Yes. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of [EMAIL PROTECTED] > Sent: Monday, June 02, 2003 12:08 PM > To: [EMAIL PROTECTED] > Subject: RE: [SonicWALL]- TCP FIN Scans? > > Ok. Like our Cisco? > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of John Tolmachoff (Lists) > Sent: Monday, June 02, 2003 1:48 PM > To: [EMAIL PROTECTED] > Subject: RE: [SonicWALL]- TCP FIN Scans? > > > That is why you are still seeing it. You only blocked it in a access > rule. You need to block it at the router. > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of [EMAIL PROTECTED] > > Sent: Monday, June 02, 2003 11:30 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [SonicWALL]- TCP FIN Scans? > > > > I've blocked the range in the access list(Denied LAN to ip, default is > > > deny IP to LAN as well) and put the IP in the content filter blocking. > > > Still no go. > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Limmer, Jim > > Sent: Monday, June 02, 2003 1:13 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [SonicWALL]- TCP FIN Scans? > > > > > > > > You may be blocking it in the content filter by name - which has no > > effect if the web page is pointing you at it numerically. you may want > > > to add that numberic IP to the content filter. Or better yet block the > > > whole range at your router level. > > > > That is of course, if you don't like advertising. :) > > > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > Sent: Monday, June 02, 2003 1:50 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [SonicWALL]- TCP FIN Scans? > > > > > > That's the weird thing - I am blocking it!!?? > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Limmer, Jim > > Sent: Monday, June 02, 2003 12:39 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [SonicWALL]- TCP FIN Scans? > > > > > > > > I get these also. this is ad.doubleclick.net - you'll find them from a > > > variety of other websites. > > > > What happens is you connect to a website which connects you to the ad > > server - during the time that you are connected there the sonicwall > > 'times out' your connection, and the ad server tries to continue > > communicating with you - thus triggering an event. > > > > Since this particular one is an ad server, you might consider blocking > > > it. > > > > -Jim > > > > > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > > Sent: Monday, June 02, 2003 1:26 PM > > To: [EMAIL PROTECTED] > > Subject: [SonicWALL]- TCP FIN Scans? > > > > > > Recently I have been receiving multiple TCP FIN scans per day coming > > from a specific address. Listed below is an excerpt from our > > SonicWALL: > > > > Probable TCP FIN scan - Source:216.73.82.11, 80 > > > > The destination of course is that of our SonicWALL's public IP > > address. > > > > Anyone know how to stop this? I get about 6-7 emails per day (during > > business hours only), all identical from the same IP address listed > > above. Any help would really be appreciated. Thanks. > > > > Marcus D. Gand > > Director of Information Technologies > > LaurenKamtech, Inc. > > [EMAIL PROTECTED] > > > > > > > > NOTICE TO OUR CUSTOMERS: > > All laurenec.com email addresses have now changed format to > > > > [EMAIL PROTECTED] While the old format may still > > > > work, it is recommended that you update your address books to the new > > > > format. Thank you. - LaurenKamtech I.T. Department > > > > > > --- > > [This E-mail scanned for viruses by Declude/F-Prot AV] > > > > ================================= > > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > > email put the following: unsubscribe sonicwall your_name The archive > > of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > > > > > > > > > > LEGAL NOTICE: > > Unless expressly stated otherwise, this message is confidential and > > may be privileged. It is intended for the addressee(s) only. Access to > > > this e-mail by anyone else is unauthorized. If you are not an > > addressee, any disclosure or copying of the contents or any action > > taken (or not taken) in reliance on it is unauthorized and may be > > unlawful. If you are not an addressee, please inform the sender > > immediately. > > --- > > [This E-mail scanned for viruses by Declude/F-Prot AV] > > > > ================================= > > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > > email put the following: unsubscribe sonicwall your_name The archive > > of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > > > > > > > > NOTICE TO OUR CUSTOMERS: > > All laurenec.com email addresses have now changed format to > > > > [EMAIL PROTECTED] While the old format may still > > > > work, it is recommended that you update your address books to the new > > > > format. Thank you. - LaurenKamtech I.T. Department > > > > > > --- > > [This E-mail scanned for viruses by Declude/F-Prot AV] > > > > ================================= > > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > > email put the following: unsubscribe sonicwall your_name The archive > > of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > > > > > > > > > > LEGAL NOTICE: > > Unless expressly stated otherwise, this message is confidential and > > may be privileged. It is intended for the addressee(s) only. Access to > > > this e-mail by anyone else is unauthorized. If you are not an > > addressee, any disclosure or copying of the contents or any action > > taken (or not taken) in reliance on it is unauthorized and may be > > unlawful. If you are not an addressee, please inform the sender > > immediately. > > --- > > [This E-mail scanned for viruses by Declude/F-Prot AV] > > > > ================================= > > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > > email put the following: unsubscribe sonicwall your_name The archive > > of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > > > > > > > > NOTICE TO OUR CUSTOMERS: > > All laurenec.com email addresses have now changed format to > > > > [EMAIL PROTECTED] While the old format may still > > > > work, it is recommended that you update your address books to the new > > > > format. Thank you. - LaurenKamtech I.T. Department > > > > > > --- > > [This E-mail scanned for viruses by Declude/F-Prot AV] > > > > ================================= > > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > > email > put > > the following: unsubscribe sonicwall your_name > > The archive of this list is at > http://www.mail-archive.com/sonicwall%40peake.com/ > > > > > --- > [This E-mail scanned for viruses by Declude/F-Prot AV] > > ================================= > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the > email put the following: unsubscribe sonicwall your_name The archive of > this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > > > > NOTICE TO OUR CUSTOMERS: > All laurenec.com email addresses have now changed format to > > [EMAIL PROTECTED] While the old format may still > > work, it is recommended that you update your address books to the new > > format. Thank you. - LaurenKamtech I.T. Department > > > --- > [This E-mail scanned for viruses by Declude/F-Prot AV] > > ================================= > To unsubscribe, send email to [EMAIL PROTECTED] In the body of the email put > the following: unsubscribe sonicwall your_name > The archive of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ > --- [This E-mail scanned for viruses by Declude/F-Prot AV] ==================================================================================================To unsubscribe, send email to [EMAIL PROTECTED] In the body of the email put the following: unsubscribe sonicwall your_name The archive of this list is at http://www.mail-archive.com/sonicwall%40peake.com/
