Subject: HELP ... TIS works at ...

From: "ddss" <[email-masked]>
Date: Tue, 8 Feb 2000 21:59:36 -0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi TIS workers ...

Please, I need some help ...

I would like to clear some questions:

01. Where the proxy TIS FWTK work ???
        (a). Application level (gateway)
        (s). Session level (circuit relay)    
        (t). Transport level (circuit relay)

02. Are there some way to verify the context of data ???

03. Where I can find statistics about the use of TIS FWTK against 
others ???

Thanks,
                      [email-masked]

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 11 Feb 2000 14:30:21 -0500

>         (t). Transport level (circuit relay)

a

> 02. Are there some way to verify the context of data ???

Explain, please.

> 03. Where I can find statistics about the use of TIS FWTK against 

I doubt that you can.  Anybody?  It's pretty wide-spread, but it is not
registered anywhere.  [Yes, it should be registered at NAI/TIS.  We have
seen that this doesn't always happen.  Does anyone at NAI/TIS want to
share?]

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: "ddss" <[email-masked]>
Date: Fri, 11 Feb 2000 23:29:23 -0200

Thanks !!!

But, about my question number two:

There are some add on to TIS FWTK to make a scanning
in the traffic for ftp, http and smtp ???
             For http reject pages with some words and
             for smtp reject some attached files like *.exe, *.dll and so on
...
Thanks,
                          [email-masked]

---

From: Ted Keller <[email-masked]>
Date: Fri, 11 Feb 2000 22:15:06 -0500 (EST)

I have modified smap to allow scanning of header data for particular
strings - primarily spam mail.  The basic scanning routines could also be
used to scan the body - I haven't implemented that for preformance issues.
With this scan, the routines could easily look for attachments
(non-encyrpted - non compressed ---) for things like .exe .dll and the
like to reject.

ted keller

---

From: "ddss" <[email-masked]>
Date: Tue, 15 Feb 2000 22:14:37 -0300

Hi Ted,
Please,
Can you explain how can I scanning smtp for particular string in the
header and data ???
Thanks,
                      [email-masked]

---

From: Ted Keller <[email-masked]>
Date: Tue, 15 Feb 2000 21:09:38 -0500 (EST)

ddss.....

I intercepted all data comming in through crunchbody, once received, I
verify what type of header it is (subject: from: to: ...) and compare the
contents of that line with a set of filters with common spam data.

The original list came from....

  Linkname: Oasel the Spam-Catcher's Report to the Nation     
        URL: http://www.cnx.com/stopspam.html
 
It contains some 7000+ lines of common spam data.

Last week, I blocked over 10,000 message total from comming through my
firewall.  Many of theme (~2000) were as a direct result of these spam
fileters.

ted keller

---

From: "ddss" <[email-masked]>
Date: Wed, 16 Feb 2000 23:00:54 -0300

Hi Ted ...
Newly, I would like to thanks for you help !!!
I can see that your Site can solve my problem and I beleave that I will find
my right answer !!!
But, I will check that with all attention ...
After this I will return for you, ok ???
Now, thanks for your help !!!

                 [email-masked]

----- Original Message -----
From: Ted Keller <[email-masked]>
To: ddss <[email-masked]>
Cc: <[email-masked]>; Joseph S D Yao <[email-masked]>
Sent: Tuesday, February 15, 2000 11:09 PM
Subject: Re: HELP ... TIS works at ...

> > > [To be removed from this list send the message "unsubscribe
fwtk-users" in
> > the
> > > > [To be removed from this list send the message "unsubscribe
fwtk-users"
> > in the
> > > >              for smtp reject some attached files like *.exe, *.dll
and
> > so on
> > > > > I doubt that you can.  Anybody?  It's pretty wide-spread, but it
is
> > not
> > > > > registered anywhere.  [Yes, it should be registered at NAI/TIS.
We
> > have