I haven't seen any blocks although I'm not sure if we're getting emails for the 140.221.64.0/22 network or not. That's the one that Ryan was running ~50 ssh session tests against. Forwarding to MCS core and CIS. On Wednesday, February 19, 2014, Ryan Aydelott <[email protected]> wrote:
namby, vm’s, jabber, anl.gov website - etc - I was running a few chunks of SSH sessions spewing test results - I’m wondering if I didn’t get blocked by some IDS somewhere - who might I talk to to get removed from this dark place as it’s impossible to WFH now without network trickery (re: tor) and I would rather not dump lab traffic through such a thing raising our profile
-ryan
We're going to need Ryan's source ip. --Dan On Feb 19, 2014, at 10:58 PM, "Scott Devoid" <[email protected]<mailto:[email protected]>> wrote: I haven't seen any blocks although I'm not sure if we're getting emails for the 140.221.64.0/22<http://140.221.64.0/22> network or not. That's the one that Ryan was running ~50 ssh session tests against. Forwarding to MCS core and CIS. On Wednesday, February 19, 2014, Ryan Aydelott <[email protected]<mailto:[email protected]>> wrote: namby, vm’s, jabber, anl.gov<http://anl.gov> website - etc - I was running a few chunks of SSH sessions spewing test results - I’m wondering if I didn’t get blocked by some IDS somewhere - who might I talk to to get removed from this dark place as it’s impossible to WFH now without network trickery (re: tor) and I would rather not dump lab traffic through such a thing raising our profile -ryan
67.167.211.254 On Wed, Feb 19, 2014 at 11:29 PM, Murphy-Olson, Daniel E. < [email protected]> wrote:
We're going to need Ryan's source ip.
--Dan
On Feb 19, 2014, at 10:58 PM, "Scott Devoid" <[email protected]> wrote:
I haven't seen any blocks although I'm not sure if we're getting emails for the 140.221.64.0/22 network or not. That's the one that Ryan was running ~50 ssh session tests against.
Forwarding to MCS core and CIS.
On Wednesday, February 19, 2014, Ryan Aydelott <[email protected]> wrote:
namby, vm’s, jabber, anl.gov website - etc - I was running a few chunks of SSH sessions spewing test results - I’m wondering if I didn’t get blocked by some IDS somewhere - who might I talk to to get removed from this dark place as it’s impossible to WFH now without network trickery (re: tor) and I would rather not dump lab traffic through such a thing raising our profile
-ryan
Yep. It's blocked. I'll send a note to get it removed. Here's the reason IP <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Start <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Stop <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Done By <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Reason <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Threshold <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Extended <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Origin <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> Block On <https://webapps.inside.anl.gov/cybersecurity/t1urpfblockdisplay/#> 67.167.211.254<tel:67.167.211.254> 2014-02-19 21:17:05 2014-02-20 21:52:06 carsuser Netflow: Fast Port Scan: TCP Port 22 > 43 times 2 9 netflow Both --Dan On Feb 19, 2014, at 11:30 PM, "Scott Devoid" <[email protected]<mailto:[email protected]>> wrote: 67.167.211.254
All: This should be undone. Ryan: Can you describe what you were doing at the time of the block? It might help prevent this kind of block in the future. -- corby From: <Murphy-Olson>, Dan Olson <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 12:07 AM To: "Devoid, Scott C." <[email protected]<mailto:[email protected]>> Cc: Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, Dan Olson <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network 67.167.211.254
Sure thing, I had a pdsh session open to about 50vm's collecting some stats from a performance run. It would have just looked like a bunch of terminal/ssh traffic, but across 50 ip's Sent from my iPhone On Feb 20, 2014, at 8:56 AM, "Schmitz, Corby B." <[email protected]<mailto:[email protected]>> wrote: All: This should be undone. Ryan: Can you describe what you were doing at the time of the block? It might help prevent this kind of block in the future. -- corby From: <Murphy-Olson>, Dan Olson <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 12:07 AM To: "Devoid, Scott C." <[email protected]<mailto:[email protected]>> Cc: Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, Dan Olson <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network 67.167.211.254
Yep, that would look like a scan, however, they missed the fact that this was 50 long running connections that passed the handshake and went on to pass data back and forth, i.e. a successful connection. I will pass it along. Thanks. -- corby From: <Aydelott>, "Ryan M." <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 9:15 AM To: Corby Schmitz <[email protected]<mailto:[email protected]>> Cc: Dan Olson <[email protected]<mailto:[email protected]>>, "Devoid, Scott C." <[email protected]<mailto:[email protected]>>, Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network Sure thing, I had a pdsh session open to about 50vm's collecting some stats from a performance run. It would have just looked like a bunch of terminal/ssh traffic, but across 50 ip's Sent from my iPhone On Feb 20, 2014, at 8:56 AM, "Schmitz, Corby B." <[email protected]<mailto:[email protected]>> wrote: All: This should be undone. Ryan: Can you describe what you were doing at the time of the block? It might help prevent this kind of block in the future. -- corby From: <Murphy-Olson>, Dan Olson <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 12:07 AM To: "Devoid, Scott C." <[email protected]<mailto:[email protected]>> Cc: Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, Dan Olson <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network 67.167.211.254
Had a brief discussion with the CSPO on this and they indicated to me that the easiest way to avoid this particular issue is to run your tests and such from an on-site bastion host instead of an outside host. This changes the dynamic of the detection tools and removes the likelihood that you will trip and get blocked. Is this a reasonable solution? -- corby From: <Aydelott>, "Ryan M." <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 9:15 AM To: Corby Schmitz <[email protected]<mailto:[email protected]>> Cc: Dan Olson <[email protected]<mailto:[email protected]>>, "Devoid, Scott C." <[email protected]<mailto:[email protected]>>, Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network Sure thing, I had a pdsh session open to about 50vm's collecting some stats from a performance run. It would have just looked like a bunch of terminal/ssh traffic, but across 50 ip's Sent from my iPhone On Feb 20, 2014, at 8:56 AM, "Schmitz, Corby B." <[email protected]<mailto:[email protected]>> wrote: All: This should be undone. Ryan: Can you describe what you were doing at the time of the block? It might help prevent this kind of block in the future. -- corby From: <Murphy-Olson>, Dan Olson <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 12:07 AM To: "Devoid, Scott C." <[email protected]<mailto:[email protected]>> Cc: Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, Dan Olson <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network 67.167.211.254
participants (4)
-
Aydelott, Ryan M. -
Murphy-Olson, Daniel E. -
Schmitz, Corby B. -
Scott Devoid