For what it's worth, this doesn't change my original assessment -- the messages are coming from within your network, so they don't represent a security threat.
Having said that, best practice is to always keep all of your systems (both MS and non-MS) up to date with the latest security patches, even if they are behind a firewall. This is especially true of security patches for the browser, since the firewall can't protect you from that. Mike Burden Lynk Systems http://www.lynk.com (616)532-4985 [EMAIL PROTECTED] > -----Original Message----- > From: Steve Leach [mailto:[EMAIL PROTECTED]] > Sent: Monday, January 28, 2002 9:25 AM > To: Mike Ayers > Cc: [EMAIL PROTECTED] > Subject: Re: [gb-users] MSN Messenger Filter Blocks > > > This (I believe) is attributable to some sort of PNP > broadcast in Windows > XP - see these links: > > http://xforce.iss.net/alerts/advise106.php > > http://www.eeye.com/html/Research/Advisories/AD20011220.html > > Best Regards, > > Steve Leach > Network Manager > Miami International Limited > Eaglescliffe Logistics Centre > Durham Lane > Egglescliffe > URL: http://www.askalix.com > TEL: 01642 356205 > e-mail: [EMAIL PROTECTED] > > > ----- Original Message ----- > From: "Mike Ayers" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, January 28, 2002 2:14 PM > Subject: [gb-users] MSN Messenger Filter Blocks > > > We are getting a steady stream of filter blocks on the protected > interface as shown below. They are apparently coming from MSN > Messenger. Does anyone know if these packets constitute a security > risk? And if not, which filter do I need to modify to stop logging > this? > > -------------------------------------------------------------- > ---------- > ----- > NOTIFICATION TYPE: GNAT Box FILTER ALARM > CONFIGURATION: PROTECTED=192.168.0.1 > -------------------------------------------------------------- > ---------- > ----- > ALARM NO: 1 > DATE: Monday, Jan 28, 2002 > TIME: 07:58:27 > INTERFACE: PRO (rl0) > ALARM TYPE: Block > IP PACKET: UDP [192.168.0.227/1218]-->[192.168.0.1/1900] l=132 > > > > Thanks, > > _____ > > Mike Ayers > [EMAIL PROTECTED] > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > To subscribe to the digest version first unsubscribe, then > e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
