Sudden increase in spam on my .me account

Hi,
As the title suggests, Ive had a sudden increase in spam on my .me account.
Its gone from 1 a week to 2 a day, then 5 & now its upto 30 spam a day & there
all from what looks like normal companies ( i know there not though)
Ive even installed spam sieve which works fine but I still have to check it
evey day.
Any suggestions welcome.
Kindest,
Jeff

Forward the spam to [email protected] so Apple can adjust their junk mail filters.

Similar Messages

  • What's with the increase # of SPAMS recently??

    All of a sudden (seema to have coincided with Leopard's introduction)...I'm getting 10 + spams daily ....prior to this I might get a ramdom spam one or two times a week....has anyone else experienced an increase in SPAM....and are there mail filters you can recommend?
    Currently I send to JUNK anyone who is not in my address book but it seems to be increasingly more difficult to restrict the number of DISGUSTING spams I'm getting.

    If you've got a Gmail account, you can try routing your mail through there--their spam filters are excellent and catch nearly everything. They've also got a built-in POP checker that you can configure to download mail from your ISP or other POP account.
    - jim

  • Recent increase in spam through iCloud?

    For many years my emails received through Apple Mail via iCloud have been virtually spam-free.  I put this down to excellent filtering by Apple and my own care.  Although my domain name is public and used on my web site, I use a different name in front of the @ for each organisation I deal with:  [email protected] or [email protected] etc.  The aim here was to limit damage should one of these emails leak out.  About once a month I would get a spam email.  At first I wondered whether the organisation had leaked it, but I now believe spammers are random-guessing strings in front of a known domain.
    In the last couple of months I have seen a huge increase in the spam reaching me - many per day, all addressed to a random selection of my hundreds of email addresses.  I still think these are spammers hitting it lucky with randomly generated strings in front of my domain name.  But why the sudden increase?  Has Apple's anti-spam team  fallen asleep on the job?
    I used to forward spam to [email protected] but I have given up on that.  I read somewhere that marking a message as spam (well Junk actually) was sufficient for Apple to take note.  Is that sufficient?
    There used to be an option in Apple Mail to bounce an email.  That went a while back.  Without any bounce option, spammers may be able to deduce an address is valid by the lack of a bounce.
    Any comments or advice welcomed.

    If the spam is coming to your domain email there's nothing that Apple can do as it comes directly from your hosting service  mail servers to your Mac. Contact your website hosting service regarding filters.
    Apple can only help if your email address ends in iCloud.com, mac.com or me.com.

