[108094] in North American Network Operators' Group
Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
daemon@ATHENA.MIT.EDU (Christopher Morrow)
Tue Sep 23 23:24:21 2008
Date: Tue, 23 Sep 2008 23:23:48 -0400
From: "Christopher Morrow" <christopher.morrow@gmail.com>
To: "Joe Greco" <jgreco@ns.sol.net>
In-Reply-To: <200809240320.m8O3KIw0019735@aurora.sol.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
On Tue, Sep 23, 2008 at 11:20 PM, Joe Greco <jgreco@ns.sol.net> wrote:
> I would suggest a different Step 1. Instead of killing power, simply
> isolate the affected machine. This might be as simple as putting up a
> firewall rule or two, if it is simply sending outgoing SMTP spam, or
it's probably easiest (depending on the network gear of course) to
just put the lan port into an isolated VLAN. It's not the 100%
solution (some badness rm's itself once it loses connectivity to the
internets) but it'd make things simpler for the client/LEA when they
need to figure out what happened.
-chris
