<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content=Word.Document name=ProgId>
<META content="MSHTML 6.00.2600.0" name=GENERATOR>
<META content="Microsoft Word 10" name=Originator><LINK
href="cid:filelist.xml@01C162CE.26D89E00" rel=File-List><!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:DoNotRelyOnCSS/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:EnvelopeVis/>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
</w:WordDocument>
</xml><![endif]-->
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; mso-header-margin: .5in; mso-footer-margin: .5in; mso-paper-source: 0; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; mso-style-parent: ""; mso-pagination: widow-orphan; mso-fareast-font-family: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline; text-underline: single
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline; text-underline: single
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline; text-underline: single
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline; text-underline: single
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose; mso-style-noshow: yes; mso-ansi-font-size: 10.0pt; mso-bidi-font-size: 10.0pt; mso-ascii-font-family: Arial; mso-hansi-font-family: Arial; mso-bidi-font-family: Arial
}
SPAN.SpellE {
mso-style-name: ""; mso-spl-e: yes
}
SPAN.GramE {
mso-style-name: ""; mso-gram-e: yes
}
DIV.Section1 {
page: Section1
}
</STYLE>
<!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";}
</style>
<![endif]--></HEAD>
<BODY lang=EN-US style="tab-interval: .5in" vLink=purple link=blue
bgColor=#ffffff>
<DIV><FONT size=2>Shawn,</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>If downstream clients are infected with NIMDA or any of
the same MS</FONT></DIV>
<DIV><FONT size=2>virus variants you should:</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>(1) Send them a nice note and tell them they are infected and
causing</FONT></DIV>
<DIV><FONT size=2> problems upstream (include
hostnames and IP addresses)</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>(2) Request that they fix the problem in FOO
hours. If they do not</FONT></DIV>
<DIV><FONT size=2> then outbound port 80 traffic
for the offensive IP address will</FONT></DIV>
<DIV><FONT size=2> be blocked (at the edge
router). (Suggest FOO=24)</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>(3) Explain that the block/filter will be
removed when virus is </FONT></DIV>
<DIV><FONT size=2> cleansed and
vulnerability mitigated.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Based on the relationshop of upstream/downstream ISPs
and</FONT></DIV>
<DIV><FONT size=2>'who is on the most outside edge'...... different blocking
strategies</FONT></DIV>
<DIV><FONT size=2>may be applied. This is an 'SLA issue' between client
and provider.</FONT></DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><BR>Finest
Regards, Tim</DIV>
<DIV> </DIV>
<DIV><A href="http://www.silkroad.com">www.silkroad.com</A><BR></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=sgyorfy@elinkny.com href="mailto:sgyorfy@elinkny.com">Gyorfy,
Shawn</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=nanog@merit.edu
href="mailto:'nanog@merit.edu'">'nanog@merit.edu'</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, November 01, 2001 12:12
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Nimba Question.</DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hey what's going
on?<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><SPAN class=GramE><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Question for you
all.</SPAN></FONT></SPAN><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><SPAN
style="mso-spacerun: yes"> </SPAN>We are a BLEC, we give each building a
T1 and router and back haul the circuit to our NOC were we distribute the
packets to our service providers. <SPAN
style="mso-spacerun: yes"> </SPAN>The problem I see, some of our clients
in the building, there computers are infected with the NIMBA virus / Code
Red.<SPAN style="mso-spacerun: yes"> </SPAN>I get emailed from firewall
administrators about the possible port scan, and then I disconnect the
customer until he updates his servers and cleans them.<SPAN
style="mso-spacerun: yes"> </SPAN>I was wondering if I can do anything
on my end to prevent the <SPAN class=SpellE>Nimba</SPAN> going out on my end.
<SPAN style="mso-spacerun: yes"> </SPAN>I have been reading about Cisco's
NBAR feature with class maps but I don't want to put that on the core because
it will kill the box (Cisco 10K ESR, (2) 7507, (2) 7206). <SPAN
style="mso-spacerun: yes"> </SPAN>Plus <SPAN class=SpellE>cisco</SPAN>
stated that it can only hand 24 concurrent web hits. So that's out.<SPAN
style="mso-spacerun: yes"> </SPAN>I was also thinking about putting that
on the building routers but 75% aren't Cisco, they are Lucent Access
Points.<SPAN style="mso-spacerun: yes"> </SPAN>Any suggestions would be
appreciated.<SPAN style="mso-spacerun: yes">
</SPAN><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><SPAN class=SpellE><SPAN class=GramE><FONT face=Arial
size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">shawn</SPAN></FONT></SPAN></SPAN><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">. <SPAN
style="mso-spacerun: yes"> </SPAN><o:p></o:p></SPAN></FONT></P></DIV></BLOCKQUOTE></BODY></HTML>