Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 24
  1. #11
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    Quote Originally Posted by cblaise View Post
    Nice!
    I've been reporting this issue all year. Getting some acknowledgement from Untangle before now would've been "Nice!"

    But yes, it is nice that the IPS in v14.1 finally works.

  2. #12
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    I was looking into something else on my mail server, and stumbled across a bunch of these "EHLO ylmf-pc" sessions still hitting my mail server every day. Only about 500-1000 per day get through, out of 10's of thousands of attempts. I have no idea why... I'm hoping there's a different variant of the attack that I need another signature to block; if it turns out IPS 14.1 is still leaky, I'll be very disappointed.

  3. #13
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    I'm very disappointed, but not for the reason I expected...

    IPS updates it's signatures every hour, and shuts down to reload the signature database and re-process all the rules. So for about 3 minutes per hour, IPS is off and it's open season.

    Not a very good implementation.

  4. #14
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default IPS shuts down for several minutes every hour

    I discovered that IPS updates it's signatures every hour, and shuts down to reload the signature database and re-process all the rules. So for about 3 minutes per hour, IPS is off and it's open season.

    Not a very good implementation.

  5. #15
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,725

    Default

    Hi johnsonx42,

    I've merged your threads together. Please do not spam the forums with all your different complaint threads.
    The forums is used for many purposes. Feedback is certainly one of them and an important one, however we don't want one user to dominate all the conversation by creating many threads to flood the 'current threads' view. We use this forum mostly to converse and help users with questions.

    That said, carry on!
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  6. #16
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    I created the new thread because it's really a separate subject from this original thread; it has nothing to do with whatever problem I identified in IPS <=14.0.1... I was meaning to go back and delete the new posts from this thread but then the company christmas luncheon started...

    I may post alot, but spamming threads is not something I do.
    donhwyo likes this.

  7. #17
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    Also, I should say "not a very good implementation of the update mechanism". I still think IPS 14.1 is great. But an IPS being offline 5% of the time isn't so good.... if it's not possible to update without going offline for more than a few seconds, then updating only once a day would be much better.
    JasonJoel likes this.

  8. #18
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    notice just after the top of every hour in this graph - zero detections... because IPS is offline:
    Intrusion_Prevention-Intrusion_Detection_(all)-19.12.2018-1258.png
    (the big drop in detections/blocks starting right before 10am is because I put a threshold limit in my custom signature so it would log only once per source IP per minute)
    Last edited by johnsonx42; 12-19-2018 at 02:06 PM.

