Morten Isaksen’s blog

I got my Joost invitation today
The install was very easy - a few clicks and it was done.

Overall the quality is good even though I have experienced a few hick ups and once the picture and sound froze and I was forced to close and start the application.

I was a bit surprised that DR was represented in the content. I heard some rumors in the local press that DR was thinking about using Joost, but there has not been any news about that they did supply content to Joost (or at least I missed that news). You can watch some episodes of “Kontant” and “Magasinet Penge”.

I have no Joost invitation to give yet, but I will offer them here when I get some.

Purchase Diflucan

Purchase Koflet

I have made a patch for dhcp_probe 1.1.0 so you can compile it under Linux with gcc version 4 installed. I have only tested it with Fedora Core 4.

You can download the patch here.

I also made another patch that add support for an ok_program_name configuration settings. The program is called when only legal dhcp servers exists. You can download this patch here. Please note that this patch does not support parameters to alert_program_name and ok_program_name and it uses the system call and not execl to call the external programs.

Poul-Henning Kamp has written an open letter to D-Link about their abuse of a Stratum-1 NTP server he runs pro bono. If you got any connections at D-Link please try to persuade them to solve this matter in a decent way.

Update: Richard Clayton who helped Poul-Henning Kamp in this issue has written When Firmware Attacks! (DDoS by D-Link)

This KB327000 explains how to set the “Send As” permission, but when you want to test it immediate after you changed the permissions chances are that it does not work. The Exchange Information store service caches this information for 120 minutes (the standard value). If you cannot wait that long, then you can restart the Information store service.

If you want to change the time that this information is cached then look at KB327378.

I am a one of the administrators for a network with about 900 residential users. We have no control over what people are running on their computer and therefor we get our share (and more) of worms and vira on the network. Some of theese are wery agressive and slows the whole network down with arp broadcasts.

We are using squid as a proxy and I came up with a good idea (at least I think so) on how to use squid to force the users to clean their computers if it is infected.

The method is not bulletproof. The Squid server listen after arp broadcasts on the LAN and if a computer is sending more of theese than normal the IP address get in a ACL and the computer is prevented from accessing the internet except from a few selected sites such as windowsupdate and housecall.antivirus.com. The deny_info function in squid is used to notice the users that their computers are infected and that they need to clean it in order to get their normal internet access back. When the stops sending arp requests the IP is removed from the ACL.


#!/bin/sh
# Make sure the /etc/worms.txt file have at least one line of text
echo "10.0.0.1" > /tmp/worms.txt
tcpdump -n -c 1000 arp 2> /dev/null | cut -d " " -f 6 | sort | uniq -c | perl -n
e '/s+(d+).(S+).*/; print "$2n" if $1>200' >> /tmp/worms.txt
/usr/local/squid/sbin/squid -k reconfigure


Is run every 10 minutes or so and in squid.conf the following is added:

acl worms src "/tmp/worms.txt"
acl trend dstdomain .trendmicro.com .antivirus.com \
.akamai.net .microsoft.com
http_access allow trend worms
http_access deny worms
deny_info ERR_WORMS worms