North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: Blocking port 135?
- From: Mans Nilsson
- Date: Sat Aug 02 04:51:43 2003
Subject: Blocking port 135? Date: Fri, Aug 01, 2003 at 01:37:21PM -0500 Quoting Adi Linden (firstname.lastname@example.org):
> Would blocking port 135 at the network edge be a prudent preventative
As most have said, no.
* It does not cover all possible attacks.
* It may block legitime traffic.
* If you block and interfere, you are responsible for what your
customer does. You Do Not Want That.
* If my home ISP tried this on me, I'd take them to the consumer
protection authority and have them explain why they are calling their
filtered service "Internet access".
Instead, I'd suggest this:
- Have the customer responsible for all things on their own machine.
In writing if necessary.
- Inform them that "real Internet" is a Good Thing, but emphasize
that it takes some care and feeding of connected devices.
- Tell them where to get free or cheap protection software.
- Inform them that devices found to be broken into will be sent to null0
until proof of cleanliness has been obtained.
- If they have a larger net (corporate customers) tell them you *will*
take their CPE interface down if they are visibly broken into and fail
Works for us.
Måns Nilsson Systems Specialist
+46 70 681 7204 KTHNOC
I fill MY industrial waste containers with old copies of the
"WATCHTOWER" and then add HAWAIIAN PUNCH to the top ... They look NICE
in the yard ...
Description: PGP signature