On Sat, Feb 22, 2003 at 09:25:24AM -0500, William Allen Simpson wrote:
Doug Clements wrote:
Which is it? Where do you draw the line between something that's big enough to block forever and something that's not worth tracking down?
Where it causes a network meltdown. The objective reality is pretty clear to some (many? most?) of us.
I see. So you're still filtering port 25 from the Morris sendmail worm. The issue I had with your argument is "forever". You should realize as well as anyone that the course of software development and implementation will mitigate the threats of the slammer worm until it's nothing more than a bad memory.
Filtering is not fun. That's why I'm trying to get everyone to cooperate in eradication of this particular problem, so that we could drop filters. (Look at the subject line.)
The first step in eradication is detection. I presume that since you're taking this stance, you're checking your filter logs and attempting to notify the appropriate partys for each hit. If you're not, then our buddy trying to infect all the machines on his network every so often is being more effective in wiping out the worm.
Right now, whether you know it or not, filtering is all that's holding the Internet as a whole together.... If you didn't filter, you're actually depending on the good graces of the rest of us that did!
If you "didn't" filter or "don't" filter? We definately filtered when the worm first came out. We don't block port 1433 anymore (nor does any of our upstreams), but we still report suspicious traffic. Regardless of what everyone else is doing, the worm is not causing a meltdown anymore. The correct course of action is to remove filters as resources allow, and investigate infected machines as they are noticed. I'm sorry, but I'm not seeing your case for implementing permament filters for this or anything else. --Doug