  • Sudden increase in buffer gets per executions in update statement

    Hi,
    Recently we have encountered one performance issue, which is most likely caused by a sudden increase in the buffer gets per execution.
    The SQL is an update statement, updating a table using a primary key (we have checked to confirm the running execution plan is using the primary key), and one field being updated is a BLOB column.
    As shown in the below statistics, there is no major change in the number of executions during the every 20 minutes monitoring interval. However, the buffer gets per executions has been more than double, and the CPU time is almost doubled, hence the exec_time (elapsed time) has been doubled.
    The same SQL has been running for the past four years in multiple similar databases. The database is Oracle 9.2.0.4 running on Solaris 9. For the past 300 days, the average elapsed time per execution is about 0.0093s, while the average buffer gets per execution is about 670. The update statement has been executed about 9 times per second.
    The question is why there is a sudden increase in the buffer gets? The sudden increase happened twice for the past two days.
    <pre>
    B_TIME E_TIME EXECUTIONS_DIFF EXEC_TIME CPU_TIME BUFFER_GETS EXEC_PER_DAY
    2009-11-25-14:04 2009-11-25-14:23 8513 .0069 .0068 315.56 646329
    2009-11-25-14:23 2009-11-25-14:43 10170 .007 .0068 312.28 726188
    2009-11-25-14:43 2009-11-25-15:05 11873 .0072 .0069 320.17 787885
    2009-11-25-15:05 2009-11-25-15:23 8633 .011 .0101 844.83 675014
    2009-11-25-15:23 2009-11-25-15:44 9668 .0144 .0137 1448.51 680778
    2009-11-25-15:44 2009-11-25-16:04 9671 .0163 .0156 1809.04 702163
    2009-11-25-16:04 2009-11-25-16:25 10260 .0188 .0177 2107.67 711447
    2009-11-25-16:25 2009-11-25-16:44 9827 .0157 .0151 1834.3 739593
    2009-11-25-16:44 2009-11-25-17:05 10586 .0171 .0164 2008.25 714555
    2009-11-26-08:04 2009-11-26-08:24 11028 .0182 .0172 1979.61 800688
    2009-11-26-08:24 2009-11-26-08:44 10533 .0154 .0149 1734.62 750248
    2009-11-26-08:44 2009-11-26-09:04 9367 .018 .0168 2043.95 685274
    2009-11-26-09:04 2009-11-26-09:24 10307 .0214 .0201 2552.43 729938
    2009-11-26-09:24 2009-11-26-09:45 10932 .0251 .0234 3111.48 762328
    2009-11-26-09:45 2009-11-26-10:05 10992 .0278 .0254 3386.41 797404
    2009-11-26-15:03 2009-11-26-15:16 7183 .0425 .0348 4615.42 746824
    2009-11-26-15:16 2009-11-26-15:23 2921 .0417 .0373 4887.75 682092
    2009-11-26-15:23 2009-11-26-15:43 9597 .0393 .0352 4603.62 679656
    2009-11-26-15:43 2009-11-26-16:03 8797 .0411 .0362 4783.66 630755
    2009-11-26-16:03 2009-11-26-16:23 9957 .0453 .0391 5168.28 718100
    2009-11-26-16:23 2009-11-26-16:43 11209 .0436 .0369 4870.77 808395
    2009-11-26-16:43 2009-11-26-17:03 10729 .0428 .0375 5119.56 766103
    2009-11-26-17:03 2009-11-26-17:23 9116 .0409 .0363 4912.58 659098
    </pre>
    Yesterday I did a trace on one of the sessions running the update statement, and below is the tkprof output:
    <pre>
    call count cpu elapsed disk query current rows
    Parse 76 0.03 0.00 0 0 0 0
    Execute 76 4.58 5.14 0 567843 19034 76
    Fetch 0 0.00 0.00 0 0 0 0
    total 152 4.61 5.14 0 567843 19034 76
    Misses in library cache during parse: 1
    Optimizer goal: CHOOSE
    Parsing user id: 88
    Rows Row Source Operation
    1 UPDATE (cr=30 r=0 w=0 time=6232 us)
    1 INDEX UNIQUE SCAN <PK Index Name> (cr=3 r=0 w=0 time=58 us)(object id 81122)
    Elapsed times include waiting on following events:
    Event waited on Times Max. Wait Total Waited
    Waited--------------------------------------------------------------------------------
    SQL*Net message to client 152 0.00 0.00
    SQL*Net message from client 152 0.00 0.22
    SQL*Net more data from client 1894 0.00 0.03
    SQL*Net break/reset to client 152 0.00 0.00
    buffer busy waits 14 0.00 0.00
    enqueue 1 0.61 0.61
    </pre>
    GaoYuan

