[108096] in North American Network Operators' Group
Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
daemon@ATHENA.MIT.EDU (Bruce Williams)
Tue Sep 23 23:47:54 2008
Date: Tue, 23 Sep 2008 20:47:41 -0700
From: "Bruce Williams" <williams.bruce@gmail.com>
To: "Christopher Morrow" <christopher.morrow@gmail.com>
In-Reply-To: <75cb24520809232023r6bb5820eubed1524b13acddc1@mail.gmail.com>
Cc: nanog@nanog.org, Joe Greco <jgreco@ns.sol.net>
Errors-To: nanog-bounces@nanog.org
using bolt cutters on cables has a certain satisfaction...
On Tue, Sep 23, 2008 at 8:23 PM, Christopher Morrow
<christopher.morrow@gmail.com> wrote:
> On Tue, Sep 23, 2008 at 11:20 PM, Joe Greco <jgreco@ns.sol.net> wrote:
>
>> I would suggest a different Step 1. Instead of killing power, simply
>> isolate the affected machine. This might be as simple as putting up a
>> firewall rule or two, if it is simply sending outgoing SMTP spam, or
>
> it's probably easiest (depending on the network gear of course) to
> just put the lan port into an isolated VLAN. It's not the 100%
> solution (some badness rm's itself once it loses connectivity to the
> internets) but it'd make things simpler for the client/LEA when they
> need to figure out what happened.
>
> -chris
>
>
