About paul.stinson

https://live.paloaltonetworks.com/t5/General-Topics/BlackNurse-Denial-of-Service-Attack/m-p/125760/highlight/true#M46455   When testing an attack at a rate of about 6Mbps (all I could get out of my old Ubuntu box) with hping3 -1 -C 3 -K 3 --flood <target ip>, I saw an increase of about 10% CPU on a PA-3020. It was high enough PPS rate that it triggered a drop following the PA recommendation for a 3020's max ICMP PPS of 8000 but had an activate a little lower than 8000. As stated in my above post, it caused severe problems on the network I was originating the attack from.     ... View more

Hi, Palo Alto Networks has determined that Application and Threat Content version 485 may introduce false-positive triggers on certain IPS signatures involving SSL changes in that content release. We removed content release 485 from public update servers and are re-releasing Application and Threat Content 486 with the SSL changes removed. Please be informed that now content 486 is available. ... View more

No problem!  The discovery of it is still less that a week old and given that it appears to be a well funded nation-state created malware it may take some time to fully investigate before they can release anything on a signature level to block it. ... View more