    Hi,
    I've reformatted your output for better understanding (with {noformat}...{noformat}):
    B_TIME           E_TIME           EXECUTIONS_DIFF  EXEC_TIME   CPU_TIME BUFFER_GETS EXEC_PER_DAY
    2009-11-25-14:04 2009-11-25-14:23            8513      .0069      .0068      315.56       646329
    2009-11-25-14:23 2009-11-25-14:43           10170       .007      .0068      312.28       726188
    2009-11-25-14:43 2009-11-25-15:05           11873      .0072      .0069      320.17       787885
    2009-11-25-15:05 2009-11-25-15:23            8633       .011      .0101      844.83       675014
    2009-11-25-15:23 2009-11-25-15:44            9668      .0144      .0137     1448.51       680778
    2009-11-25-15:44 2009-11-25-16:04            9671      .0163      .0156     1809.04       702163
    2009-11-25-16:04 2009-11-25-16:25           10260      .0188      .0177     2107.67       711447
    2009-11-25-16:25 2009-11-25-16:44            9827      .0157      .0151      1834.3       739593
    2009-11-25-16:44 2009-11-25-17:05           10586      .0171      .0164     2008.25       714555
    2009-11-26-08:04 2009-11-26-08:24           11028      .0182      .0172     1979.61       800688
    2009-11-26-08:24 2009-11-26-08:44           10533      .0154      .0149     1734.62       750248
    2009-11-26-08:44 2009-11-26-09:04            9367       .018      .0168     2043.95       685274
    2009-11-26-09:04 2009-11-26-09:24           10307      .0214      .0201     2552.43       729938
    2009-11-26-09:24 2009-11-26-09:45           10932      .0251      .0234     3111.48       762328
    2009-11-26-09:45 2009-11-26-10:05           10992      .0278      .0254     3386.41       797404
    2009-11-26-15:03 2009-11-26-15:16            7183      .0425      .0348     4615.42       746824
    2009-11-26-15:16 2009-11-26-15:23            2921      .0417      .0373     4887.75       682092
    2009-11-26-15:23 2009-11-26-15:43            9597      .0393      .0352     4603.62       679656
    2009-11-26-15:43 2009-11-26-16:03            8797      .0411      .0362     4783.66       630755
    2009-11-26-16:03 2009-11-26-16:23            9957      .0453      .0391     5168.28       718100
    2009-11-26-16:23 2009-11-26-16:43           11209      .0436      .0369     4870.77       808395
    2009-11-26-16:43 2009-11-26-17:03           10729      .0428      .0375     5119.56       766103
    2009-11-26-17:03 2009-11-26-17:23            9116      .0409      .0363     4912.58       659098
    call     count       cpu    elapsed       disk      query    current        rows
    Parse       76      0.03       0.00          0          0          0           0
    Execute     76      4.58       5.14          0     567843      19034          76
    Fetch        0      0.00       0.00          0          0          0           0
    total      152      4.61       5.14          0     567843      19034          76
    Misses in library cache during parse: 1
    Optimizer goal: CHOOSE
    Parsing user id: 88
    Rows     Row Source Operation
          1  UPDATE  (cr=30 r=0 w=0 time=6232 us)
          1   INDEX UNIQUE SCAN <PK Index Name(cr=3 r=0 w=0 time=58 us)(object id 81122)
    Elapsed times include waiting on following events:
      Event waited on                             Times   Max. Wait  Total Waited
      SQL*Net message to client                     152        0.00          0.00
      SQL*Net message from client                   152        0.00          0.22
      SQL*Net more data from client                1894        0.00          0.03
      SQL*Net break/reset to client                 152        0.00          0.00
      buffer busy waits                              14        0.00          0.00
      enqueue                                         1        0.61          0.61
    ********************************************************************************Can you please provide a DDL for the table, indexes, type of the tablespace(s) they reside in (ASSM/MSSM, extents sizes), the UPDATE statement, how many sessions on average/peaks are doing the same thing concurrently, how many sessions are working this table concurrently and how do they use it?

  • Spam in email sub-account

    I do not use any explicit spam protection tools other than what comes automatically with my Verizon DSL email service.  My primary user account gets no spam, but a sub-account is flooded with spam daily.  How can I extend anti-spam protection to the sub-account?   Thanx...

    I do not use any explicit spam protection tools other than what comes automatically with my Verizon DSL email service.  My primary user account gets no spam, but a sub-account is flooded with spam daily.  How can I extend anti-spam protection to the sub-account?   Thanx...

  • Anyone else seeing a sudden uptick in SPAM making it through their Ironports?

