Re: [fw-wiz] firewall rule lifecycle management

From: Victor Williams (vbwilliams_at_neb.rr.com)
Date: 09/01/05

  • Next message: Paul D. Robertson: "Re: [fw-wiz] stopping bots from phoning home"
    To: Martin <marty@supine.com>
    Date: Wed, 31 Aug 2005 21:03:38 -0500
    
    

    True.

    That's why I've started commenting rules, or groups of rules. Then I
    can go back later and determine if they are actually needed.

    Martin wrote:
    > $quoted_author = "Bruce Smith" ;
    >
    >>From my PIX experience, clear rule counters every month. After a while, look
    >>for the rules that have zero counts and then remove them. Can be scripted
    >>and searched with grep.
    >
    >
    > that's a neat way of picking up dormant rules, but you'd still need to
    > review them manually to identify rules that should no longer be in place
    > even if traffic is still matching them.
    >
    > cheers
    > marty
    >
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards


  • Next message: Paul D. Robertson: "Re: [fw-wiz] stopping bots from phoning home"

    Relevant Pages

    • its very australian, Ill prove partly or Moammar will spend the takeovers
      ... marked firms. ... Martin will sadly force afterwards. ... Marty never puts until Aneyd isolates the oral isle inevitably. ... owes Kareem, it alters Angelo instead. ...
      (sci.crypt)
    • Re: Iowa Primary
      ... recall seeing your quoted advice previously. ... And Martin did indicate the subject in his Subject line. ... I agree (although I would never have dared refer to the OP as Marty) but only because it gives me the opportunity to comment on the phrase "Iowa caucuses" which I find difficult to take seriously as it reminds me of dodos. ...
      (alt.usage.english)
    • Re: Iowa Primary
      ... don't recall seeing your quoted advice previously. ... And Martin did indicate the subject in his Subject line. ... I agree (although I would never have dared refer to the OP as Marty) but only because it gives me the opportunity to comment on the phrase "Iowa caucuses" which I find difficult to take seriously as it reminds me of dodos. ...
      (alt.usage.english)
    • Re: snip retarded numbers.
      ... I gave up looking at Lost, after the first series, have they gone hex? ... Are you really so retarded, Marty, that you had to repost the damned ...
      (sci.electronics.design)
    • Re: Problem
      ... Hi Martin, ... This looks kind of similar to the problem I asked a few days ago in the thread "newbie: Out of local stack, matching values from 0 to 10". ...
      (comp.lang.prolog)