We have relaunched: What's new at ZDNet Asia?

ZDNet / Techguide / Internet Security / Story

Is spyware clogging your firewall?

By Jonathan Yarden on June 21, 2005

Summary

If you're troubleshooting intermittent network connectivity, spyware could be the culprit. Jonathan Yarden tells you how to check your firewall for spyware infection.

Events

Microsoft MSDN/Developer Event
25 Mar 2010

One Marina Boulevard, Microsoft Singapore

IT Architect Regional Conference Singapore 2010
20 - 21 Apr 2010

Singapore Management University, Singapore

The Internet Show 2010
21-22 Apr 2010

Suntec Singapore

Organizations frequently ask me for assistance in diagnosing and resolving Internet problems. After a bit of detective work, I usually find that the problems are not really an Internet security issue. There's so much complexity in the corporate network these days, and so many places where a problem can occur, that simply identifying the true source of a networking problem is increasingly complex.

Earlier this month, a hospital that I periodically do some consulting for contacted me and asked for some assistance. Because I've worked there on other projects, I was already quite familiar with its network configuration and equipment.

This organization uses Check Point's FireWall-1, a modular firewall platform. Depending on your network, this can either be just what you need or overkill.

The company also uses Websense Enterprise, an HTTP content-filtering system that monitors and restricts Web sites. Websense interacts with the HTTP proxy on Firewall-1 (the HTTP Security Server) using the URL Filtering Protocol (UFP).

After weeks of trouble, the organization called me in to help solve one of the more frustrating computer problems: intermittent failure. During normal business hours--but not always--Web surfing didn't always work. The problem sometimes occurred even with accessing internal Web sites not proxied by Firewall-1.

At first, the description of the error sounded like a DNS failure, but this wasn't the case. Further details suggested a failure of the Firewall-1 HTTP proxy.

After reviewing the log files, we discovered that one particular Web site was repeatedly turning up in the logs, and Websense was consistently denying access to this Web site. But for some reason, it was also randomly dropping legitimate URLs as well--sometimes not even showing up in the log files.

We finally discovered that the URL that Websense was blocking was evidence of a spyware program transmitting information. It began at 7:30 A.M. and continued throughout the day, and other workstations were also showing up in the logs.

After further investigation, we determined that a program called Wild Tangent Updater was responsible for all of the log entries. The Wild Tangent Updater was attempting to transmit usage information, but it was failing because outbound HTTP requests required authentication by Firewall-1.

Firewall-1 and Websense were doing exactly what they should. So why were they also blocking legitimate Web sites?

All network-connected devices using TCP have limits to their ability to communicate. TCP is a connection-oriented protocol, and it uses a socket for communication.

Checkpoint Firewall-1 employs many individual proxy servers using TCP to handle communication from the internal network to and from the public Internet. Firewall-1 also uses TCP to communicate with Websense to determine whether to allow a URL.

I suspected that Wild Tangent Updater was causing either Firewall-1 or Websense to run out of TCP sockets. TCP sockets have timeouts, so they don't just disappear when you're finished with communication.

My theory seemed to explain the problems quite well. After a quick Google search and a visit to phoneboy.com, I felt that I was on the right track. So we increased the socket limits for Firewall-1 and Websense from their default values, and the problem went away.

Whether the Wild Tangent Updater caused the problem or merely precipitated it, there are certainly a lot of other firewall systems out there that could also experience this type of problem. If you're having similar difficulties, check your firewall: Spyware may be clogging it.

Jonathan Yarden is the senior UNIX system administrator, network security manager, and senior software architect for a regional ISP.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
Transform your business interactions with real-time voice, video and telepresence solutions.
Tech Vendor: Cisco

ZDNet Asia Live

RT @mistertechblog: I wrote about Nexus One and Touchdown, desktop dock, Bluetooth/USB tethering, ebooks here: http://bit.ly/bRdzx0

1 hour 46 minutes ago by yklee13 on topsy

Read my blog post on getting the most from your Nexus One: http://www.zdnetasia.com/blogs/m...

Data Centre Operator (Fresh Graduates Welcome to Apply) in ... http://bit.ly/bagYuu

2 hours 16 minutes ago by intmasterfeed on topsy

#Cisco #Cloud Cloud on ZDNet Asia: Aussie university joins Cisco cloud ยท Early-adopter criminals embrace cloud... http://bit.ly/d93C8S #TCN

3 hours 19 minutes ago by thetechgang on topsy

www.3w.com.au has seen it's outsourced IT Contracting Business in Manila grow at 4 times the rate of its traditional Australian Based...

