🚀 go-pugleaf

cehona@mi.madritel.es (noSign) wrote in 
news:a40564ba.0211081324.740e4da6@posting.google.com:

> [...]


    	Despu�s de echar un ojo a esas direcciones in-addr.arpa mencionadas 
por 'noSing', sin llegar a ning�na conclusi�n a mayores de la ya expuesta, 
en un momento dado comprob� la existencia de una extra�a conexi�n por el 
port 1028, as� como tambi�n, que atend�a por el port 1026 TCP/UDP sin 
motivo aparente :-O   

C:\IDS\netstat -a -n

 Proto  Direcci�n local        Direcci�n remota       Estado
 TCP    0.0.0.0:0              0.0.0.0:0              LISTENING
 TCP    0.0.0.0:1028           0.0.0.0:0              LISTENING
 TCP    127.0.0.1:1026         0.0.0.0:0              LISTENING
 TCP    192.168.0.1:1028       207.33.111.82:8195     ESTABLISHED
 UDP    127.0.0.1:1026         *:*
 
C:\IDS>nmap -vv -sS -O -P0 207.33.111.82 -p8000-8200 
-D213.96.115.112,ME,80.46.75.176,80.46.75.168,62.14.80.222

Starting nmap V. 3.00 ( www.insecure.org/nmap )
Host  (207.33.111.82) appears to be up ... good.
Interesting ports on  (207.33.111.82):
Port       State       Service
8195/tcp   open        unknown
Remote operating system guess: Windows XP Professional RC1+ through final 
release (esto es poco creible... xDDD)

    	La conversaci�n sniffeada entre mi IP y el site remoto di� como 
resultado una consulta update del firewall sin importancia :-�

GET /notify/spfp/pspfinfo.txt?ver=0500 HTTP/1.1
User-Agent: Sygate Personal Firewall Service
Host: ssupdates.sygate.com:8195
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 12 Nov 2002 11:13:29 GMT
Content-Type: text/plain
Accept-Ranges: bytes
Last-Modified: Tue, 01 Oct 2002 22:35:00 GMT
ETag: "0c2bdc69a69c21:a78"
Content-Length: 12

0x0500047E

http://207.33.111.82:8195
It is Sygate Online Update Site

ssupdates.sygate.com (207.33.111.82)

    	Pero lo curioso, es que yo no hab�a sido capaz de resolver previamente 
un DNS inverso a partir de la IP conocida, y un whois hecho a varios sitios 
apenas aportaba nada, y eso, me llevo a curiosear como hab�a sido resuelto 
el dominio finalmente, en la conversaci�n sniffeada... y me llev� una 
sorpresa... los servers dns en juego son bien conocidos y habituales... 
dns2.terra.es (que no fu� capaz de resolverlo :-), y esifw1.tsai.es, que lo 
consigui� resolver (los frames de la solicitud y la respuesta van al final 
;-)

    	Aparece una solicitud un tanto extra�a que no logro entender, en 
notaci�n arcaica... lo curioso es que obtiene respuesta :-\

     query: 82.111.33.207.in-addr.arpa: type PTR, class inet
            Name: 82.111.33.207.in-addr.arpa
            Type: Domain name pointer
            Class: inet

  response: 111.33.207.in-addr.arpa: type SOA, class inet, 
    	    	  mname c.ns.verio.net
            Name: 111.33.207.in-addr.arpa
            Type: Start of zone of authority
            Class: inet
            Time to live: 2 hours, 48 minutes, 7 seconds
            Data length: 42
            Primary name server: c.ns.verio.net
            Responsible authority's mailbox: dns.verio.net
            Serial number: 2002012400
            Refresh interval: 12 hours
            Retry interval: 15 minutes
            Expiration limit: 7 days
            Minimum TTL: 3 days

    	�...82.111.33.207.in-addr.arpa??? �in-addr.arpa? que tiene que ver 
este dominio, supongo ya desaparecido, en una resoluci�n dns de una IP de  
verio.net??? :-O

    	Si alguien puede darme una explicaci�n, agradecido me quedo... /me no 
entender :-(

