【原創翻譯】是間諜程式阻塞了你的防火牆嗎？

Is spyware clogging your firewall?
是間諜程式阻塞了你的防火牆嗎？
(英文來源：http://techrepublic.com.com/5100-1009_11-5553653.html?tag=nl.e030)

by Jonathan Yarden
作者： Jonathan Yarden（喬納森·雅登）
翻譯： endurer

Takeaway:
If you're troubleshooting intermittent network connectivity, spyware could be the culprit. Jonathan Yarden tells you how to check your firewall for spyware infection.

簡介：
如果你在正排解時斷時續的網路連接這樣的疑難問題，間諜軟體可能是原凶。Jonathan Yarden（喬納森·雅登）告訴你如何檢查你的防火牆的間諜感染情況。

Organizations frequently ask me for assistance in diagnosing and resolving Internet problems. After a bit of detective work, I usually find that the problems are not really an Internet security issue. There's so much complexity in the corporate network these days, and so many places where a problem can occur, that simply identifying the true source of a networking problem is increasingly complex.
相當多的組織機構經常請我協助診斷或解決互連網問題。在做少量檢測工作後，我通常發現並不是互連網安全問題。當代公司團體的電腦網路是如此的複雜，所有有相當多可能發生問題的位置，僅僅確認網路問題的真正根源的複雜度也正在增加。

Earlier this month, a hospital that I periodically do some consulting for contacted me and asked for some assistance. Because I've worked there on other projects, I was already quite familiar with its network configuration and equipment.
本月初，一家此前我曾為之決策的醫院與我聯絡並請求我協助。因為我曾經在那兒做過其他的項目，所以我已經相分熟悉它的網路設定和裝置。

This organization uses Check Point's FireWall-1, a modular firewall platform. Depending on your network, this can either be just what you need or overkill.
這個機構使用Check Point's FireWall-1，一個組合式的防火牆平台。完全取決於你的網路，它可以僅滿足你的需要，或者擁有更多的功能。

The company also uses Websense Enterprise, an HTTP content-filtering system that monitors and restricts Web sites. Websense interacts with the HTTP proxy on Firewall-1 (the HTTP Security Server) using the URL Filtering Protocol (UFP).
這家公司也使用Websense Enterprise，一個監視和約束Web網站的HTTP內容過濾系統。Websense通過URL過濾協議(UFP)與Firewall-1(HTTP安全伺服器)中的HTTP代理服務互動。

After weeks of trouble, the organization called me in to help solve one of the more frustrating computer problems: intermittent failure. During normal business hours--but not always--Web surfing didn't always work. The problem sometimes occurred even with accessing internal Web sites not proxied by Firewall-1.
在困擾持續了幾個星期後，這個機構請我協助解決一個困擾電腦的問題，時斷時續的失敗。這個故障出現在正常的上班時間，但不總是這樣--網頁訪問不是一直工作著。這個問題有時甚至出現在訪問不需要經過Firewall-1代理的內部Web網站中。

At first, the description of the error sounded like a DNS failure, but this wasn't the case. Further details suggested a failure of the Firewall-1 HTTP proxy.
起初，錯誤描述聽起來像是DNS解析失敗，但實際上不是這樣。進一步的細節暗示是Firewall-1 HTTPProxy 伺服器失敗。

After reviewing the log files, we discovered that one particular Web site was repeatedly turning up in the logs, and Websense was consistently denying access to this Web site. But for some reason, it was also randomly dropping legitimate URLs as well--sometimes not even showing up in the log files.
在複審log檔案後，我們發現一個特定的web網站在log中反覆出現，並且Websense一直拒絕訪問這個web網站。但由於某些原因，它也隨機丟棄/遺漏(endurer註：從後文看是阻塞引起的)一些合法URL——有時甚至不顯示在log檔案中。

We finally discovered that the URL that Websense was blocking was evidence of a spyware program transmitting information. It began at 7:30 A.M. and continued throughout the day, and other workstations were also showing up in the logs.
我們最終發現Websense阻塞的URL是間諜程式傳輸資訊的證據。它開始於上午7:30，並持續了一天，其他工作站的log檔案也有類似的記錄。

After further investigation, we determined that a program called Wild Tangent Updater was responsible for all of the log entries. The Wild Tangent Updater was attempting to transmit usage information, but it was failing because outbound HTTP requests required authentication by Firewall-1.
進行更多的調查後，我們確定一個名為Wild Tangent Updater的程式需要為所有的log負責。
Wild Tangent Updater這個程式嘗試傳送習慣資訊，但因為對外HTTP要求Firewall-1確認而失敗。

Firewall-1 and Websense were doing exactly what they should. So why were they also blocking legitimate Web sites?
Firewall-1和Websense都十分精確地工作著。然而為什麼他們會阻塞合法Web網站呢？

All network-connected devices using TCP have limits to their ability to communicate. TCP is a connection-oriented protocol, and it uses a socket for communication.
所有使用TCP的網路連接裝置的通訊能力是有限的。TCP是連線導向的協議，它使用通訊端(socket)來通訊。

Checkpoint Firewall-1 employs many individual proxy servers using TCP to handle communication from the internal network to and from the public Internet. Firewall-1 also uses TCP to communicate with Websense to determine whether to allow a URL.
Checkpoint Firewall-1為一些獨特的Proxy 伺服器服務，這些Proxy 伺服器使用TCP來處理內部網路和網際網路的通訊。Checkpoint Firewall-1也使用TCP與Websense通訊，決定是否允許一個URL訪問。

I suspected that Wild Tangent Updater was causing either Firewall-1 or Websense to run out of TCP sockets. TCP sockets have timeouts, so they don't just disappear when you're finished with communication.
我懷疑Wild Tangent Updater造成了Firewall-1或Websense的TCP通訊端運行逾時。TCP通訊端有逾時設定，所以當你已經完成通訊時，它們不立即消失。

My theory seemed to explain the problems quite well. After a quick Google search and a visit to phoneboy.com, I felt that I was on the right track. So we increased the socket limits for Firewall-1 and Websense from their default values, and the problem went away.
我的理論看起來很好地解釋了這個問題。在Google快速搜尋並訪問phoneboy.com後，我感到我在正確的道路上。所以我們在Firewall-1和Websense的預設值上增加了通訊端限制，這樣問題解決了。

Whether the Wild Tangent Updater caused the problem or merely precipitated it, there are certainly a lot of other firewall systems out there that could also experience this type of problem. If you're having similar difficulties, check your firewall: Spyware may be clogging it.
無論Wild Tangent Updater是否造成了這個問題或僅僅促其發生，其他地方仍有大量的其他防火牆可能經曆這類問題。如果你已經有相似的困難，檢查你的防火牆：間諜程式可能正在阻塞它。

Want more advice for locking down your network? Stay on top of the latest security issues and industry trends by automatically signing up for our free Internet Security Focus newsletter, delivered each Monday!

Jonathan Yarden is the senior UNIX system administrator, network security manager, and senior software architect for a regional ISP.
Jonathan Yarden 是一位UNIX進階系統管理員，同時還是一名網路安全專家。他還在當地的一家ISP 中擔任進階軟體構架師。