Re: Cuervo, I disagree: ShareSniffer Released

Article View: comp.security.firewalls

Article #112

Back to comp.security.firewalls Previous Next

#112

From: Rebeccah Prastein
Date: Mon, 26 Feb 2001 17:11

31 lines
2867 bytes

In article <hPum6.4139$S25.63391@typhoon.sonic.net>, 
spamfilter@navasgrp.dublin.ca.us says...
> [POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]
> 
> In <MPG.1503be36f44f72a3989701@news.earthlink.net>, Rebeccah Prastein
> <rhp@fgi.net> wrote:
> 
> >But making that TCP connection is NOT analogous to entering a 
> >building.  It is analogous to turning a doorknob.  You apply the force 
> >to the knob (SYN).  The knob responds by turning (SYN-ACK).  You can 
> >then push on the door to enter, or maybe you need a key (password).
> 
> I suggest you put a packet sniffer on the line and look at what is
> really going on.  These aren't SYN Floods (a different form of abuse);
> they are attempts to connect.
> 
> 

Well, I'm not speaking specifically about DoS attacks (which is what I 
thought a SYN flood was), but I see that you are not talking about 
what I think of as a *scan*.  You are talking about an activity that 
includes scanning, followed by further communication on a port that 
turns out to be open.

You are right, though, that I should get a sniffer and see what's 
going on.  It may be that by now, most scanners include automatic 
followthrough with the servers they are searching for.

Rebeccah

Technical Details

Message-ID: <MPG.15042e2d813b7c94989702@news.earthlink.net>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!newsfeed.direct.ca!look.ca!newsfeed1.earthlink.net!newsfeed.earthlink.net!newsmaster1.prod.itd.earthlink.net!newsread2.prod.itd.earthlink.net.POSTED!not-for-mail

References:

<3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-ArrivalTime: 2001-02-26 09:12:23 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!newsfeed.direct.ca!look.ca!newsfeed1.earthlink.net!newsfeed.earthlink.net!newsmaster1.prod.itd.earthlink.net!newsread2.prod.itd.earthlink.net.POSTED!not-for-mail
From: Rebeccah Prastein <rhp@fgi.net>
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
Message-ID: <MPG.15042e2d813b7c94989702@news.earthlink.net>
References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net>
X-Newsreader: MicroPlanet Gravity v2.20
Lines: 31
Date: Mon, 26 Feb 2001 17:11:54 GMT
NNTP-Posting-Host: 158.252.241.63
X-Complaints-To: abuse@earthlink.net
X-Trace: newsread2.prod.itd.earthlink.net 983207514 158.252.241.63 (Mon, 26 Feb 2001 09:11:54 PST)
NNTP-Posting-Date: Mon, 26 Feb 2001 09:11:54 PST
Organization: EarthLink Inc. -- http://www.EarthLink.net

Reply to Parent Message