IDS mailing list archives
Re: Router/Switches and viruses
From: Derek Nash <ddnash () gmail com>
Date: Thu, 5 May 2005 08:52:04 -0500
We saw it all the time at the ISP I worked for. A PC would pickup up a nasty scanning type virus, SQL Slammer comes to mind, and would take up all the NAT/PAT translation slots on a router/firewall. Routers running NAT remain susceptible to this vulernability to my knowledge. Most modern firewalls have source-based session limiting to prevent this type of DOS. Lastly I have seen HP Procurve Switches lock up from a port scan. This is a known issue that has been fixed with a firmware upgrade. On 5/3/05, Seek Knowledge <aseeker03 () yahoo com> wrote:
Does anyone have any first-hand experience with a single infected desktop machine (or windows server for that matter) taking out a LAN switch? Would anyone have any stories from the trenches of an infected machine causing a directly connected router to stop functioning? If so, what could be done to prevent such an outage? What IDS/IPS strategy might one implement to prevent and or at least detect such an event? Thanks in advance. ASeeker ________________________________________________________________________ Yahoo! Messenger - Communicate instantly..."Ping" your friends today! Download Messenger Now http://uk.messenger.yahoo.com/download/index.html -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
-- Derek Nash; CISSP, CCSP, NCSP, MCSE -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Router/Switches and viruses Seek Knowledge (May 04)
- Re: Router/Switches and viruses Per Engelbrecht (May 06)
- Re: Router/Switches and viruses Derek Nash (May 06)
- Re: Router/Switches and viruses Robert Holtz (May 06)
- Re: Router/Switches and viruses Kevin (May 06)
- Re: Router/Switches and viruses Jason Haar (May 06)
- RE: Router/Switches and viruses Wolfpaw - Dale Corse (May 09)
- <Possible follow-ups>
- Re: Router/Switches and viruses Chris Byrd (May 06)
- RE: Router/Switches and viruses Steven Williams (May 09)
- RE: Router/Switches and viruses THolman (May 19)