9 hours 57 minutes ago by brucemills on Companies' outsourcing spend to increase

RT @3wconsulting: Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oY9f

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbA

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbz

Zdnetasia.com Estimated Worth $178,365 USD. Daily Ad Revenue:$244 USD, Daily Views:81,445 Pages... - http://www.haplog.com/www.zdneta...

recently estimated website net worth of zdnetasia.com - http://www.haplog.com/www.zdneta...

19 hours 50 minutes ago by haplog on topsy

When I create an event, I click on an approximate time during the day when I want the event to occur, then I click "edit event detail...

1 day 26 minutes ago by bessellbrowne on Google Calendar gets 'smart' rescheduling

ipads break alott i had one it broke three times in the month i had it so i got rid of the damn thing id just go for the laptop Top Grade...

1 day 28 minutes ago by bessellbrowne on Report: 'Hundreds of thousands' of iPad preorders

There are a number of websites that still require Internet Explorer to view and IE for Mac Stinks (it is really ies4osx which is the Wind...

1 day 29 minutes ago by bessellbrowne on Microsoft: Only minor tweaks in Windows 7 SP1

The receivers don't transmit back to the satellite. Unless there is a phone line attached to the receiver, they don't have any wa...

1 day 32 minutes ago by bessellbrowne on Apple to join the geolocation craze?

"Lead Cognos BI Developer Insurance - Jobs - ZDNet Asia" http://bit.ly/bRcxOG

1 day 27 minutes ago by rhrcognos on topsy

whatever little understanding I have we 'll only progress toward end of the world if we use HPCs to lenthen life of human being. Huma...

1 day 38 minutes ago by abhi32002@gmail.com on High computing promises elixir of life

Thanks for the knowledgeable article on SDDs. Allas...when all this reasearch will happen in Indian Universities. Hope the new bill on Fo...

1 day 51 minutes ago by abhi32002@gmail.com on APAC HPC users eye solid-state drives

It was a good article. This brings a good opportunity for Indian IT firms to come up with new solutions in this field. HPC can become a b...

1 day 10 minutes ago by abhi32002@gmail.com on High computing most-wanted job in Asia

COL KR DHARMADHIKARY(RETD) its very late to reply the link, but if it is still alive and looking for opportunity, i would like to know th...

2 days 7 minutes ago by deb021280 on Education takes off in rural India, helped by PCs

It was just a matter of time until google was marginalised anyway. I'm afraid this will be forgotten in China very quickly. Still, it...

2 days 12 minutes ago by robinsmith on Report: Google to leave China on April 10

High performance computing (HPC) most-wanted job in Asia http://bit.ly/9vFC3i (via @zdnetasia) #singapore

He doesn't care if her shoes are of glass, All he wants to see is a huge rack and nice a*s. Sleeping beauty's not awoken by true ...

2 days 41 minutes ago by warlowdavies on One pair of 3D glasses to rule them all

RT @zdnetasia: EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. (cont) http://tl.gd/i5jjd

EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. http://bit.ly/9etOZW

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08 via @zdnetasia

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

[TECH] URL Shorteners slow Web redirection. - http://bit.ly/bySnWK @zdnetasia

URL shorteners are great but they can slow web redirection & you pray it would never go down http://bit.ly/bySnWK via @zdnetasia

URL shorteners slow Web redirection. http://bit.ly/bySnWK

Chinese agencies cry foul over Google. http://bit.ly/by6rwV

all of sg's isps have been practising compulsory invisible proxy for all home subscribers at their backend since many years back alre...

3 days 51 minutes ago by melvinchia on Web filters mean bad news for business

it is not to good for china.
Proactol

3 days 36 minutes ago by nathonastle on Chinese ad partners beg Google for information

Very good explanation of JMX

4 days 41 minutes ago by Babith B on Managing applications with JMX

The reaction to a report issued Tuesday by Flurry Analytics managed to completely overlook some interesting news--the Android-based Motorola Droid outsold the original iPhone over the same period of time following their respective launches--to focus instead on the sales numbers for the Nexus One.

4 days 44 minutes ago by lonemavericks on diggs

Another ZTE story....

4 days 46 minutes ago by Moderate Your Greed on Philippines opens bid for final 3G license

Keep up with ZDNet Asia

Linkedin Join our network

RSS Feeds Subscribe now

Newsletters Subscribe today

Twitter Follow us

Inside ZDNet Asia

Special Report: Tech Focus in 2010

Latest Videos on Tech Industry

Insight: Interviews with Newsmakers

Search for over 15,000 Tech Jobs in Asia

Find your Tech answers in TechGuides

IT Library: Over 60,000 IT papers at your fingertips

Download IT Priorities 2010 Report