    	Un saludo, 



    	TyP


Anexo frames

Frame OUT (86 on wire, 86 captured)
    Arrival Time: Nov 10, 2002 10:00:50.243996000
    Time delta from previous packet: 1.230092000 seconds
    Time relative to first packet: 1.230092000 seconds
    Frame Number: X
    Packet Length: 86 bytes
    Capture Length: 86 bytes
Ethernet II
    Destination: 00:c0:49:24:c0:7a (US_24:c0:7a)
    Source: 00:a0:cc:61:bf:5a (Lite-On_61:bf:5a)
    Type: IP (0x0800)
Internet Protocol, Src Addr: USER4 (192.168.0.1), Dst Addr: esifw1.tsai.es 
(194.224.52.4)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 72
    Identification: 0x8300
    Flags: 0x00
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x0017 (correct)
    Source: USER4 (192.168.0.1)
    Destination: esifw1.tsai.es (194.224.52.4)
User Datagram Protocol, Src Port: 1043 (1043), Dst Port: domain (53)
    Source port: 1043 (1043)
    Destination port: domain (53)
    Length: 52
    Checksum: 0x3250 (correct)
Domain Name System (query)
    Transaction ID: 0x0008
    Flags: 0x0100 (Standard query)
        0... .... .... .... = Query
        .000 0... .... .... = Standard query
        .... ..0. .... .... = Message is not truncated
        .... ...1 .... .... = Do query recursively
        .... .... ...0 .... = Non-authenticated data is unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        82.111.33.207.in-addr.arpa: type PTR, class inet
            Name: 82.111.33.207.in-addr.arpa
            Type: Domain name pointer
            Class: inet

Frame IN (140 on wire, 140 captured)
    Arrival Time: Nov 10, 2002 10:00:50.313741000
    Time delta from previous packet: 0.069745000 seconds
    Time relative to first packet: 1.299837000 seconds
    Frame Number: X+1
    Packet Length: 140 bytes
    Capture Length: 140 bytes
Ethernet II
    Destination: 00:a0:cc:61:bf:5a (Lite-On_61:bf:5a)
    Source: 00:c0:49:24:c0:7a (US_24:c0:7a)
    Type: IP (0x0800)
Internet Protocol, Src Addr: esifw1.tsai.es (194.224.52.4), Dst Addr: USER4 
(192.168.0.1)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 126
    Identification: 0x13d1
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 247
    Protocol: UDP (0x11)
    Header checksum: 0xb80f (correct)
    Source: esifw1.tsai.es (194.224.52.4)
    Destination: USER4 (192.168.0.1)
User Datagram Protocol, Src Port: domain (53), Dst Port: 1043 (1043)
    Source port: domain (53)
    Destination port: 1043 (1043)
    Length: 106
    Checksum: 0x4afd (correct)
Domain Name System (response)
    Transaction ID: 0x0008
    Flags: 0x8183 (Standard query response, No such name)
        1... .... .... .... = Response
        .000 0... .... .... = Standard query
        .... .0.. .... .... = Server is not an authority for domain
        .... ..0. .... .... = Message is not truncated
        .... ...1 .... .... = Do query recursively
        .... .... 1... .... = Server can do recursive queries
        .... .... ..0. .... = Answer/authority portion was not 
authenticated by the server
        .... .... .... 0011 = No such name
    Questions: 1
    Answer RRs: 0
    Authority RRs: 1
    Additional RRs: 0
    Queries
        82.111.33.207.in-addr.arpa: type PTR, class inet
            Name: 82.111.33.207.in-addr.arpa
            Type: Domain name pointer
            Class: inet
    Authoritative nameservers
        111.33.207.in-addr.arpa: type SOA, class inet, mname c.ns.verio.net
            Name: 111.33.207.in-addr.arpa
            Type: Start of zone of authority
            Class: inet
            Time to live: 2 hours, 48 minutes, 7 seconds
            Data length: 42
            Primary name server: c.ns.verio.net
            Responsible authority's mailbox: dns.verio.net
            Serial number: 2002012400
            Refresh interval: 12 hours
            Retry interval: 15 minutes
            Expiration limit: 7 days
            Minimum TTL: 3 days