Originally posted by Steve
i answered this on webhosting talk ill also answer it here.
first off our system measures transfer by measuring the packets of information accross the router destined for an ip address.
this number simply can not be wrong, if the number was wrong that means the packets sent across the router would not reach the designated owner of those packets and all traffic on the internet ceases to exist.
>> i believe your counting is ok. but that still doesn't mean you shouldn't care for security. in the datacenter there are a lot possilibities to do so.
and think of following: has tera-byte to pay for the traffic at virutal accounts without ip's that are not domain specific?
whether the traffic shown in our monitor is caused by some worm or some other source is irrelivent as its still traffic, its traffic destined for your ip address and our job is to get it there
>>that's true. it's our (customer) traffic. but we are not the only one that can do something about security.
so the question some would ask is why dont you block the traffic caused by the worm if that is whats causing the increase? quite simply how? do i block all ips of all windows servers throughout the internet so there is no possible chance worm traffic can hit the network? or do i add a few lines of code to the router that scans all traffic inbound for virus code and dumps it before its measured?
lets look at both of those options
option one, its pretty hard as a webhost to block all the windows type servers that exist from accessing the network the job of a webhost is to make the sites hosted on their servers accessable to the entire internet comunity not "the internet comunity that isnt infected" or "the internet comunity that some customers may want to allow access to"
so that leaves option two block out the virus with some code put on the router
is this possible? not really the router has a job that is to route traffic not to inspect it, if we ask the router to inspect traffic the load goes up, load increases so does latency and the possibility that traffic fails, altogether it works out that it isnt an obtainable solution. if it were a workable solution why havent the backbone providers already done so? why is the traffic reaching our routers in the first place? the answer is they also cant afford the load on their routers.
Steve
>> Interesting points Steve. If you see it this way. But there are a lot of other things a data-center could do.
i feel like you think all of your customers have no idea about your stuff. but i am intelligent and got a lot of knowledge about that area.
here some hints, what could be done. it's not a complete list (cause i don't make consulting for free and i already tried to post it once, but failed, so i had to retype):
*usage could be set to the bandwith of the plan. i asked that for my account. and it's easy to do for the customer service
*warn costumers: some would be willed to take the site offline for some hours...
*you could limit maximum bandwith. my site never needs a traffic of 5GB/night (connection of 1mb/s instead of 100mb/s)
for sites that want that...
*antispam and virus checking for emails:
(delete the virus, so it cannot spread! prevention)
http://www.amavis.org/
http://www.mail-abuse.org
*firewalls and intruder detection or similar (yes, web servers can still be operated)
http://www.networkice.com/
(and there are systems that have no problem to work with a high load!)
take a look at security at adult verification systems... they also try to detect hackers and block them... similar could be used for webhosts...
I believe you -Steve- are really doing a great job at tera-byte and support is great. But still i would love to see it, when you think more about security.
Thanks in advance
Greetings
Arno
PS: Hope I can give other users an idea, what could be done and perhaps also other webhosts.
