Help me

From: Tran Nguyen Vu (tran.vunguyen_at_gmail.com)
Date: 02/21/05

  • Next message: Kevin Conaway: "Re: Free Webmail w/ SSL?" 
    Date: 21 Feb 2005 11:20:01 -0000
To: security-basics@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Dear all,
    I have a problem and i dont know how to explain.
    Last month, my ISP give our company a report about the capacity download and upload, It was about 47GB.
    The problem is my isa server has logged at about 7GB data down/upload.
    When I asked them explain this great unequal capacity they said that although My isa firewall prevented almost requests from the untrust network (so this request was not included in capacity logfile and only 7GB was allowed),their server logged all requests to my router and firewall from the other local Loop . It mean, there are 40GB data of requests that not except (attack, scan ping ...) in a month.
    So I make some caculation, every second, there are 16035 byte attack (I call "attack" because I was not allowed.
    Everybody help me explain this situation. I know, A request does not have big capacity and my ISA server was not logged any attack!

    Please help me. (sorry because of my english!)
    Thanks in advance.

  • Next message: Kevin Conaway: "Re: Free Webmail w/ SSL?"

    Relevant Pages

    • RE: SBS Sp1 - ISA2004 - IP Half scan attacks
      ... alert warning that ISA Server detected an Internet Protocol half-scan ... an attack is attempted against your network. ... If you have enabled the intrusion detection on ISA, ...
      (microsoft.public.windows.server.sbs)
    • Re: Question about rsync
      ... server, through your switches and gateways on to your ISP, through the ... internet infrastructure, and back out at the other side" ... methodof attack as you. ... - the idea that you *always* need strong encryption for any transfer can ...
      (comp.os.linux.networking)
    • Re: Web site being attacked!
      ... My advice is to contact the ISP that owns the IP address of the attacker ... block the attacks, until the attack patterns change again. ... Yes, you want "IISlockdown" which contains URLscan, install all microsoft ... The Netscreen 5XP is a real commercial grade firewall with the same features ...
      (microsoft.public.win2000.security)
    • Re: SBS Sp1 - ISA2004 - IP Half scan attacks
      ... > alert warning that ISA Server detected an Internet Protocol half-scan ... > an attack is attempted against your network. ... > alerts. ... If you have enabled the intrusion detection on ISA, ...
      (microsoft.public.windows.server.sbs)
    • Re: Dealing with script kiddies
      ... If I get a repeated attack ... and if I'm pissed because the bagel place was out of garlic ... >> to law enforcement networks, including the FBI, so I can let the ISP ... > security, not the technical side, so I'm not always _au courant_ with the ...
      (microsoft.public.inetserver.iis.security)