    Quick question:
    We updated our C170 to 8.5.6-092 last week, and since then we've seen a massive increase in SPAM making it through our Ironport undetected.
    I've read some updates here re: SBRS and repengine issues after an 8.5.6-092 update, and have investigated these (both are OK) but nonetheless I am curious if others are seeing the same thing.
    What I'd like to know is if these are just a new spam campaign that is making it through the Ironport filters, or if we have an actual technical issue after the 8.5.6-092 upgrade that I'm missing.
    Current status:
    Rule Type     Last Update     Current Version     New Update
    CASE Core Files     Tue Sep 30 12:22:51 2014     3.3.1-009     Not Available
    CASE Utilities     Tue Sep 30 12:22:51 2014     3.3.1-009     Not Available
    Structural Rules     Mon Oct 6 08:08:52 2014     3.3.1-009-20141005_221700     Not Available
    Web Reputation DB     Mon Oct 6 01:18:29 2014     20141006_081308     Not Available
    Web Reputation DB Update     Mon Oct 6 09:18:56 2014     20141006_081308-20141006_161553     Not Available
    Content Rules     Mon Oct 6 10:06:11 2014     20141006_170304     Not Available
    Content Rules Update     Mon Oct 6 10:06:11 2014     20141006_170501     Not Available
    In general, we're seeing spam with the following characteristics:
    1) many originate from, or contain links to, .link domains
    2) SBRS on these are clear (-1, -2) and gets a pass on the SBRS check
    3) Sample subjects:
    SENDER:     [email protected]
    SUBJECT:     Exclusive: Enrollment Plans from Blue-Cross, Humana, and AARP.
    SENDER:     [email protected]
    SUBJECT:     Re: Someone has run-a-background scan on you. See-your results #190860649
    SENDER:     [email protected]
    SUBJECT:     Alert:Someone ran your background-scan. Read the results #1609820.01
    SENDER:     [email protected]
    SUBJECT:     Ford Cuts Prices to Make Quotas.
    SENDER:     [email protected]
    SUBJECT:     Website May Expose Your Arrest Records. (see details)
    SENDER:     [email protected]
    SUBJECT:     Re: Your background-report may have been viewed on 10/03/14
    4) Furthermore, many contain .link URL's in the content, and the newly added URLscanning seems to be giving these a total pass, too.
    Some samples: http://signupnow.growingmedicareprovider.link , http://detailshere.largelycarsavings.link etc.
    We're playing wack-a-mole with individual rules for subjects and .link domains, i.e. to flag and quarantine these as they come in, but I'd like to know if anyone else seeing this, or just me?
    -b

    Hello Bryan,
    Ideally for us to diagnose if there is a possible fault in your IronPort or with misconfiguration we would need you configuration file, complete message tracking information and also the actual samples which are passing the device.
    Thus i would like to recommend you to open a Cisco TAC case with us so we can be of assistance.
    In terms of the information provided (there maybe some other variables to consider as well).
    I would suggest firstly running this command on your device if not already done.
    CLI > updatenow force
    Let the systems update all services again.
    Continue to monitor.
    These server IPs if they continue to send such emails their IP's will hit a blacklist.
    However at this point, there are too many variables in place that can affect the scanning of these emails and reasons why they're passing.
    EDIT:
    8.5.6-092 revision corrects the SBRS connection that was witnessed in -074 as per the release notes.
    Regards,
    Matthew

