Hello Priyank Since this attack runs off of UDP it is not possible for Proventia A to send RSKILL's to the attacking machine.
Insure that you have MS02-038 and MS02-039 installed in your SQL servers, also from the Firewall you can block traffic targeting UDP port 1434 Regards, Abdulkareem M. Al-Raie ISS-CE -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, November 03, 2004 2:30 PM To: [EMAIL PROTECTED] Subject: [ISSForum] Query Regarding RSKILL Option Dear All, I have recently installed A201 Provetia in our organization and have defined some basic policies.When defining policy there is an option "RSKILL", does this option kill TCP connection.There is continous logging of SQL_SLAMMER_WORM,because of this my log file is getting full,can i set it to "RSKILL" option.Any help would be appreciated Thanking You All In Anticipation. Regards Priyank Gaddala Technical Consultant - Sytems Integration and Support Tata Technologies Ltd ************************************************************************ **************************** Email Disclaimer: Information contained and transmitted by this e-mail is confidential,proprietary, and legally privileged data of Tata Technologies that is intended for use only by the addressee.If you are not the intended recipient, you are notified that any dissemination, distribution, or copying of this e-mail is strictly prohibited.You are requested to delete this e-mail immediately and notify the originator.Any views expressed by an individual do not necessarily reflect the view of Tata Technologies.While this e-mail has been checked for all known viruses, the addressee should also scan for viruses.Internet communications cannot be guaranteed to be timely, secure, error or virus-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete.Tata Technologies does not accept liability for any errors or omissions.To know more about Tata Technologiesplease visit http://www.tatatechnologies.com ************************************************************************ *************************** _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
