I’ve come across many postings on forums where admins are talking about being hit by DDOS attacks and the servers going down. I’ve been replying to those threads, but I think its time for me to discuss it at length here.

Basically, DDOS means a Distributed Denial of Service attack which are targeted towards a computer, server or a device to make it unavailable on the network. Lot of malicious traffic is directed towards a server or a service which blocks the bandwidth/network. Here are some steps Windows administrators can go through to prevent or fight against it:

- Keep your servers/computers updated with the latest patches, service packs and updates.
- Harden the TCP/IP stack. Here is an article from Microsoft which talk about it: http://support.microsoft.com/default.aspx/kb/324270
- Check with your Data Center to find out what infrastructure security is in place. They may be having a system in place where the DDoS traffic can be routed through a DDoS Mitigation Service. This filters out the attack traffic and allows the legitimate traffic to continue to its original destination.
- If the budget permits, get a good hardware firewall installed in your infrastructure network. If not, then you can also go in for some software based firewall which can filter packets. In the worst case, at least have your Windows Basic Firewall configured.

Recently I came across a situation in a company which ran ISA Firewall where the Outlook clients were not able to connect to external POP3/SMTP servers. The implementation of the firewall was being done by one of my friends and he was stuck up with this problem.

Upon further discussions with him, I came to know that the clients were using the ISA Firewall client. The ISA Firewall machine was not a member of the domain – which is a good sign. There was a rule configured which allowed DNS, POP3 and SMTP protocols from the Internal network to the External networks. The rule was enabled for all Authenticated Users.

So far so good. Everything seems to be in place and configured right. But what is stopping this traffic?
The problem was the default Firewall Client settings. In the application settings of the Firewall Client settings, OUTLOOK was set to Disable. Modified the value to 0, refreshed the Firewall Client and attempted a connection. BINGO! Everything was working fine now and a treat from my friend was due.

Approximately 60-hours terror siege of Mumbai resulted in the deaths of over 150 people (toll still rising), while more than 300 people sustained injuries as the terrorists took hold of Nariman House, Taj Hotel and Oberoi-Trident hotel. I am deeply saddened with the terrorist attacks in Mumbai and it is due to the India’s brave armed forces, a few of who lost their lives in battle with the terrorists that the situation is back in control. With this post, I would like to salute five such heroes, whose sacrifices will not be forgotten for a long time – Hemant Karkare (Chief of the Mumbai Anti-Terrorist Squad), Major Sandeep Unnikrishnan (National Security Guard Commando), Ashok Kamte (Additional Commissioner of Police, Mumbai), Vijay Salaskar (Head, Anti-Extortion Cell, Mumbai) and Gajendra Singh (NSG Hawaldar).