If the School goes DHCP instead of Static for Residents

[apac]

Originally posted by: fivespeed5

Originally posted by: Wuffsunie
looking at router and switch logs to see what physical ports are doing the most traffic is the most likely.

Really, there are many different ways.

bingo, they can simply limit the port in your room

That's what happened to me last year. Actually, they only throttled back the filesharing ports that had been getting the most traffic. I still filled a 160gb HD before they cracked down though .

 

[TuxDave]

Originally posted by: brunswickite
do you go to Rutgers?

lol... I was wondering that too. I don't remember the procedure exactly, but they register your mac address before they let you on the network. If I had to guess, if you tried switching to another NIC, you would need to reregister the new card.

 

[Gravity]

MAC addresses can be altered and spoofed. At least these guys think so.

 

[Amorphus]

btw - 2gb/500mb per week? or month?

 

[FoBoT]

users need to realize that network admins are smarter than they are and get over it

 

[Zenmervolt]

My school went to PPPoE a couple years back. They'd track you by that.

For kids in the dorm this year, they will have a CD that is required to be run before any computer can be connected to the network the first time. The CD does a forcible install of every critical Windows Update, then a forcible un-install of any Anti-Virus software, then a forcible install of Norton 2004, then forces a full system virus scan. After everything is completed, the program registers the computer on the network and activates the port.

We've had some serious problems with viri on the network here and they are really cracking down.

What gets me is when people come into the _labs_ with a laptop and ask us to let them plug the computer into our network, then get all pissy when we say no.

ZV

 

[minendo]

Originally posted by: Zenmervolt
My school went to PPPoE a couple years back. They'd track you by that.

For kids in the dorm this year, they will have a CD that is required to be run before any computer can be connected to the network the first time. The CD does a forcible install of every critical Windows Update, then a forcible un-install of any Anti-Virus software, then a forcible install of Norton 2004, then forces a full system virus scan. After everything is completed, the program registers the computer on the network and activates the port.

Sh!tty policy. Probably easy to get around though.

 

[cronos]

Originally posted by: FoBoT
users need to realize that network admins are smarter than they are and get over it

haha... winnar!

admins are teh God

if i were them i would cap the port also instead of by MAC address. too many opportunities for abuse. and yeah, because this is a dorm, i would *expect* abuse.

 

[Zenmervolt]

Originally posted by: minendo

Originally posted by: Zenmervolt
My school went to PPPoE a couple years back. They'd track you by that.

For kids in the dorm this year, they will have a CD that is required to be run before any computer can be connected to the network the first time. The CD does a forcible install of every critical Windows Update, then a forcible un-install of any Anti-Virus software, then a forcible install of Norton 2004, then forces a full system virus scan. After everything is completed, the program registers the computer on the network and activates the port.

Sh!tty policy. Probably easy to get around though.

I haven't looked at the CD much, I just work in the labs. (For the next 4 days anyway.) But it looks like the only way to get the network authentication is to let the program run through and the thing definitely gets pissy if you try to end it. You can stop it, but you ain't getting the authentication if you do.

I can see where the policy is coming from though. The dorms still get hit with 4 year old viri because the morons never patch their machines.

Basically, the CD just forces them to update to the most current and secure version of windows, and forces them to have an up-to-date anti-virus software. Still, I'm glad that I won't be here when Fall semester starts and everyone comes in bitching about it.

ZV

 

[yukichigai]

Originally posted by: Zenmervolt
My school went to PPPoE a couple years back. They'd track you by that.

For kids in the dorm this year, they will have a CD that is required to be run before any computer can be connected to the network the first time. The CD does a forcible install of every critical Windows Update, then a forcible un-install of any Anti-Virus software, then a forcible install of Norton 2004, then forces a full system virus scan. After everything is completed, the program registers the computer on the network and activates the port.

We've had some serious problems with viri on the network here and they are really cracking down.

Does it forcibly prevent you from uninstalling Norton and reinstalling a real Antivirus program?

P.S. and what do you do about folks running Linux or Mac OS*?

 

[minendo]

Originally posted by: Zenmervolt

Originally posted by: minendo

Originally posted by: Zenmervolt
My school went to PPPoE a couple years back. They'd track you by that.

For kids in the dorm this year, they will have a CD that is required to be run before any computer can be connected to the network the first time. The CD does a forcible install of every critical Windows Update, then a forcible un-install of any Anti-Virus software, then a forcible install of Norton 2004, then forces a full system virus scan. After everything is completed, the program registers the computer on the network and activates the port.

Sh!tty policy. Probably easy to get around though.

I haven't looked at the CD much, I just work in the labs. (For the next 4 days anyway.) But it looks like the only way to get the network authentication is to let the program run through and the thing definitely gets pissy if you try to end it. You can stop it, but you ain't getting the authentication if you do.

I can see where the policy is coming from though. The dorms still get hit with 4 year old viri because the morons never patch their machines.

