Microsoft BING

Hi all,
Today Microsoft will announce the Release of BING, this is an important milestone for Microsoft as search is critical to Microsoft and Bing is a significant step forward in redefining the Search. With Bing, Microsoft's goal is to do more than just make it easier for people to find information, Bing is a decision engine that goes beyond the search. Next week, Bing will go live at http://bing.com try it then and give Microsoft your feedback.

Regards,
Mahmoud

Internetwork Experts Workbook All volumes (I, II, III) V4.1

here is a nice link for all of them:
http://www.mediafire.com/?i1oyzztfnwi

Help stoping Confiker worm

As you might know, Confiker worm is spreading all over the world and hitting so bad, I read the architecture of the worm and it is so tricky.

 

the worm installs itself in the system by registering several DLLs files and service into the system, then it starts to downloads instructions from the internet on how to work, interact and change itself.

 

I have paid a close attention to the worm since the early days, we have been scanning our systems and network on weekly basis to isolate infected PCs and thanks god we have none, what me me write today that I read an article today indicating that baout 4.5 Million PC WW are infected with the Confiker worm.

 

below are some steps to help you protecting your network:

- Install Microsoft hotfix http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

 

- Confiker owns 250 domain per day, so you can use https://www.opendns.com/start to start blocking those domains, since they work with the IBM security research center to block access to those domains.

- use nessus http://blog.tenablesecurity.com/2009/03/detecting-conficker-with-nessus.html to scan your network, I prefer using NMAP.

 

- Finally pray and ask god to help you network.

 

Visit the Microsoft's Confiker page:

http://technet.microsoft.com/en-us/security/dd452420.aspx

 

---

“The information contained in this communication is intended solely for the use of the individual or entity it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this e-mail message is strictly prohibited. If you have received this message by mistake please notify the sender immediately by e-mail, destroy it and delete it from your system. The sender is neither liable for the proper and complete transmission of the information contained in this communication nor for any special, incidental or consequential damages of any nature whatsoever resulting from receipt or use of this communication”

helping OCS not to drop words, applying Voice QoS for OCS on WAN traffic

Long time I haven’t blogged, I was so busy in some new projects that burned my time.

 

I will blog about a topic I wanted to blog about it long time ago, applying the correct QoS for OCS 2007 traffic over the WAN, this has been a hot topic (at least for me) as I believe that all of voice traffic requires over WAN links.

 

I will introduce some QoS terminology in this post, and later will tell you how to apply QoS for OCS traffic.

 

Quality of Service Models

There are 3 service models:

·         Best Effort · No QoS policies are implemented

·         Integrated Services (IntServ) · Resource Reservation Protocol (RSVP) is used to reserve bandwidth per flow across all nodes in a path, uses the Resource Reservation Protocol (RSVP) to reserve network resources in advance of the data actually traveling across the network. Once the end-to-end bandwidth reservation is in place, the data is transmitted.

·         Differentiated Services (DiffServ) · Packets are individually classified and marked; policy decisions are made independently at each node in a path, DiffServ doesn't use RSVP, but instead uses hop by hop Behavior or per hop behavior (PHB) to allow each router/hop across the network to examine the packet and decide what service level it should receive.

IP QoS Markings

We currently use 2 QoS marking methods:

·         Precedence · The first three bits of the IP TOS field are evaluated; compatible with Ethernet CoS and MPLS EXP values

·         DSCP · The first six bits of the IP TOS are evaluated to provide more granular classification; backward-compatible with IP Precedence

The following table contains the Precedence Values

	Binary	Application
7	111	Reserved
6	110	Routing
5	101	Voice
4	100	Streaming Video
3	11	Call Signaling
2	10	Transactional
1	1	Bulk Data

 

The following table lists the DSCP marking values:

Likely to be dropped	AF Class	Drop Probability	DSCP Value
Low	AF Class 1	AF11 (low)	001 01 0
		AF12 (medium)	001 10 0
		AF13 (high)	001 11 0
Medium	AF Class 2	AF21 (low)	010 01 0
		AF22 (medium)	010 10 0
		AF23 (high)	010 11 0
High	AF Class 3	AF31 (low)	011 01 0
		AF32 (medium)	011 10 0
		AF33 (high)	011 11 0
Very High	AF Class 4	AF41 (low)	100 01 0
		AF42 (medium)	100 10 0
		AF43 (high)	100 11 0

 

How to reserve the Bandwidth:

You can use any of the following methods:

·         Policing · Creates an artificial ceiling on the amount of bandwidth that may be consumed; traffic exceeding the cap and be remarked or dropped

·         Shaping · Similar to policing but buffers excess traffic for delayed transmission; makes more efficient use of bandwidth but introduces a delay

 

Mahmoud

---

“The information contained in this communication is intended solely for the use of the individual or entity it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this e-mail message is strictly prohibited. If you have received this message by mistake please notify the sender immediately by e-mail, destroy it and delete it from your system. The sender is neither liable for the proper and complete transmission of the information contained in this communication nor for any special, incidental or consequential damages of any nature whatsoever resulting from receipt or use of this communication”

And MS laucnhes Microsoft Egypt Heroes

Karim Salah started several months ago the heroes imitative in Egypt, a group of the ITpros in Egypt that deliver specialized message for them, great idea from Kimo.

 

To join please visit http://www.hero-eg.com

 

Mahmoud

---

“The information contained in this communication is intended solely for the use of the individual or entity it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this e-mail message is strictly prohibited. If you have received this message by mistake please notify the sender immediately by e-mail, destroy it and delete it from your system. The sender is neither liable for the proper and complete transmission of the information contained in this communication nor for any special, incidental or consequential damages of any nature whatsoever resulting from receipt or use of this communication”

Blog Post: "The call could not be completed because security levels do not match"

Hi,

I had a weird issue with my OCS in the last 2 weeks, I will blog about the first one in a later post, the problem that I will talk about it here is that I couldn’t join a conf. or do any one to one conf. with any of my Tandberg video endpoints from OCS client.

 

The problem started after a security review we have done ourselves and we came up with several action to take to enhance our security internally, after the review OCS to CODIAN MCU communication got dropped.

 

The first problem stopped us from debugging it, last Thursday we solved the first problem so we started to edbug this one, below are the symptoms of the issue:

-          When you do a call from OCS client to Codian MCU the following error appears in the OCS client “The call could not be completed because security levels do not match".

-          In the MCU ou will find the following error: Unable to provide video channel - possible bandwidth/codec issue

Cause:

The cause was that OCS 2007 server has been configured to require encryption at the A/V conference, this causes the communication to drop, configuring the module to support encryption fixes the problem.

 

Mahmoud

blog Post: confirmed bug with Kaspersky WS/File server/Ent and SCCM Remote tools

I had an issue in my network and it is a confirmed issue with the KAV, we are currently running Kaspersky adminkit 7 latest build to protect our workstations and servers, we run Kaspersky for workstation latest builds, Windows XP SP3 and Vista SP1 with the latest windows updates across our network, we have about 8 remote sites and reaching about 750 client, a salve server installed in each site which reports to the Master adminkit in the HQ.

 The issue is

The issue with MS SCCM remote tool on a protected station (Either running KAV for workstation/file server/Ent), and when opening the KAV windows from the taskbar the remote tool connection drops, we run MS SCCM SP1 with SQL 2005 and Windows 2003 SP2 latest updates.

 

I reported it to Kaspersky and once fixed I will post an update on it.