[IPCop-user] Update Accelarator 1.0.0

Discussion:

Stephen Jordaan

2007-09-26 15:17:08 UTC

Hi All

None of my client PC's can run Windows update, Windows update fails during
scan for updates. (websites has encountered a problem)

I get this message in the IDS logs

(http_inspect) BARE BYTE UNICODE ENCODING

I'm using IPCOP-Update Accelerator 1.0.0 and Advproxy 2.1.5

Guardian for 1.4.16

Any ideas what can be causing my problem

Thanks

Stephen

Stephen Jordaan

2007-09-26 18:07:10 UTC

Permalink

Seemed to have found a a way around this, it won't work if I stipulate the
Proxy settings in IE6 orIE7, but if I have the IPCOP running as a
transparent proxy, and I set the Browser to detect proxy settings, it works.

Microsoft says the error 0x80072EE2 is generated when the client does not
get a response from their updates server.

-----Original Message-----
From: ipcop-user-***@lists.sourceforge.net
[mailto:ipcop-user-***@lists.sourceforge.net] On Behalf Of Stephen
Jordaan
Sent: 26 September 2007 05:17 PM
To: ipcop-***@lists.sourceforge.net
Subject: [IPCop-user] Update Accelarator 1.0.0

Hi All

None of my client PC's can run Windows update, Windows update fails during
scan for updates. (websites has encountered a problem)

I get this message in the IDS logs

(http_inspect) BARE BYTE UNICODE ENCODING

I'm using IPCOP-Update Accelerator 1.0.0 and Advproxy 2.1.5

Guardian for 1.4.16

Any ideas what can be causing my problem

Thanks

Stephen

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
IPCop-user mailing list
IPCop-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ipcop-user

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.5.488 / Virus Database: 269.13.31/1031 - Release Date: 2007/09/26
12:12 PM

Alex McColl

2007-09-26 18:43:02 UTC

Permalink

Hi Stephen,
If you turn off guardian does this still happen?
I believe what might have been happening is Snort is interpreting the update
as an intrusion and then in response guardian is blocking. You might check
your block list and see what got blocked at that time.
If that is indeed what is happenning then you could add that ip to your
exception list (unfortunately that IP will vary - so, you'll probably
have to
tweak from time to time.)

Let us know,
Alex.

Post by Stephen Jordaan
Seemed to have found a a way around this, it won't work if I stipulate the
Proxy settings in IE6 orIE7, but if I have the IPCOP running as a
transparent proxy, and I set the Browser to detect proxy settings, it works.
Microsoft says the error 0x80072EE2 is generated when the client does not
get a response from their updates server.
-----Original Message-----
Jordaan
Sent: 26 September 2007 05:17 PM
Subject: [IPCop-user] Update Accelarator 1.0.0
Hi All
None of my client PC's can run Windows update, Windows update fails during
scan for updates. (websites has encountered a problem)
I get this message in the IDS logs
(http_inspect) BARE BYTE UNICODE ENCODING
I'm using IPCOP-Update Accelerator 1.0.0 and Advproxy 2.1.5
Guardian for 1.4.16
Any ideas what can be causing my problem
Thanks
Stephen
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
IPCop-user mailing list
https://lists.sourceforge.net/lists/listinfo/ipcop-user

Bernhard Bitsch

2007-09-26 19:12:06 UTC

Permalink

Hi,
yes its's right the IP for the update varies, but probably it is the
same network. Then you can add this network to the ignore list.
Bernhard

Post by Alex McColl
Hi Stephen,
If you turn off guardian does this still happen?
I believe what might have been happening is Snort is interpreting the update
as an intrusion and then in response guardian is blocking. You might check
your block list and see what got blocked at that time.
If that is indeed what is happenning then you could add that ip to your
exception list (unfortunately that IP will vary - so, you'll probably
have to
tweak from time to time.)
Let us know,
Alex.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
IPCop-user mailing list
https://lists.sourceforge.net/lists/listinfo/ipcop-user

Stephen Jordaan

2007-09-26 19:18:25 UTC

Permalink

Hi Alex

I found the rule that's stopping the Windows updates

ICMP PATH MTU denial of service.

If I turn off this rule, the updates are working

Regards

Steve

-----Original Message-----
From: ipcop-user-***@lists.sourceforge.net
[mailto:ipcop-user-***@lists.sourceforge.net] On Behalf Of Alex McColl
Sent: 26 September 2007 08:43 PM
To: ipcop-***@lists.sourceforge.net
Subject: Re: [IPCop-user] Update Accelarator 1.0.0

Hi Stephen,
If you turn off guardian does this still happen?
I believe what might have been happening is Snort is interpreting the update
as an intrusion and then in response guardian is blocking. You might check
your block list and see what got blocked at that time.
If that is indeed what is happenning then you could add that ip to your
exception list (unfortunately that IP will vary - so, you'll probably
have to
tweak from time to time.)

Let us know,
Alex.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
IPCop-user mailing list
IPCop-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ipcop-user

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.5.488 / Virus Database: 269.13.31/1031 - Release Date: 2007/09/26
12:12 PM

i***@corwyn.net

2007-09-26 22:48:17 UTC

Permalink

Hi! (running ipcop current), mostly default green/red config.

Whenever I try go through the (transparent) squid proxy to a URL
formed like this
http://seal.demotech.com/?id=50370&t=1&s=30

The link won't load. If I turn proxy off, it works just fine. Any ideas?

Thanks

Rick

Rick Steeves
***@sinister.net http://www.sinister.net

A bicycle sails aim-irelandbybicycle
On an ocean of freedom yahoo-ricksteeves
I am the captain msn-***@corwyn.net