Basically, the CD just forces them to update to the most current and secure version of windows, and forces them to have an up-to-date anti-virus software. Still, I'm glad that I won't be here when Fall semester starts and everyone comes in bitching about it.

ZV

As for those that don't run windows?

 

[Zenmervolt]

Originally posted by: yukichigai
Does it forcibly prevent you from uninstalling Norton and reinstalling a real Antivirus program?

No, it doesn't.

Theoretically if you wanted to be a real jerk about it you could even un-install all the windows updates.

But the CD isn't targeted at the people like you who know what they're doing. It's targeted at the problem people. The ones who have never updated their systems.

What's wrong with Norton anyway? It's nice and quiet in the background and does a good job as a last line of defense. Personally, I've never had a virus make it onto my machine in the 4 years I've been on high-speed. (Never had one on dial-up before that either, but that doesn't count really.) The wonders of having my machine up-to-date and disabling scripting.

ZV

EDIT: There is to be a Mac version as well. Nothing that I know of for Linux, but as I said, Linux users aren't the problem group. I would imagine that there will be a number to call or something if they are running linux.

Also as I said, I'm in the labs, we're a completely different department from the Resnet people. We just keep a hacked copy of this CD to do windows updates on machines that students bring us to repair. It's easier and faster than downloading the updates.

 

[Mookow]

Originally posted by: FoBoT
users need to realize that network admins are smarter than they are and get over it

Precisely. At my university, I can look at the top talkers internal and external, by physical port on the Cisco gear, by MAC, by network port (we look at the top FTPers frequently), by IP, etc. I love making phone calls like this:
Me: Sir, this is IS&T Networking calling. Is this Mr. Ima Dipshit?
User: Yes, it is.
Me: I'm calling about the excessive network traffic coming from your room.
User: Excessive traffic?
Me: Yes. Specifically, FTP.
User: Are you sure you have the right computer?
Me: Yes. The computer name is I_Dipshit, and the database says the cable goes to your office.
User: Oh... well, still, I'm not FTPing anything.
Me: Are you sure?
User: Yes.
Me: Well then, give me a moment to run a more in-depth analysis of traffic coming from this computer. Hmmm.... we're going to have to investigate this, since now that I look more closely, the last file transferred was "Lesbian Confessions #14.mpg". I know for sure this cable goes somewhere on that floor, and I'm sure the Dean of Engineering would be happy to assist me, and quite interested in the results of my investigation.
User: *very quietely* Oh sh!t. *pause* *normal vioce* Ummm... *pause*
Me: Precisely.
*long pause*
User: How about I look into this matter myself? I'm sure I could guarantee that there were be no more of this spurious network traffic.
Me: You do that. *click*
Me: *rolfpimp*

Yes, our equipment will find out file names of files being FTPed. And yes, I did have a conversation very like the one above, except I made up the file name (it was obviously porn, but I forget the specific name) and it was in a different department. And, obviously he wasnt actually named Ima Dipshit... though he should have been.

EDIT: when I called, I already knew he was uploading porn. But really, we dont have an official policy against porn, just excessive traffic. But I wasnt going to volunteer that information.

 

[slpaulson]

Originally posted by: minendo

Originally posted by: yukichigai

Originally posted by: minendo

Originally posted by: isekii
Also, if you have several different modems, then you can basically defeat this MAC address rule.. no ?

Not if they require phone call to release/renew IPs when hardware is changed.

That would be the stupidest system ever. That being said, they'll probably do it.

Many places already do.

I know one of my friends actually had to pay like $5 to get the internet in his dorm.
That's pretty bunk, but that's how some schools do it.
My school just uses DHCP and it works well enough.

 

[yukichigai]

Originally posted by: Zenmervolt
What's wrong with Norton anyway? It's nice and quiet in the background and does a good job as a last line of defense. Personally, I've never had a virus make it onto my machine in the 4 years I've been on high-speed.

1) It costs money, where AVG doesn't. Not a big issue though.
2) It interferes(sp?) with certain programs I use, ones with legitimate uses. (coding/modding stuff)
3) On a fresh install of 2000 a fully-updated Norton caused my computer to crash every 5 hours. That's what killed it for me. I've never had any problems like that with AVG, save for when it tried to scan for virii while I had an active torrent open.

 

[spidey07]

ok, here we go.

If the IT department is smart then there is NO way you can get around it.

The ports are locked down and labeled to each and every room. go over the limit - get shut down/reported/throttled or whatever they want.

put more than one MAC on it or change mac?
shutdown and logged

put wireless on it?
shutdown and logged

have worm/virus?
shutdown and logged

malicous traffic?
shutdown and logged

run any kind of server they don't like (dhcp, wins, filesharing, etc)
shutdown and logged

That's if they know what they're doing.



Most of this stuff is done on a switch port level through automated software and features of the net itself. So in all reality it doesn't matter if they use DHCP or not because most of this is all done at layer2 - the MAC layer where your MAC address is.

