I find it very interesting to see so much HTTP traffic out of Brazil -- most of which is not needed in my environment. The beauty of this system is that it allows for easy correction to my web server logs to match up connection sources with HTTP requests in order to subsequently validate the traffic itself to make determinations of what to block and from where (or what to allow). In my environment (and that of my colleagues), we actually receive a non-trivial amount of valid traffic from Brazilian sources, so even though a vast percentage of the traffic is indeed invalid for our purposes, we've made the decision to allow HTTP from Brazil in order to best serve the people who count on access to the data we provide. In this case, we have to take the bad with the good -- but at least we arrived at the decision based on fact. Here's one that took some research to nail down:

At first, I had no idea what UDP/TCP 32085 was for -- yet I was seeing substantial traffic from all over the world. Nothing turned up on Google, so a quick packet capture got me the information I needed. It was BitTorrent. Seems that someone inside one of our networks was "a bit active" in the torrent scene. This traffic is easy enough to block in its entirety without respect to the source countries, but I found the distribution of players in other countries interesting in its own right.

Creating Objects in ISA

In my test VM, I installed ISA Server and Microsoft Access. The Access database simply has a copy of the IPAddresses table imported from SQL (or as a linked database, your choice) . This was done in a test VM as you would never load Microsoft Office products on your production firewall.

This code creates the Computer Sets based on the IPAddress data:

Private Sub BuildISAComputerSets_Click()
    On Error Resume Next
    
    ' Create the root FPC object.
    Dim root  ' The FPCLib.FPC root object
    Set root = CreateObject("FPC.Root")

    ' Declare the other ISA objects needed.
    Dim isaArray
    Dim ComputerSets
    Dim ComputerSet
    Dim AddressRanges
    Dim AddressRange
    
    Dim rstCountries As Recordset
    Dim rstAddresses As Recordset
    Dim sCountry As String
    Dim sSQL As String
    Dim sRangeName As String
    Dim sLogText As String
    
    'Connect to ISA
    Set isaArray = root.GetContainingArray()
    Set ComputerSets = isaArray.RuleElements.ComputerSets
    
    Log.SetFocus
 
    'Get a distinct list of countries
    
    sSQL = "SELECT distinct IPAddresses.FullCntry 
        FROM IPAddresses order by FullCntry "
    
    Set rstCountries = CurrentDb.OpenRecordset(sSQL)
    
    Do 'Countries loop
     Log.Text = ""
     sCountry = rstCountries!CountryName
     Log.Text = Log.Text + "Working on " + sCountry 
         + Constants.vbNewLine
     Set ComputerSet = ComputerSets.Add("ThorSet_" + sCountry)
     sSQL = "Select BegIP,EndIP,BegIPLong,EndIPLong,Cntry,FullCntry 
        from IPAddresses where CountryName = '" + sCountry 
        + "' Order by BegIPLong"
     
       Set rstAddresses = CurrentDb.OpenRecordset(sSQL)
       Log.Text = Log.Text + Str(rstAddresses.RecordCount) 
           + " address ranges found" + Constants.vbNewLine
       Do 'Addresses Loop
        sRangeName = Trim(rstAddresses!Country) 
        + Trim(Str(rstAddresses!BegIpNo)) 
              + "-" + Trim(Str(rstAddresses!EndIpNo))
        Set AddressRanges = ComputerSet.AddressRanges
        Set AddressRange = AddressRanges.Add(sRangeName, 
              rstAddresses!BegIP, rstAddresses!EndIP)
      rstAddresses.MoveNext
     
      Loop Until rstAddresses.EOF
    
     Log.Text = Log.Text + "... saving"
     'ComputerSet.Save
     rstCountries.MoveNext

    Loop Until rstCountries.EOF
     
     ComputerSets.Save
     
   MsgBox ("Done.")

  
End Sub