0779hjj
发表于 2004-10-12 19:18:06
如图:CPU占用40-100%之间,平时多数是10%以下,内存也比平时用多了很多,我已在filter rules:forward里把TCP/UDP:135-139端口dorp掉了。在不杀病毒的情况下,有什么办法改善一下ros吗?
majun1999
发表于 2004-10-12 22:32:06
这个东西也没有啥好的办法!只能叫你的内网用户杀毒呢!
liu00901
发表于 2004-10-13 01:52:49
内网用户2K/XP添加IP安全策略......阻止任何IP访问本机IP134-139阻止本机IP访问任何IP134-139
0779hjj
发表于 2004-10-13 08:27:23
内网用的是win98,不是win2k/xp。我是在外网监控知道内网有病毒的,打了电话让人杀毒,可能没人信我,未杀,今天内存(昨晚看见越来越少)可能已被用完了,我用了几分钟都登录不上。
liu00901
发表于 2004-10-13 08:44:21
A:除了在filter rules:forward里把TCP/UDP:135-139端口dorp掉还要在input 里把TCP/UDP:135-139端口dorp掉B:加内存,换高频CPUC:内网每台机装天网防火墙D:内网每台机断网杀毒
0779hjj
发表于 2004-10-13 09:04:29
"input 里把TCP/UDP:135-139端口dorp掉"这个我早早就做了。我看现在只有杀毒这一招可以用了。每台机装天网太麻烦了,60台机子。
0779hjj
发表于 2004-10-13 09:11:07
现在只在一台机子有毒,ros就这个样子了,假如有多几台有这样的毒,即使换高频CPU,加大内存,时间长了最终也会死啊!!!
bow
发表于 2004-10-13 09:30:16
/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \ action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \ disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \ Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \ disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \ Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \ comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \ purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \ purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \ purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \ purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no
0779hjj
发表于 2004-10-13 10:22:06
QUOTE (bow @ Oct 13 2004, 09:30 AM)
/ ip firewall rule forward add dst-address=:137-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:137-139 protocol=udp action=drop comment="" disabled=no / ip firewall rule input add protocol=tcp tcp-options=non-syn-only connection-state=established \ action=accept comment="Established TCP connections." disabled=no add connection-state=related action=accept comment="Related connections" \ disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster \ Worm." disabled=no add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" \ disabled=no add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger \ Worm" disabled=no add protocol=udp action=accept comment="UDP" disabled=no add protocol=icmp limit-count=100 limit-burst=2 limit-time=5s action=accept \ comment="Allow limited pings" disabled=no add protocol=icmp action=drop comment="Drop excess pings" disabled=no add dst-address=:22 protocol=tcp action=accept comment="SSH for demo \ purposes" disabled=no add dst-address=:23 protocol=tcp action=accept comment="Telnet for demo \ purposes" disabled=no add dst-address=:80 protocol=tcp action=accept comment="http for demo \ purposes" disabled=no add dst-address=:3987 protocol=tcp action=accept comment="winbox for demo \ purposes" disabled=no add action=drop log=yes comment="Log and drop everything else" disabled=no
这是官方ros的设置吧?这个我知道,但可用内存还是越来越少了,最后没有了,现在能登录但已不能操作了。
zhx0123
发表于 2006-10-4 21:31:03
xuexi。谢谢
权威
发表于 2006-10-5 02:39:47
你设置的防火墙有问题。
如果正确的 应该能看见拦阻的字节数的。你好好看看有没有?
页:
[1]