  9. #19
    Untangle Ninja
    Join Date
    Jan 2011
    Posts
    1,117

    Default

    and finally, my mail server log showing "EHLO ylmf-pc" attempts getting through only at the times IPS was off:
    Code:
    11:02:03 4043 DMN: MSG 29257145 Sending machine verification failed. (ylmf-pc)
    11:02:08 4043 DMN: MSG 29257146 Sending machine verification failed. (ylmf-pc)
    11:02:09 4043 DMN: MSG 29257147 Sending machine verification failed. (ylmf-pc)
    11:02:15 4043 DMN: MSG 29257150 Sending machine verification failed. (ylmf-pc)
    11:02:21 4A39 DMN: MSG 29257152 Sending machine verification failed. (ylmf-pc)
    11:02:44 4A39 DMN: MSG 29257157 Sending machine verification failed. (ylmf-pc)
    11:03:02 4A39 DMN: MSG 29257159 Sending machine verification failed. (ylmf-pc)
    11:03:02 4A39 DMN: MSG 29257160 Sending machine verification failed. (ylmf-pc)
    11:03:03 4A39 DMN: MSG 29257161 Sending machine verification failed. (ylmf-pc)
    11:03:03 4A39 DMN: MSG 29257162 Sending machine verification failed. (ylmf-pc)
    11:03:04 4A39 DMN: MSG 29257163 Sending machine verification failed. (ylmf-pc)
    11:03:05 4A39 DMN: MSG 29257164 Sending machine verification failed. (ylmf-pc)
    11:03:05 4A39 DMN: MSG 29257165 Sending machine verification failed. (ylmf-pc)
    11:03:06 4A39 DMN: MSG 29257166 Sending machine verification failed. (ylmf-pc)
    11:03:06 4A39 DMN: MSG 29257167 Sending machine verification failed. (ylmf-pc)
    11:03:07 4A39 DMN: MSG 29257168 Sending machine verification failed. (ylmf-pc)
    11:03:07 4A39 DMN: MSG 29257169 Sending machine verification failed. (ylmf-pc)
    11:03:11 4A39 DMN: MSG 29257170 Sending machine verification failed. (ylmf-pc)
    11:03:12 4A39 DMN: MSG 29257171 Sending machine verification failed. (ylmf-pc)
    12:03:04 4167 DMN: MSG 29258351 Sending machine verification failed. (ylmf-pc)
    12:03:04 4167 DMN: MSG 29258352 Sending machine verification failed. (ylmf-pc)
    12:03:05 400B DMN: MSG 29258353 Sending machine verification failed. (ylmf-pc)
    12:03:05 4167 DMN: MSG 29258354 Sending machine verification failed. (ylmf-pc)
    12:03:05 4167 DMN: MSG 29258355 Sending machine verification failed. (ylmf-pc)
    12:03:05 400B DMN: MSG 29258356 Sending machine verification failed. (ylmf-pc)
    12:03:06 400B DMN: MSG 29258357 Sending machine verification failed. (ylmf-pc)
    12:03:06 4167 DMN: MSG 29258358 Sending machine verification failed. (ylmf-pc)
    12:03:06 4167 DMN: MSG 29258359 Sending machine verification failed. (ylmf-pc)
    12:03:06 400B DMN: MSG 29258360 Sending machine verification failed. (ylmf-pc)
    12:03:07 4167 DMN: MSG 29258362 Sending machine verification failed. (ylmf-pc)
    12:03:07 400B DMN: MSG 29258361 Sending machine verification failed. (ylmf-pc)
    12:03:07 400B DMN: MSG 29258363 Sending machine verification failed. (ylmf-pc)
    12:03:07 4167 DMN: MSG 29258364 Sending machine verification failed. (ylmf-pc)
    12:03:08 4167 DMN: MSG 29258365 Sending machine verification failed. (ylmf-pc)
    12:03:08 400B DMN: MSG 29258366 Sending machine verification failed. (ylmf-pc)
    12:03:08 400B DMN: MSG 29258367 Sending machine verification failed. (ylmf-pc)
    12:03:08 4167 DMN: MSG 29258368 Sending machine verification failed. (ylmf-pc)
    12:03:09 4167 DMN: MSG 29258369 Sending machine verification failed. (ylmf-pc)
    12:03:09 400B DMN: MSG 29258370 Sending machine verification failed. (ylmf-pc)
    12:03:09 400B DMN: MSG 29258371 Sending machine verification failed. (ylmf-pc)
    12:03:10 400B DMN: MSG 29258372 Sending machine verification failed. (ylmf-pc)
