Fall 2003

The student arrival in September means that Networking becomes heavily involved with:

•Answering questions from students and colleagues.
•Helping configure machines that do not network properly. •Making house calls to fix bad data ports which often are not bad.
•Dealing with a variety of user issues related to networking for faculty and staff as well as students as the load on all the systems jumps.

Insecure Windows and the Nachi virus
September 2003 had a very nasty surprise. A vulnerability in the Windows 2000 and Windows XP operating systems allowed intruders to gain access to machines that were plugged into the network.

The Nachi virus did not require any intervention by the user of the system to infect a computer. All that was required was that the computer was not patched with the fixes that Microsoft was providing. Most machines were not patched; most machines became infected.

The Nachi virus shut down many networks at many institutions and businesses. We saw a number of problems, but it did not shut us down. The largest problems were:

•False "bad resnet dataport" complaints because often the initial startup of the computer would fail to connect to the network.
•The environmental controls used by Facilities (including street lamp control) failed to work reliably.

We encorporated virus scanning and computer system quarantining into our network registration system.
We also created programs that students could run to patch their computers and to harden their computers against other attacks. These things allowed us to specifically warn people about the status of their computer system (patched or not, infected or not) and to partially isolate infected computers. It was a lot of work but we were able to get a handle on the situation without it destroying the network.

Just as we were getting a good handle on the vulnerable computers, Microsoft announced that the first set of fixes were inadequate and there was another vulnerability which needed to be patched. Things started all over again.

All told, for at least the first six weeks of the semester, the primary focus of Networking and TSR was computer security, which involved system scanning, virus tracking, and operating system upgrades or replacements.

The network registration system proved to be a multiple benefit, and without it, we could not have responded as well to the virus problem as we did.

We learned was that the high level of network broadcasts seemed to cause a higher rate of problem for those computers that were attached to the older network electronics. Often these machines would fail to obtain their IP number and we were plagued with false reports of bad dataports. Because these reports occurred with much higher frequence on the older electronics, we accelerated our planned efforts to upgrade the network electronics over the next few semesters to upgrading all during the fall semester.

Resnet connections
In 2002, by Friday September 13, 78% of the resident students had gotten on the network and registered their computers. This was a number that we did not reach in 2001 until November. By October, that number was 87% of the residents, and it edged up to a bit more than 90% by the end of the calendar year.

This pattern repeated in 2003. By Friday September 12, 2003, 83% had registered, and by October, 88% had registered. By December, 92% of the residence hall students had registered a computer.

Thus the rate of registration was not greatly increased by the network registration system, but the support calls related to the older shell ip-request program were avoided. Things may have gone better without the tremendous virus problem.

From 1995 though the class of 2006, we surveyed every new student. In 2003 (class 2007) we changed the method of handing out accounts so could not survey them. However, similar data could be obtained from the computer registration data. The details of the data may be found elsewhere. Beginning with '07, the numbers are based on the December registration data. This may account for the jump in percentage.

Spring 2004

Network electronics replaced
In preparation for more virus problems, in January we replaced all the older (1997/1998) network electronics with Cisco 2950 switches. While this change solved some problems, it introduced some others due to the more complex configuration of the electronics. With the help of UMass technicians, we were able to sort out those issues.

Spring infection, Sasser worm/virus
The Spring semester began with another Microsoft system vulnerability and massive infections. The major virus had the nice feature of causing the machine to shut down, so it got the attention of the owner of the machine right away. Given our earlier experiences, we were able to contain this one more quickly than in the Fale.

Spam and virus filtering and tagging Spamassassin/MimeDefang is an open source product that is commonly used to filter to tag spam and in other ways get better control of an email system.

We put this in place in Feb 2004 primarily to stop the virus. We also began to tag messages with a "spam score" to allow individuals to use the filtering capability in a number of desktop email clients to get a handle on spam.

Another open source program that fit with this system was ClamAV which can block email with virus attachments. Since August 2001 we have appended "-VirusRisk" to attachment names that are Windows executable programs. This has reduced email as a virus vector by making it difficult for someone to open such an attachment and run it.
ClamAV is able to identify attachments as having a virus and block them.

The ClamAV filtering is extremely good. During the school year, there were about 3000 blocked virus messages per day. In addition, there were about 30 messages per day that were not identified but which might have been viruses and which had "-VirusRisk" appended.

Webadvisor in production
This ISIS Webadvisor application, authenticating using LDAP, went into production use. This was used for student review of courses in this phase.

System usage data
The web-based email client, IMP, continues to grow in popularity, as does other desktop email clients using IMAP. The long-predicted decrease in number of interactive logins to MHC from residence halls finally occurred. It is interesting to note, however, that as the 2003/2004 academic year progressed, the number of interactive logins from the dorms did show a bit of an increase in spite of the overall increases in IMAP and IMP connections.

The number of machines for which there were Copyright Infringement Notices decreased from the previous year.

Internet2 and connectivity
In April 2004, the second DS3 for Internet2 was installed. Because of the risk of disrupting traffic flow, we delayed the actual change in the router hardware and configuration until right after finals in June 2004.

General

During this tumultuous year, there were a number of other tasks that had progress or were accomplished.

•The Five College Fiber Optic project is continuing well. Fiber was purchased, contracts were signed, and the process of permitting was started.
•A Blackberry BES and Exchange server were set up but it was concluded that the general level of support would too high for the limited use that was expected. This topic may be revisited in the future.
•A number of system upgrades occurred. SAM, the statistical analysis machine, was upgraded from a 1994 Ultrix system to a modern Linux system running SAS, primarily for Economics. TAP, a system used for network monitoring and intrusion detection, was upgraded.
•A system with disks dedicated to backing up other systems was installed (STOW).
•Fiber was installed in 15 Woodbridge for future network connectivity in the cultural house.
•D-Space experimentation indicated that this was not yet ready for production use.