Re: Cuervo, I disagree: ShareSniffer Released

Article View: comp.security.firewalls

Article #117

Back to comp.security.firewalls Previous Next

#117

From: Zadig
Date: Mon, 26 Feb 2001 20:34

23 lines
2890 bytes

In article <hPum6.4139$S25.63391@typhoon.sonic.net>,
 John Navas <spamfilter@navasgrp.dublin.ca.us> wrote:

> >But making that TCP connection is NOT analogous to entering a 
> >building.  It is analogous to turning a doorknob.  You apply the force 
> >to the knob (SYN).  The knob responds by turning (SYN-ACK).  You can 
> >then push on the door to enter, or maybe you need a key (password).
> 
> I suggest you put a packet sniffer on the line and look at what is
> really going on.  These aren't SYN Floods (a different form of abuse);
> they are attempts to connect.

What about FIN scans, John? FIN scans find out if a service is available 
by specifically NOT connecting to it... it sends a packet to close a 
non-existent connection, and the service (if it's running on that port) 
responds with an RST (packet that closes the session), thus confirming 
that it exists.

That's a port scan that doesn't really connect... do you have a problem 
with this kind, too? It's kind of the equivalent (to follow your flawed 
"trying the doors on the street" analogy) of standing in the street 
shouting "Anyone home?" at each house... if someone shouts back, you 
know they're home. No laws broken, though.

Technical Details

Message-ID: <zadig-71A47A.15341926022001@news.dsli.com>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!newsfeed.direct.ca!look.ca!newshub2.rdc1.sfba.home.com!news.home.com!news-sjo.usenetserver.com!news-out.usenetserver.com!e3500-chi1.usenetserver.com.POSTED!zadig

References:

<3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-ArrivalTime: 2001-02-26 12:36:03 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!newsfeed.direct.ca!look.ca!newshub2.rdc1.sfba.home.com!news.home.com!news-sjo.usenetserver.com!news-out.usenetserver.com!e3500-chi1.usenetserver.com.POSTED!zadig
From: Zadig <zadig@no.spam.thanks.aol.com>
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net>
User-Agent: MT-NewsWatcher/3.1 (PPC)
Message-ID: <zadig-71A47A.15341926022001@news.dsli.com>
Lines: 23
X-Complaints-To: abuse@usenetserver.com
X-Abuse-Info: Please be sure to forward a copy of ALL headers
X-Abuse-Info: Otherwise we will be unable to process your complaint properly.
NNTP-Posting-Date: Mon, 26 Feb 2001 15:32:45 EST
Organization: WebUseNet Corp  http://www.usenetserver.com - Home of the fastest NNTP servers on the Net.
Date: Mon, 26 Feb 2001 15:34:19 -0500

Reply to Parent Message