So lets say you change your MAC address?
But you're still on the same switch port so your stats haven't changed.

heh - I'm getting ready to put in a large campus net where you can't even talk to anything until the following are verified:
1) patched out
2) correct userid/password
3) virus scanner installed and up to date
4) no worm activity
5) firewall installed with correct policy
[/b
don't meet those? Then you can't talk. Well - the only thing you can talk to is a web page that will do all of this for you.

 

[cessna152]

Is this for Rutgers Univeristy?

Yea, we are going to DHCP. When you register you will be running a few programs to ensure that your system is clean of any worms/viruses. I'm sure you remember the debacle with the RADS. At that time, your MAC address will be recorded by our servers and you will be leased an IP for the semester. You will get new ips every semester. This will be significantly easier for new students since they will not need to enter an ip. If your MAC changes you will not get a connection until you re-register. This will also cut down on ip jumping...

 

[amdskip]

We have a solution on our campus to bandwidth hogging without limiting students. You can have 100 connections open, nothing more. We have a box in each dorm controlling this and they don't break a sweat. We had some students with 800+ open and causing all sorts of problems. We also can track students with ports and turn them off if they do not do windows updates as requested.

 

[Zenmervolt]

Originally posted by: yukichigai

Originally posted by: Zenmervolt
What's wrong with Norton anyway? It's nice and quiet in the background and does a good job as a last line of defense. Personally, I've never had a virus make it onto my machine in the 4 years I've been on high-speed.

1) It costs money, where AVG doesn't. Not a big issue though.
2) It interferes(sp?) with certain programs I use, ones with legitimate uses. (coding/modding stuff)
3) On a fresh install of 2000 a fully-updated Norton caused my computer to crash every 5 hours. That's what killed it for me. I've never had any problems like that with AVG, save for when it tried to scan for virii while I had an active torrent open.

Yeah, I'll grant that Norton has some issues. But all-in-all it's a competant program for 95+% of users. To be honest though, I have stuck with NAV 2002 even though 2003 and 2004 are available free through school because 2002 has fewer issues with other programs.

I should look into AVG though. Is the system footprint smaller?

ZV

 

[Zenmervolt]

Originally posted by: spidey07
heh - I'm getting ready to put in a large campus net where you can't even talk to anything until the following are verified:
1) patched out
2) correct userid/password
3) virus scanner installed and up to date
4) no worm activity
5) firewall installed with correct policy

don't meet those? Then you can't talk. Well - the only thing you can talk to is a web page that will do all of this for you.

Sounds a lot like what the CD from Pitt does.

ZV

 

[spidey07]

Originally posted by: Zenmervolt

Originally posted by: spidey07
heh - I'm getting ready to put in a large campus net where you can't even talk to anything until the following are verified:
1) patched out
2) correct userid/password
3) virus scanner installed and up to date
4) no worm activity
5) firewall installed with correct policy

don't meet those? Then you can't talk. Well - the only thing you can talk to is a web page that will do all of this for you.

Sounds a lot like what the CD from Pitt does.

ZV

yeah, but this is continous. not one time check. Although could be the same system.

All these checks are performed when the link goes up or down (booting, plugging in, etc). If worm activity is detected after the fact the port is shutdown.

 

[yukichigai]

Originally posted by: Zenmervolt
I should look into AVG though. Is the system footprint smaller?

If you mean size- and resource-wise, yes. Takes up very little space on the hard drive and I don't even notice it running in the background. (except when it's doing a full test) It doesn't have all the fancy bells and whistles that NAV does -- no Registry Tracker, no Disc Doctor (that Microsoft will buy and incorporate into their OS 3 years from now), but I've yet to hear of AVG missing a virus that NAV catches.

You can get the full version of AVG too. Not sure what it has over the free version beyond active tech support. I'll ask my mom: she got so hooked on AVG she bought the full version.

EDIT: oh yeah, when I installed Norton on the fresh 2000 install I had to update it from 2002 to 2004 in order to get the most current virus updates. It would not let me do it any other way. That's another thing I didn't like about it.

 

[eigen]

My school has ethernet ports littered around campus. So if you really want to keep the BT/p2p rocking just connect at different places on campus. i guess we are lucky.Though they do enforce limits in dorms (by port ) as well.

 

[DaiShan]

Originally posted by: isekii
How would they be able to monitor the amount uploaded and the amount downloaded pending there is a

2gb download and 500mb upload limit ?

mac address linked to port info and student info, my school does it, but they don't limit anything, just don't let you run servers and stuff.

 

[DaiShan]

Originally posted by: isekii
Also, if you have several different modems, then you can basically defeat this MAC address rule.. no ?

No, my school limits you to 3 mac registrations unless you have extenuating circumstances. You have to visit an intraweb site as soon as you plug into your dorm port and register your MAC before you get assigned your ip, we have to log on with our "gator link " account, which is the account we use to logon to all school related things like signing up for classes etc. Besides you HAVE to register your MAC BEFORE you use the network, not like they don't know who you are lol.