North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Providers removing blocks on port 135?

  • From: Justin Shore
  • Date: Sat Sep 20 22:00:13 2003 
On Sat, 20 Sep 2003, Sean Donelan wrote:

> It costs service providers more (cpu/ram/equipment) to filter a
> connection. And even more for every exception. Should service providers
> charge customers with filtering less (even though it costs more), and
> customers without filtering more (even though it costs less)? If the
> unfiltered connection was less expensive, wouldn't everyone just buy
> that; and we would be right back to the current situation?

Abosulutely.  At least if the customer wants technical support or plans on
paying for their bandwidth.  It costs *more* resources for an ISP to *not*
filter ports and it costs them *less* resources to filter known ports that
are rarely used by Joe Blow average user but the cause of 99% of their
(our) headaches.  How many people here have ever worked in a helpdesk with
hundreds of users calling you for help when they've been infected with the
latest greatest Netbios-enabled virus and lost their report, thesis,
archived email, pictures of the kids, you name it.  I used to work at a
Unv helpdesk.  Every single time the mail server hiccuped for whatever
reason, or the personal webserver was offline for a few minutes of
maintenance in the week hours of the morning (no matter whether it was 2
minutes of 2 days) people would inundate us with complaints.  All the real
problems had to be put on hold so we could answer the phones.  Technical
support costs an ISP many times that of the neccessary CPU and RAM
resources on an access server or border router needed to filter malicious
ports.  Why don't we just wait until we identify that a user has been
infected or compromised (by whatever resource-hog of a method that
entails).  Then we can just disable their account and wait for them to
call.  Those calls are always the most pleasant of the day.

When did proactive security measures become criminal?  Was there a memo I 
missed?

Justin