:
>"As an always-on connection,  you are likely to see many packets of
>data  that are stopped as "intrusions" when they really are nothing
>more than  normal packets.  ...
>
>Who is correct? From the logs, and from what I could look up on-line
>(e.g., http://www.sonicwall.com/firewall-pro/dos_attacks.html,
>http://www.robertgraham.com/pubs/firewall-seen.html), it appears the
>notice from the firewall was accurate. My inclination is to *not* send
>logs to customer service anymore (I cc'd them) - I think the form
>letter is a brush-off to have you contact abuse.

Correct.  Customer Service is technically clueless.  NOC (network
operations center) is what matters.  Your firewall is doing its job -- be
glad you have it.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
CABLE/DSL TIPS:  <http://navasgrp.home.att.net/tech/cable_dsl.htm>
Technical Details
Message-ID: <f00jbs8fphi3isch4uq6hejk1q57r1ji1r@4ax.com>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 100e10,4940de17635e6780
X-Google-Attributes: gid100e10,public
X-Google-Thread: f922c,4940de17635e6780
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10f392,60b7cb6f8866452b,start
X-Google-Attributes: gid10f392,public
X-Google-Thread: 113850,4940de17635e6780
X-Google-Attributes: gid113850,public
X-Google-Thread: fa51b,60b7cb6f8866452b,start
X-Google-Attributes: gidfa51b,public
From: John Navas <spamfilter@navasgrp.dublin.ca.us>
Subject: Re: sub-7 - 24.112.208.13;  netbus - 216.112.169.221 (Was: Smurf amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13.39, 24.13.156.131, 24.8.18.47)
Date: 2000/02/27
Message-ID: <f00jbs8fphi3isch4uq6hejk1q57r1ji1r@4ax.com>
X-Deja-AN: 590556442
Content-Transfer-Encoding: 7bit
References: <t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com>
Followup-To: comp.dcom.modems.cable
Content-Type: text/plain; charset=us-ascii
X-Complaints-To: abuse@swbell.net
X-Trace: news.swbell.net 951681222 209.233.23.56 (Sun, 27 Feb 2000 13:53:42 CST)
Organization: The Navas Group, Dublin, CA, USA
MIME-Version: 1.0
NNTP-Posting-Date: Sun, 27 Feb 2000 13:53:42 CST
Newsgroups: comp.security.firewalls,comp.dcom.modems.cable,cableinet.cable_modems,sdnet.cablemodems,alt.cable-tv.tci-digital