Security Basics
Re: bandwidth question Sep 18 2013 05:06PM
ToddAndMargo (ToddAndMargo zoho com)
> On Tue, Sep 17, 2013 at 2:03 PM, ToddAndMargo <ToddAndMargo (at) zoho (dot) com [email concealed]
> <mailto:ToddAndMargo (at) zoho (dot) com [email concealed]>> wrote:
> Hi Dennis,
> Thank you!
> -T
> On 09/16/2013 09:51 PM, Dennis Dumont wrote:
> Not an issue. Request versus response is still an order of
> magnitude
> difference.
> Dennis Dumont
> CCIE #12981
> C:440-227-7722 <tel:440-227-7722>
> Please consider the environment before printing this email.
> *From:* ToddAndMargo <ToddAndMargo (at) zoho (dot) com [email concealed]
> <mailto:ToddAndMargo (at) zoho (dot) com [email concealed]>>
> *To:* security-basics (at) securityfocus (dot) __co [email concealed]m
> <mailto:security-basics (at) securityfocus (dot) com [email concealed]>
> *Sent:* Monday, September 16, 2013 7:45 PM
> *Subject:* bandwidth question
> Hi All,
> A customer has asked me to do some human penetration
> testing for PCI compliance. I am planning on doing a bunch
> of probing with nmap to look for openings. I plan to log into
> the customer's network with Open VPN over my DSL line.
> (And Metasploit when I figure out how to use it too.)
> Question: what kind of bandwidth do I need? I have
> ~3 Mbps download and ~.7 Mbps upload? Am I going
> to swamp my DSL modem? Or is there enough wait time
> between probes that that is not an issue?
> Many thanks,
> -T

On 09/18/2013 06:03 AM, Dag Ger3D wrote:
> Something to consider is that Metasploit traffic may be seen as
> malicious by your ISP. You may need permission from them to perform this
> sort of testing over DSL. Not every ISP is this way, but I recall
> working for Comcast about 15 years ago, and we used to monitor for his
> activity and flag is a malicious. With the increased coverage by the
> media of the "hackers", monitoring traffic by ISPs may be on the rise as
> well. I would start by reading your TOS.
> As for the bandwidth, shouldn't be an issue as long as you keep number
> of threads to a reasonable level.
> - Oleg L.

Hi Oleg,

Thank you for the heads up!

I currently have Open VPN connections on the computers I
have abeen asked to test. This should get me around the issue.
The new fancy firewall I will be insalling has Intrustion Prevention
Software (IPS) on it and even though I will have this POS
workstation on its own leg, the IPS may lay an eggs on me.
May be a good test of the IPS to make sure it is actually working.
May have to turn the IPS off while I am testing.

I have noticed that what you say can be gotten around by
upgrading your hgome office Internet accounts to a business
account. Charter is a real ass about this. They blocked
a customer of mine from logging into his work (commercial)
VPN when he had to stay at home to mend a bromen collar
bone. Had another customer who whated to view his work
I.P. camera at home who had to upgrade a work account
too. Do believe his may have been Charter too, but may have
been Frontier.

Thank you for the help!


Computers are like air conditioners.
They malfunction when you open windows


Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.;4175;25;1371;0;5;946;e13b6be442

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus