For what it's worth, this doesn't change my original
assessment -- the messages are coming from within
your network, so they don't represent a security
threat.

Having said that, best practice is to always keep
all of your systems (both MS and non-MS) up to date
with the latest security patches, even if they are
behind a firewall.  This is especially true of
security patches for the browser, since the firewall
can't protect you from that.

Mike Burden
Lynk Systems
http://www.lynk.com
(616)532-4985
[EMAIL PROTECTED]



> -----Original Message-----
> From: Steve Leach [mailto:[EMAIL PROTECTED]] 
> Sent: Monday, January 28, 2002 9:25 AM
> To: Mike Ayers
> Cc: [EMAIL PROTECTED]
> Subject: Re: [gb-users] MSN Messenger Filter Blocks
> 
> 
> This (I believe) is attributable to some sort of PNP 
> broadcast in Windows
> XP - see these links:
> 
> http://xforce.iss.net/alerts/advise106.php
> 
> http://www.eeye.com/html/Research/Advisories/AD20011220.html
> 
> Best Regards,
> 
> Steve Leach
> Network Manager
> Miami International Limited
> Eaglescliffe Logistics Centre
> Durham Lane
> Egglescliffe
> URL: http://www.askalix.com
> TEL: 01642 356205
> e-mail: [EMAIL PROTECTED]
> 
> 
> ----- Original Message -----
> From: "Mike Ayers" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Monday, January 28, 2002 2:14 PM
> Subject: [gb-users] MSN Messenger Filter Blocks
> 
> 
> We are getting a steady stream of filter blocks on the protected
> interface as shown below.  They are apparently coming from MSN
> Messenger.  Does anyone know if these packets constitute a security
> risk?  And if not, which filter do I need to modify to stop logging
> this?
> 
> --------------------------------------------------------------
> ----------
> -----
> NOTIFICATION TYPE: GNAT Box FILTER ALARM
>     CONFIGURATION: PROTECTED=192.168.0.1
> --------------------------------------------------------------
> ----------
> -----
>      ALARM NO: 1
>          DATE: Monday, Jan 28, 2002
>          TIME: 07:58:27
>     INTERFACE: PRO (rl0)
>    ALARM TYPE: Block
>     IP PACKET: UDP  [192.168.0.227/1218]-->[192.168.0.1/1900]  l=132
> 
> 
> 
> Thanks,
> 
>   _____
> 
> Mike Ayers
> [EMAIL PROTECTED]
> 
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> To subscribe to the digest version first unsubscribe, then
>  e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
> 
> 

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
To subscribe to the digest version first unsubscribe, then
 e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to