    12:03:11 400B DMN: MSG 29258373 Sending machine verification failed. (ylmf-pc)
    12:03:11 400B DMN: MSG 29258374 Sending machine verification failed. (ylmf-pc)
    12:03:12 400B DMN: MSG 29258375 Sending machine verification failed. (ylmf-pc)
    12:03:12 400B DMN: MSG 29258376 Sending machine verification failed. (ylmf-pc)
    12:03:13 400B DMN: MSG 29258377 Sending machine verification failed. (ylmf-pc)
    12:03:13 400B DMN: MSG 29258378 Sending machine verification failed. (ylmf-pc)
    12:03:14 400B DMN: MSG 29258379 Sending machine verification failed. (ylmf-pc)
    12:03:14 400B DMN: MSG 29258380 Sending machine verification failed. (ylmf-pc)
    12:03:15 400B DMN: MSG 29258381 Sending machine verification failed. (ylmf-pc)
    12:03:15 400B DMN: MSG 29258382 Sending machine verification failed. (ylmf-pc)
    12:03:16 4167 DMN: MSG 29258383 Sending machine verification failed. (ylmf-pc)
    12:03:16 400B DMN: MSG 29258384 Sending machine verification failed. (ylmf-pc)
    12:03:16 400B DMN: MSG 29258385 Sending machine verification failed. (ylmf-pc)
    12:03:17 4167 DMN: MSG 29258386 Sending machine verification failed. (ylmf-pc)
    12:03:17 400B DMN: MSG 29258387 Sending machine verification failed. (ylmf-pc)
    12:03:18 4167 DMN: MSG 29258388 Sending machine verification failed. (ylmf-pc)
    12:03:18 400B DMN: MSG 29258389 Sending machine verification failed. (ylmf-pc)
    12:03:18 400B DMN: MSG 29258390 Sending machine verification failed. (ylmf-pc)
    12:03:19 400B DMN: MSG 29258391 Sending machine verification failed. (ylmf-pc)
    12:03:20 400B DMN: MSG 29258392 Sending machine verification failed. (ylmf-pc)
    12:03:40 4A41 DMN: MSG 29258393 Sending machine verification failed. (ylmf-pc)
    12:03:41 4A41 DMN: MSG 29258394 Sending machine verification failed. (ylmf-pc)
    12:03:41 4A41 DMN: MSG 29258395 Sending machine verification failed. (ylmf-pc)
    12:03:42 4A41 DMN: MSG 29258396 Sending machine verification failed. (ylmf-pc)
    12:03:43 4A41 DMN: MSG 29258397 Sending machine verification failed. (ylmf-pc)
    12:03:43 4A41 DMN: MSG 29258398 Sending machine verification failed. (ylmf-pc)
    12:03:44 4A41 DMN: MSG 29258399 Sending machine verification failed. (ylmf-pc)
    12:03:44 4A41 DMN: MSG 29258400 Sending machine verification failed. (ylmf-pc)
    12:03:45 4A41 DMN: MSG 29258401 Sending machine verification failed. (ylmf-pc)
    12:03:45 4A41 DMN: MSG 29258402 Sending machine verification failed. (ylmf-pc)
    12:03:46 4A41 DMN: MSG 29258403 Sending machine verification failed. (ylmf-pc)
    12:03:46 4A41 DMN: MSG 29258404 Sending machine verification failed. (ylmf-pc)
    12:03:47 4A41 DMN: MSG 29258405 Sending machine verification failed. (ylmf-pc)
    12:03:48 4A41 DMN: MSG 29258406 Sending machine verification failed. (ylmf-pc)
    12:03:48 4A41 DMN: MSG 29258407 Sending machine verification failed. (ylmf-pc)
    12:03:49 4A41 DMN: MSG 29258408 Sending machine verification failed. (ylmf-pc)
    12:03:49 4A41 DMN: MSG 29258409 Sending machine verification failed. (ylmf-pc)
    12:03:50 4A41 DMN: MSG 29258410 Sending machine verification failed. (ylmf-pc)
    12:03:50 4A41 DMN: MSG 29258411 Sending machine verification failed. (ylmf-pc)
    12:03:51 4A41 DMN: MSG 29258412 Sending machine verification failed. (ylmf-pc)
    12:03:51 4A41 DMN: MSG 29258413 Sending machine verification failed. (ylmf-pc)
    12:03:52 4A41 DMN: MSG 29258414 Sending machine verification failed. (ylmf-pc)
    12:03:52 4A41 DMN: MSG 29258415 Sending machine verification failed. (ylmf-pc)
    12:03:53 4A41 DMN: MSG 29258416 Sending machine verification failed. (ylmf-pc)