  • Sudden increase in Tablespace - Oracle 9.2.0.8

    The oracle tablespace increased suddenly but without loading the actual data. On 06/15, the tablespace has a free space on 1.5G, but all of a sudden, all 1.5G has been consumed and casued the batch job to abend due to lack of space in the tablespace. The tablepace was increased by 2.5G and the batch job ws successfully completed. Till now ( after 1 month) there was no decrease in the free space of the tablespace (still 2.5G) and there was a increase in the size of the tablespace.
    Please could you help in sudden consumption of the free space by the tabllespace. here are the tablespace storage details.
    BLOCK_SIZE 8192,
    INITIAL_EXTENT 6553600,
    NEXT_EXTENT 6553600,
    MIN_EXTENTS 1,
    MAX_EXTENTS 2147483645,
    PCT_INCREASE 0,
    MIN_EXTLEN 6553600,
    STATUS ONLINE,
    CONTENTS PERMANENT,
    LOGGING LOGGING,
    FORCE_LOGGING NO,
    EXTENT_MANAGEMENT LOCAL,
    ALLOCATION_TYPE UNIFORM,
    SEGMENT_SPACE_MANAGEMENT AUTO,
    DEF_TAB_COMPRESSION DISABLED
    Thanks,
    Mahesh

    Hi All,
    I got the answer. It is a bug in oracle 9.2.0.8. Oracle support has given as patch to implement and it should resolve issue.Here is the quote from Oracle support " It seems you have hitting the known Bug 5987262 duplicate of Bug 5890312 Unexplained increases in unformatted blocks in a tablespace ..This issue is also addressed by article : Note 469985.1 Ext/Mod Sudden Increase in Unformatted Blocks "
    Thanks for your support
    Thanks,
    Mahesh

  • Sudden Increase in database size

    Hi all,
    I have noticed sudden increase in sys schema size, after making queries on DBA_TABLESPCAES, DBA_DATA_FILE,
    DBA_EXTENTS,DBA_SEGMENTS.
    Does it means Oracle has generated lot of data after queries to these views ?
    It's very urgent .
    Please reply.

    Hi,
    Is any application accessing this database? If yes, then did you confirm with the application contact whether any heavy changes have taken place in the application/database? I think that an increase of 300M is not huge but normal/acceptable. However, it is a factor of the actual database size. What is you database size?
    Regards.

  • Increase in spam?

    Has anyone else had an increase in spam since getting their ipod Touch?
    Before I got my ipod touch I was getting almost no spam. Since I got it, registered with Apple and downloaded apps for it, I get up to 200 pieces of junk mail a day - to my alternate email address.
    My daughter had the same thing happen after she registered her Macbook with Apple.
    Am I the only one who had this happen?
    Thanks

    I Don't Get Any.
    Don't Sign Up For Things, Some Companies Also Pass On Your Email If You Don't Click A Tiny Checkbox During Signup
    Use disposable email addresses for non-important sites, such as www.mailinator.com

  • Sudden increase in BT Infinity Latency - Harwich E...

    I have had BT Infinity for a couple of months now and have a SamKnows broadband monitoring unit connected. It originally reported the latency to be 10 milliseconds, however on 9th December at 13:00 it jumped to 20ms and has remained there ever since, so the latency is now worse than it was with my old ADSL2+ (approx 15ms) and my son reports problems with lag now when online gaming.
    Does anyone have any idea why the latency should suddenly increase like this, I presume it's a network issue somewhere.
    I have a HomeHub 5 fitted.
    Whether it's relevant, my connection was the 1st in the cabinet.
    Any information would be appreciated. Thanks.
    Solved!
    Go to Solution.

    DLM has probably decided to add interleaving to your line.
    If you do a 'tracert bbc.co.uk' you will see the first hop after the HomeHub as around 6ms without interleaving, and around 16 ms with interleaving.
    No reason I know of to expect lower pings on FTTC than ADSL.  My bbc pings with BE/ADSL were around 11ms (no interleaving) or 20 ms (interleaving).  With Infinity they are around 22ms (no interleaving) or 31 ms (interleaved).  On BE I had the choice; I chose interleaving for greater stability and lower packet loss depite the ping increase.  With FTTC you don't have the choice; you get what DLM gives you.  I have been on interleaved for most of my Infinity contract, it was removed a couple of months ago (probably as a result of changes to the updated modem firmware).
    A lot of my Infinity extra is the silly routing of all my traffic Winchester->Sheffield->London before it leaves the BT network; this adds around 9ms to my ping times; around 4/5 ms each for the hops north and back south.

