This is especially important when dealing with IP telephones.

Recently, when I helped import some DHCP data from a Microsoft DHCP server, the Data Import Wizard changed the call server option (Option 128 for Nortel) from “String” to “Text”. You might guess the result.

If you more information on the correct syntax for “Call Server Information” (Option 128) for Nortel IP telephones, use the following blog post by Michael McNamara as a reference.
DHCP Options (VoIP)

You can check if your appliance(s) is/are compatible by running the following cli command:

show upgrade_compatible 6.0

Running it will look something like this:

Infoblox > show upgrade_compatible 6.0
Hardware Type(model) Node IP Status
IB-1050 192.168.150.2 Not Compatible
The grid is not compatible with 6.0 release.
Infoblox >

If you try to upgrade, you will get the following error message, when you try to distribute the image:
2011-01-10 09:41:10 UTC,”syslog”,”CRITICAL”,”logger[24930]“,”Use CLI: show upgrade_compatible”
2011-01-10 09:41:10 UTC,”syslog”,”CRITICAL”,”logger[24928]“,”Grid not compatible with 6.0 release”
2011-01-10 09:39:55 UTC,”syslog”,”CRITICAL”,”logger[22493]“,”Use CLI: show upgrade_compatible”
2011-01-10 09:39:55 UTC,”syslog”,”CRITICAL”,”logger[22492]“,”Grid not compatible with 6.0 release”
2011-01-10 09:33:02 UTC,”syslog”,”CRITICAL”,”logger[10791]“,”Use CLI: show upgrade_compatible”
2011-01-10 09:33:02 UTC,”syslog”,”CRITICAL”,”logger[10790]“,”Grid not compatible with 6.0 release”

NIOS 6.0.0 Feature overview
- CSV import
- NXDOMAIN response replacement
- Blacklisting
- DHCP Lease Scavenging
- BGP Anycast Support
- bloxTools
- Synchronization with MS Windows Servers improvement

CSV import
Now you can actually import CSV files that are not just DHCP-related. And it’s included in the actual product (it’s not a Java Import Wizard). With the new import feature, you can import DNS, DHCP and IPAM data!

NXDOMAIN response replacement
You now have the ability to replace the NXDOMAIN response, with a “synthesized” DNS response with a pre-defined IP-address. You can also create rules specifying how a member should respond to a query for an A-record for a certain domain. In other words, it’s not just limited to NXDOMAIN.

Blacklisting
You can blacklist domain names.

DHCP Lease Scavenging
Automated scavenging of leases older than a certain age.

BGP Anycast Support
You can now use BGP or OSPF (or both) as the anycast protocol for DNS advertising.

bloxTools
bloxTools can no longer be run on a Grid Master, Grid Master Candidate or a vNIOS appliance on Riverbed or VMware. It must run on a Grid Member.

Synchronization with MS Windows Servers
With version 6.0.0 you can now create a user account that does not require Admin group membership rights, to use with Infoblox.

If I manage to get through it, I’ll write a short review.

First of all, before performing a full system scan, OfficeScan will check with the server if other systems in the environment are also running a full scan. In order to avoid multiple full system scans in the same environment.

Second, they implemented the option to scan a virtual machine template. And save the results as a cache (which will be used when performing a full system scan).

Example:
@echo off
setlocal EnableDelayedExpansion EnableExtensions
for /F %%a in (file.txt) do (
set file_content=%%a
for /f "tokens=*" %%k in (' %file_content%') do (
set command_result=%%k
echo !file_content! !command_result!
)
)
ENDLOCAL

First, what’s changed in OfficeScan from version 10.0 SP1?

- Active Directory Integration
- Smart Protection Solutions
- Security Compliance
- Virtual Desktop Support
- Role-based administration
- General Product enhancements

So, what is my experience with the new features?

Active Directory Integration
Closer integration with active directory. Personally not tested.

Smart Protection Solutions
I guess this is enhancements to the file reputation and the implementation of a “local” web reputation server.
Tested this one, works fine. Good idea to include a local alternative, instead of having all your clients talk to “the cloud”. The new version of the TMCSS (Cloud Scan Server) also works with OfficeScan 10.0 SP1.

