firewall-wizards Digest, Vol 43, Issue 5

Send firewall-wizards mailing list submissions to
firewall-wizards@listserv.icsalabs.com

To subscribe or unsubscribe via the World Wide Web, visit
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
or, via email, send a message with subject or body 'help' to
firewall-wizards-request@listserv.icsalabs.com

You can reach the person managing the list at
firewall-wizards-owner@listserv.icsalabs.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of firewall-wizards digest..."

Today's Topics:

1. Re: Message Labs (shane brennan)
2. Re: port scanning activity going up recently? (Nate Itkin)
3. Re: Message Labs (A)

----------------------------------------------------------------------

Message: 1
Date: Sun, 15 Nov 2009 14:18:09 +0000
From: shane brennan <wiserwaylander@gmail.com>
Subject: Re: [fw-wiz] Message Labs
To: Firewall Wizards Security Mailing List
<firewall-wizards@listserv.icsalabs.com>
Message-ID:
<d39f09aa0911150618l40572adds7d504b132c3734e0@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Hi

We use it in work. havent received any notification like that

Shane

On Tue, Nov 10, 2009 at 9:06 PM, Brian Loe <knobdy@gmail.com> wrote:
> Anyone here using message labs? Have you received notice that you MUST
> open up your firewall for 8 or so networks?
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@listserv.icsalabs.com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>

------------------------------

Message: 2
Date: Sun, 15 Nov 2009 12:11:35 -1000
From: Nate Itkin <fw-wizards@konadogs.net>
Subject: Re: [fw-wiz] port scanning activity going up recently?
To: firewall-wizards@listserv.cybertrust.com
Message-ID: <200911152211.nAFMBZXR009411@ns1.konadogs.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Overall illicit activity looks to be down slightly.
see: http://www.dshield.org/submissions.html (select sources, targets,
and reports for 2009)

Cheers,
Nate Itkin

On Fri, Nov 13, 2009 at 12:16:21PM -0500, Ken Fox wrote:
> Hi all -
> Has anyone else noticed a recent spike in port scan activity over the last
> few days?
> I've been seeing some interesting traffic where multiple source addresses
> are probing a number of the same high order destination ports from a small
> set of source ports with a number of different but specific packet sizes.
> e.g.: source port 3268 -> dest port 50572 packet size 48, 60, 64, and 52
> egg: source port 3268 -> dest port 50592 packet size 48, 60, 64, and 52
> Is there some botnet out there that I haven't heard about?
> thanks -- ken

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBSwB6mjCWEYiadXeZAQiI/Qf/YcDpdRG9QKfHxrQV7nKrLx9DUUuKhEA6
mHLrtmmTQwtbJARIlErtdgal9EuJxGFnrAAKWYaPjaIUDj/21AZ03x06pRX6tKWD
LNLm0jOPZZBom4rnMyssDQ96tqN/9pnrLHEd8wr6D3DzgT0X33KifDKEkhgv40l8
Q4jhvJBGrgZcqPPCH7MMGhLX7qVYNWLDAyIf11uROlb8FRiRlW7Qholn4Baor40/
tEB6SuuFh7SoH76My2rCv94Co62Q7NqT9tMZrBf8jzeeG/SveUv6ymhORX75XLZi
KEXPTjj0G+1tiQYdkXLBIK75xta9V0fdc9UEf8OCMJHO3/bvMbfK0g==
=u9Ix
-----END PGP SIGNATURE-----

------------------------------

Message: 3
Date: Mon, 16 Nov 2009 21:36:52 +1100
From: A <clonemeagain@gmail.com>
Subject: Re: [fw-wiz] Message Labs
To: Firewall Wizards Security Mailing List
<firewall-wizards@listserv.icsalabs.com>
Message-ID:
<306c20fc0911160236v136a0a81ib07a2cde647c0ed3@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Yeah, its if you are using their mail-filtering service, for them to
be able to send you mail you have to allow the ip ranges.

Most people will lock down the router to only accept email from the
hosted security provider.. to reduce spam.

Aaron

\ /
Putting the F in BOFH!

2009/11/11 Brian Loe <knobdy@gmail.com>:
> Anyone here using message labs? Have you received notice that you MUST
> open up your firewall for 8 or so networks?
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@listserv.icsalabs.com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>

------------------------------

_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

End of firewall-wizards Digest, Vol 43, Issue 5
***********************************************