xddsg's questions

An instance brought up in a VPC with internet access is able to respond to traffic directed to an internet routable public IP assigned to it, as well as the internal subnet IP it has on it's only interface.

How is that accomplished?

edit for further information: This is an standard EC2 instanced created inside a VPC I have made that does not have a NAT instance.

The box has an public Elastic IP applied to it and can send and receive over this route, despite only having one interface with a private 10.x address.

Have a Palo Alto Networks PA-200 firewall with the basic setup complete, all outgoing traffic allowed and working fine.

This is showing up in the traffic logs going from the created internal and external zones.

I have been unable to log traffic that is coming in from the external zone - using the packet capture feature I can see pings hitting the interface, but can not get any logs showing dropped packets.

How can I make this type of traffic visible?

There is next to no information online about configuring these devices and just getting this far has been quite hard work!

tag request: palo-alto-networks

Is there a way to send the Ctrl-Alt-Del command to an RDP session (Windows Server 2008 R2) inside another RDP session (also Windows Server 2008 R2) without the first session catching it?

Ctrl+Alt+End and Ctrl+Alt+Shift+End do not reach the 2nd level session.

Top-level environment is Windows 7 Enterprise.

A user deleted a directory containing an important file over a Samba share. Share was from a Nexenta box running ZFS, raid-Z3.

Last backup was 12 hours ago - is there a way to recover the 1 day's work?

Edit:
Asked about topic on Nexenta forums, similar responses.

Will the running the Windows dcdiag.exe command-line tool on a Server 2008 R2 system interfere with any services on that machine?

A small amount of CPU and network traffic usage is acceptable, but the system is live and applications on the machine must remain up and running without interruption.

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances.

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch

Firewall related?

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

What could be changing interface settings? Does it get updated every reboot? During use?

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASP.NET_2.0.50727\Names

PIDs of worker processes. Seems legit.

The list goes on - I'd like to be able to look up and find out about any registry entry that changes. The alerts are useless if I can't understand them.