  • Sudden increase in native heap memory

    Hi all,
    we are using JRockit 26.4 and currently configured with 1800MB heap on windows 2003 with /3GB switch.
    We noticed that after the weblogic server is started the total memory (java heap + native memory) lingers around 2550 MB... (We monitored this using perfmon -> virtual bytes of java process)
    after couple of days run, the native memory suddenly increased by 300 MB, taking the total virtual bytes to 2850 MB.
    Do we know what could be the reason for such a sudden increase?
    Thanks,
    - Pritam.

    I don't believe this is documented anywhere unfortunately, and it might vary depending on the exact JRockit release. But the key thing to watch out for is growth, regardless of which component it is. If you see that, post a question here and we'll find someone to tell you what the issue is...
    That said, here's an example printout and some guesses from my side.
    [JRockit] memtrace is collecting data...
    [JRockit] *** 0th memory utilization report
    (all numbers are in kbytes)
    Total mapped                         ;;;;;;; 860976
    ; Total in-use                        ;;;;;;  89816
    ;;  executable                         ;;;;;   4400
    ;;;   java code                         ;;;;    384;   8.7%
    ;;;;    used                             ;;;    236;   61.6%
    ;;  shared modules (exec+ro+rw)        ;;;;;   8496
    ;;  guards                             ;;;;;    180
    ;;  readonly                           ;;;;;   3052
    ;;  rw-memory                          ;;;;;  78132
    ;;;   Java-heap                         ;;;;  65536;   83.9%
    ;;;   Stacks                            ;;;;   1976;   2.5%
    ;;;   Native-memory                     ;;;;  10619;   13.6%
    ;;;;    java-heap-overhead               ;;;   2056
    ;;;;    codegen memory                   ;;;    576
    ;;;;    classes                          ;;;   2048;   19.3%
    ;;;;;     method bytecode                 ;;    219
    ;;;;;     method structs                  ;;    277    (#5929)
    ;;;;;     constantpool                    ;;    788
    ;;;;;     classblock                      ;;     69
    ;;;;;     class                           ;;    143    (#443)
    ;;;;;     other classdata                 ;;    338
    ;;;;;     overhead                        ;;     91
    ;;;;    threads                          ;;;      6;   0.1%
    ;;;;    malloc:ed memory                 ;;;   1445;   13.6%
    ;;;;;     codeinfo                        ;;     60
    ;;;;;     codeinfotrees                   ;;     24
    ;;;;;     exceptiontables                 ;;      5
    ;;;;;     metainfo/livemaptable           ;;    243
    ;;;;;     codeblock structs               ;;      0
    ;;;;;     constants                       ;;      0
    ;;;;;     livemap global tables           ;;    135
    ;;;;;     callprof cache                  ;;      0
    ;;;;;     paraminfo                       ;;     30    (#506)
    ;;;;;     strings                         ;;    426    (#8402)
    ;;;;;     strings(jstring)                ;;      0
    ;;;;;     typegraph                       ;;     27
    ;;;;;     interface implementor list      ;;      5
    ;;;;;     thread contexts                 ;;      8
    ;;;;;     jar/zip memory                  ;;    497
    ;;;;;     native handle memory            ;;      5
    ;;;;    unaccounted for memory           ;;;   4493;   42.3%;3.11
    ---------------------!!!Total mapped means mapped virtual memory, eg the largest size the JVM can be expected to grow to. This is typically on the same order of magnitude as the Java heap size (Xmx).
    Total in-use is the actual memory in use, this is the current "memory footprint" of your process.
    executable refers to JIT compiled code, I believe.
    Java-heap is the heap (duh).
    Stacks should be the thread stacks (where local variables are stored).
    classes is native memory used to store bytecode etc. If this grows, it may be because you are generating classes dynamically and they are not getting cleaned up because there are still live instances. Or maybe you're running with -Xnoclassgc.
    threads can grow if you start a lot of threads and don't let them die.
    Stuff under malloc:ed memory is mainly misc JVM metadata.
    unaccounted for memory is...everything else. The most common leak involving unaccounted-for is native byte buffers (DirectByteBuffer).
    -- Henrik

