Re: bandwidth question

 > On Tue, Sep 17, 2013 at 2:03 PM, ToddAndMargo <[email protected]
 > <mailto:[email protected]>> wrote:
 >
 >     Hi Dennis,
 >
 >         Thank you!
 >
 >     -T
 >
 >
 >     On 09/16/2013 09:51 PM, Dennis Dumont wrote:
 >
 >         Not an issue.  Request versus response is still an order of
 >         magnitude
 >         difference.
 >         Dennis Dumont
 >         CCIE #12981
 >         C:440-227-7722 <tel:440-227-7722>
 >
 >
 >         Please consider the environment before printing this email.
 >
 > 
------------------------------__------------------------------__------------
 >         *From:* ToddAndMargo <[email protected]
 >         <mailto:[email protected]>>
 >         *To:* security-basics@securityfocus.__com
 >         <mailto:[email protected]>
 >         *Sent:* Monday, September 16, 2013 7:45 PM
 >         *Subject:* bandwidth question
 >
 >
 >         Hi All,
 >
 >         A customer has asked me to do some human penetration
 >         testing for PCI compliance.  I am planning on doing a bunch
 >         of probing with nmap to look for openings.  I plan to log into
 >         the customer's network with Open VPN over my DSL line.
 >         (And Metasploit when I figure out how to use it too.)
 >
 >         Question: what kind of bandwidth do I need?  I have
 >         ~3 Mbps download and ~.7 Mbps upload?  Am I going
 >         to swamp my DSL modem?  Or is there enough wait time
 >         between probes that that is not an issue?
 >
 >         Many thanks,
 >         -T
 >


On 09/18/2013 06:03 AM, Dag Ger3D wrote:
> Something to consider is that Metasploit traffic may be seen as
> malicious by your ISP. You may need permission from them to perform this
> sort of testing over DSL. Not every ISP is this way, but I recall
> working for Comcast about 15 years ago, and we used to monitor for his
> activity and flag is a malicious. With the increased coverage by the
> media of the "hackers", monitoring traffic by ISPs may be on the rise as
> well. I would start by reading your TOS.
>
> As for the bandwidth, shouldn't be an issue as long as you keep number
> of threads to a reasonable level.
>
> - Oleg L.


Hi Oleg,

    Thank you for the heads up!

    I currently have Open VPN connections on the computers I
have abeen asked to test.  This should get me around the issue.
The new fancy firewall I will be insalling has Intrustion Prevention
Software (IPS) on it and even though I will have this POS
workstation on its own leg, the IPS may lay an eggs on me.
May be a good test of the IPS to make sure it is actually working.
May have to turn the IPS off while I am testing.

    I have noticed that what you say can be gotten around by
upgrading your hgome office Internet accounts to a business
account.  Charter is a real ass about this.  They blocked
a customer of mine from logging into his work (commercial)
VPN when he had to stay at home to mend a bromen collar
bone.  Had another customer who whated to view his work
I.P. camera at home who had to upgrade a work account
too.  Do believe his may have been Charter too, but may have
been Frontier.

Thank you for the help!

-T

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------