You can either perform a fresh install, or upgrade from 1.x.

Security Compliance
Not tested.

Virtual Desktop Support
According to Trend, OfficeScan is now “VDI”-aware. And supports VMware View 4 and Citrix XenDesktop 4.
Anyone running those products tested?

Granular Role-based Administration
Pretty much standard role based administration, with the possibility to use Active Directory user accounts. Also single sign on support.

General Product enhancements
Just a bunch of smaller product enhancements.

They fixed stuff related to:
- Update Agent
- Exception list
- Firewall
- Logs
- Scan Settings
- Web Reputation
- Plug in program updates

Update Agent
You can now have update agents separately download components, settings and program updates. A new report tool for update agents has also been implemented.

Exception list
There are now separate lists for Behavior Monitoring and Device control exceptions. In 10.0 they were the same.

Firewall
It is now possible to make exceptions for software on the Certified Software List, or block specific applications.

Also, when installing OfficeScan server from scratch, you will be asked if you want to enable the OfficeScan firewall, AND if you want to enable the firewall for server platforms. Earlier, if you enabled the firewall, it would be enabled both for workstations/laptops AND servers. This is great, because the firewall is not recommended for server platforms, but for client platforms. So you can get away with just one OfficeScan server (if you want to). In other words, no need to have dedicated server without the firewall enabled. You might of course still want to do this, so you can patch the client server, separate from the server server (server server server? ).

Logs
Enhancements of the logging feature will ensure consistency between time settings on OfficeScan clients, server and Control Manager. In other words “unified time stamping”.

Scan Settings
The following configuration options are now available on the local client (as long as the client has privileges to configure scan exclusions):
- Add, remove or overwrite files and directories from the client scan exclusion list.
- configure OLE exploit detection settings
- Configure settings for action on probable virus malware (scan actions on heuristic and generic detection)
- Clean Spyware/grayware in zipped files setting
- Use wildcards in the scan exclusion lists.

They also added additional options in the web gui. These are not listed in the release notes. But I’ve found some of them, and the most important one is the option to configure actions on generic/heuristic while using Active Action.
But I’m bit confused, since this is not an option if you use “use the same actions for all”.
Even if you configure the same actions for all types, you will have to specify “1st” and “2nd” scan action in the ofcscan.ini file.

As far as I know OfficeScan will still “Pass” potential security threats, if not configured with “1st” and “2nd” action when using the same actions for all types.

Web reputation settings
You can now configure web reputation policies and assign them to one, multiple or all OfficeScan clients.

Plug in program updates
OfficeScan can now automagically download plug in program updates from the first source in the server update source list. This includes Trend Micro Control Manager.

So, except from the GUI-bug mentioned in an earlier post, it should be safe to upgrade to version 10.5. I have not experienced any other problems. Have you?

Example netstat to CSV with “-an” flags.
for /F "tokens=1-4 delims= " %A in ('netstat -an') do echo %A,%B,%C,%D

Example netstat to CSV with “-ano” flags with output to file.
for /F "tokens=1-5 delims= " %A in ('netstat -ano') do echo %A,%B,%C,%D,%E>>outputfile.csv

Note if you are going to use it in a batch script, remember to use the following format:
for /F "tokens=1-4 delims= " %%A in ('netstat -an') do echo %%A,%%B,%%C,%%D

And you can of course use this to just list “Listening” ports:
for /F "tokens=1-4 delims= " %A in ('netstat -an ^| find "LISTENING"') do echo %A,%B,C%,%D

Why would you do this?
1. Openports (from DiamonCS is licensed)
2. No need for third party binaries.

Why would you not do this?
1. Hard to parse netstat -anob

If you know how to parse “netstat -anob”, please feel free to leave a comment

By installing the Smart Scan Server 2.0, you will get the following features:
- “Local” Web Reputation Server
- Additional Widgets
- Web Access and Pattern Update Log
- Notifications through email and SNMP
- Multi language web interface

Full installation readme:
http://www.trendmicro.com/ftp/documentation/readme/tmcss-2.0.1336-1-x86_64-DVD_README-en.txt

Patch update readme:
http://www.trendmicro.com/ftp/documentation/readme/PatchPackage-2.0-1336.x86_64_README-en.txt