  • Sudden increase in memory space

    We have developed an application using the Hyperion 9.3.1.
    We are trying to load data and the data load itself is taking lot of time.
    Again, the memory space is getting increased drastically (almost to 100%).
    We see lot of page files being generated.
    What can be the reason for this sudden increase in memory space utilization.

    you should consider the folllowing factors for sudden increase in memory space
    1.Minimize the no of hierarchies otherwise it leads to increase in the size of aggregated data and slows down view selection
    2. remove fragmentation
    3.Compact the outline to remove the records of members that we have been deleted
    4.create transparent partition if neccessary which leads to enable write-back partition.By doing this we can reducethe size of the Database and reduces calculation time.
    5.use compression if values are grouped together in consecutive members on dimensions or hierarchies rather than spread throughout the outline with lots of
    #missing data between values.

  • Essbase pag file size had a sudden increase

    We have a BSO cube who used to have 1.8g of exported data and about 2.5 gigs of pag files. However, they both suddenly increased to 5 gigs each (in just one day). I checked our logs and there were only a few data uploads/changes and the outline member additions that we had that day were all dynamic calcs members. We do export - clear - reload data everynight, but the exported files and page files are still on th 5 gigs.
    Does anyone know what could have caused this issue?
    Thank you.

    Same type of thing happened here. Overnight, 3 hour agg calc now taking upwards of 8 hours. They had implemented hierarchy additions, nothing drastic.
    By chance, were any of these Dynamic Calc members created in sparse dimensions? Do they roll up to stored members? It's bad ju-ju to have that situation.
    This was the biggest design offender I found, and am redesigning cube for them right now.
    I have taken the 8-10 hour agg (and 41 pag files) down to 36 minutes (and 15 pag files) simply by changing the dense and sparse settings of their cube. One of the dimensions they had dynamic members rolling up to stored members, I made this one dense and made all upper levels dynamic. (of course I had to change some of their other dense dimensions to sparse to accomodate this) But the end results on time and page files tells me that having dynamic calc members roll to stored members is really bad.
    Robert
    Edited by: RobertR3 on Apr 18, 2011 10:02 AM

  • Tuning Sudden Increase to Port Traffic

    I am looking for suggestions on tuning sudden increase to port traffic for MARS.
    We have a third party that we do not want to be actively alerted when they perform their scan. This gives us one set of IP addresses they use to scan.
    Next is our internal networks that are the target of those scans. Which gives us a second source.
    Unforunately, Mars is reporting these flows as Source 0.0.0.0 Target (Int Host) and Source (Scan Co.) Target 0.0.0.0.
    Anyone have any suggestions? I'm worried if I filter by source, I'll loose that portion of the correlation and be left with just the victim IP of the scan, which tells me little.

    Have you tried to set that particular session as false positive? (i hope you know that) You can tune the false positive for particular source/destination on per session basis. Once you do that, try and see if it still reports as a scan.
    Mohsin

  • MARS - "Sudden increase of traffic to a port" rule

    Hello. I duplicated the system rule "Sudden increase of traffic to a port" in MARS and it blew out the original system rule and now shows up as a user rule. It doesn't appear to be working either. It is active. Not sure what to make of this, and neither is TAC. Anybody every mess up a system rule like this? Anyway to recover it? Thanks!

    I upgraded to 4.2.2 and the rule seems to have been restored as a system rule. I noticed that it is showing up in our morning report (Event Types Ranked by Sessions), but we are not recieving an email or page for this rule firing (email/SMS notification works for all other rules). I ran a query for this event for the time period of the report it showed up on and no results were returned. Any thoughts would be appreciated. Thanks.
    Christine

Maybe you are looking for