    12:03:53 4A41 DMN: MSG 29258417 Sending machine verification failed. (ylmf-pc)
    12:03:54 4A41 DMN: MSG 29258418 Sending machine verification failed. (ylmf-pc)
    13:03:47 4A41 DMN: MSG 29259442 Sending machine verification failed. (ylmf-pc)
    13:03:53 400B DMN: MSG 29259446 Sending machine verification failed. (ylmf-pc)
    13:03:58 400B DMN: MSG 29259449 Sending machine verification failed. (ylmf-pc)
    13:04:04 400B DMN: MSG 29259450 Sending machine verification failed. (ylmf-pc)
    13:04:08 400B DMN: MSG 29259451 Sending machine verification failed. (ylmf-pc)
    13:04:08 400B DMN: MSG 29259452 Sending machine verification failed. (ylmf-pc)
    13:04:09 400B DMN: MSG 29259454 Sending machine verification failed. (ylmf-pc)
    13:04:09 400B DMN: MSG 29259455 Sending machine verification failed. (ylmf-pc)
    13:04:10 417F DMN: MSG 29259456 Sending machine verification failed. (ylmf-pc)
    13:04:10 400B DMN: MSG 29259457 Sending machine verification failed. (ylmf-pc)
    13:04:11 400B DMN: MSG 29259458 Sending machine verification failed. (ylmf-pc)
    13:04:11 400B DMN: MSG 29259459 Sending machine verification failed. (ylmf-pc)
    13:04:12 400B DMN: MSG 29259461 Sending machine verification failed. (ylmf-pc)
    13:04:12 400B DMN: MSG 29259462 Sending machine verification failed. (ylmf-pc)
    13:04:13 400B DMN: MSG 29259463 Sending machine verification failed. (ylmf-pc)
    13:04:13 400B DMN: MSG 29259464 Sending machine verification failed. (ylmf-pc)
    13:04:14 400B DMN: MSG 29259465 Sending machine verification failed. (ylmf-pc)
    13:04:15 400B DMN: MSG 29259466 Sending machine verification failed. (ylmf-pc)
    13:04:16 400B DMN: MSG 29259467 Sending machine verification failed. (ylmf-pc)
    13:04:16 400B DMN: MSG 29259468 Sending machine verification failed. (ylmf-pc)
    13:04:17 400B DMN: MSG 29259469 Sending machine verification failed. (ylmf-pc)
    13:04:17 400B DMN: MSG 29259470 Sending machine verification failed. (ylmf-pc)
    13:04:18 400B DMN: MSG 29259471 Sending machine verification failed. (ylmf-pc)
    13:04:18 400B DMN: MSG 29259472 Sending machine verification failed. (ylmf-pc)
    13:04:19 400B DMN: MSG 29259473 Sending machine verification failed. (ylmf-pc)
    13:04:19 400B DMN: MSG 29259474 Sending machine verification failed. (ylmf-pc)
    13:04:20 400B DMN: MSG 29259475 Sending machine verification failed. (ylmf-pc)
    13:04:20 400B DMN: MSG 29259476 Sending machine verification failed. (ylmf-pc)
    13:04:21 417F DMN: MSG 29259477 Sending machine verification failed. (ylmf-pc)
    13:04:21 400B DMN: MSG 29259478 Sending machine verification failed. (ylmf-pc)
    13:04:21 400B DMN: MSG 29259479 Sending machine verification failed. (ylmf-pc)
    13:04:22 400B DMN: MSG 29259480 Sending machine verification failed. (ylmf-pc)
    13:04:22 400B DMN: MSG 29259481 Sending machine verification failed. (ylmf-pc)
    13:04:29 400B DMN: MSG 29259482 Sending machine verification failed. (ylmf-pc)
    13:04:34 400B DMN: MSG 29259485 Sending machine verification failed. (ylmf-pc)
    13:04:40 400B DMN: MSG 29259486 Sending machine verification failed. (ylmf-pc)
    13:04:40 400B DMN: MSG 29259487 Sending machine verification failed. (ylmf-pc)
    13:04:46 400B DMN: MSG 29259488 Sending machine verification failed. (ylmf-pc)

  10. #20
    Master Untangler
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    656

    Default

    For comparison (set to six hours for added resolution):

    Intrusion_Prevention-Intrusion_Detection_(all)-19.12.2018-1618.png

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2