virus/worms killing a network...

[Volker Kindermann]

Hi,


> The virus get into the user machine by e-mail from other ISPs. Thats
> noway i can block e-mail ports. I blocked ports TCP 4444,135,445 and
> UDP 69, known as ports that w32.blaster and others worms use to spread
> in the network. I really want to be able to scan every package that
> pass through the firewall and see from witch host its comming from.
> Ex: host-192.168.1.175 is sending strange packages that maybe a virus
> attack.


as somebody already suggested you should install the snort intrusion
detection system on the FC2 box (http://www.snort.org). Then you should
search for snort pattern files regarding these worms (some are included
in the standard packages, but perhaps not all you need).

It's also possible to configure snort such a way, that it acts as an
intrusion prevention system, that is it will cut a connection if it
detects some worm activity.

But be warned: it's not trivial to set up and run a network intrusion
detection/prevention system correctly. Depending on your current
knowledge you may have to learn a lot.

Especially if you configure it as an intrusion prevention system changes
are that you cut internet access for all machines by, e.g. blocking the
name servers.

 -volker