Some people don't deserve access to the machine room
rachelbythebay.com
rachelbythebay.com
One great example was an admin that claimed our software wasn't working properly. After some prompting, he let me know that things were timing out with symptoms that matched an inability to contact the database server. I asked if they'd changed anything on their end, and the answer was "no". Trying to dig in further just made him more irate.
After several more minutes of me asking questions and him getting increasingly mad, he proudly announced that he solved the problem. When I asked him how, he said that he turned off the firewall. I then asked if they'd changed anything on the firewall recently that could have affected the connection between server and DB, and he said no there were no changes. When I pressed to ask if he was sure, he responded that there couldn't have been any changes because they'd just installed the firewall earlier in the day.
I took a deep breath, told him I was happy his issue was resolved, and wished him a great day. I then took a break from going through the support escalation queue.
Better yet: I had a call to "come replace a desktop system" that someone had been complaining about for a while. they'd opened the case and stomped on the innards a few times.
Which wouldn't have been a thing but for the fact this was the sub-server for the Layout Dept's "Mac network" they insisted on having. It wasn't a good desktop because it was running fileserver and proxy and who knows what else for several others too... until it got stomped.
The reason the machine had been there? They insisted on having their network all in office and "under their control". This server was up as a terminal with web browser etc on it because "there's no point in having a computer sitting here useless!" and it gave the Dept head a good feeling to have it on his desk.
Even got to ask "Had you been taking backups?" They hadn't.
Das computermachine ist nicht fuer gefingerpoken und mitten grabben.
Ist easy schnappen der springen werk, blowenfusen und poppencorken mit spitzensparken.
Ist nicht fuer gewerken bei das dumpkopfen.
Das rubbernecken sichtseeren keepen das cotten-pickenen hans in das pockets muss; relaxen und watchen das blinkenlichten.
You would think someone watching logs so diligently would also note the counters for dropped packets ceasing, and probably look to remove the rule
Because well, they use DHCP. Those IPs by very nature of that environment are not static.. so rules dropping them shouldn't be either.
Maybe just accept that services get unwanted traffic and QoS and structured logs exist for a reason. This is like early optimization, good intentions leading to holes in feet.
I can look past it though for benefit of the story.
The person flipping power had far more reasonable options at their disposal... Though I doubt they would expect a problem specifically with their source IP - a bit rigged