Security Basics
Re: bandwidth question Sep 18 2013 05:06PM
ToddAndMargo (ToddAndMargo zoho com)
> On Tue, Sep 17, 2013 at 2:03 PM, ToddAndMargo <ToddAndMargo (at) zoho (dot) com [email concealed]
> <mailto:ToddAndMargo (at) zoho (dot) com [email concealed]>> wrote:
>
> Hi Dennis,
>
> Thank you!
>
> -T
>
>
> On 09/16/2013 09:51 PM, Dennis Dumont wrote:
>
> Not an issue. Request versus response is still an order of
> magnitude
> difference.
> Dennis Dumont
> CCIE #12981
> C:440-227-7722 <tel:440-227-7722>
>
>
> Please consider the environment before printing this email.
>
>
------------------------------__------------------------------__--------
----
> *From:* ToddAndMargo <ToddAndMargo (at) zoho (dot) com [email concealed]
> <mailto:ToddAndMargo (at) zoho (dot) com [email concealed]>>
> *To:* security-basics (at) securityfocus (dot) __co [email concealed]m
> <mailto:security-basics (at) securityfocus (dot) com [email concealed]>
> *Sent:* Monday, September 16, 2013 7:45 PM
> *Subject:* bandwidth question
>
>
> Hi All,
>
> A customer has asked me to do some human penetration
> testing for PCI compliance. I am planning on doing a bunch
> of probing with nmap to look for openings. I plan to log into
> the customer's network with Open VPN over my DSL line.
> (And Metasploit when I figure out how to use it too.)
>
> Question: what kind of bandwidth do I need? I have
> ~3 Mbps download and ~.7 Mbps upload? Am I going
> to swamp my DSL modem? Or is there enough wait time
> between probes that that is not an issue?
>
> Many thanks,
> -T
>

On 09/18/2013 06:03 AM, Dag Ger3D wrote:
> Something to consider is that Metasploit traffic may be seen as
> malicious by your ISP. You may need permission from them to perform this
> sort of testing over DSL. Not every ISP is this way, but I recall
> working for Comcast about 15 years ago, and we used to monitor for his
> activity and flag is a malicious. With the increased coverage by the
> media of the "hackers", monitoring traffic by ISPs may be on the rise as
> well. I would start by reading your TOS.
>
> As for the bandwidth, shouldn't be an issue as long as you keep number
> of threads to a reasonable level.
>
> - Oleg L.

Hi Oleg,

Thank you for the heads up!

I currently have Open VPN connections on the computers I
have abeen asked to test. This should get me around the issue.
The new fancy firewall I will be insalling has Intrustion Prevention
Software (IPS) on it and even though I will have this POS
workstation on its own leg, the IPS may lay an eggs on me.
May be a good test of the IPS to make sure it is actually working.
May have to turn the IPS off while I am testing.

I have noticed that what you say can be gotten around by
upgrading your hgome office Internet accounts to a business
account. Charter is a real ass about this. They blocked
a customer of mine from logging into his work (commercial)
VPN when he had to stay at home to mend a bromen collar
bone. Had another customer who whated to view his work
I.P. camera at home who had to upgrade a work account
too. Do believe his may have been Charter too, but may have
been Frontier.

Thank you for the help!

-T

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

------------------------------------------------------------------------

Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
------------------------------------------------------------------------

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus