Article View: comp.security.firewalls
Article #122Re: Cuervo, I disagree: ShareSniffer Released
From: Philip J. Koenig
Date: Tue, 27 Feb 2001 04:04
Date: Tue, 27 Feb 2001 04:04
46 lines
3644 bytes
3644 bytes
In article <zadig-71A47A.15341926022001@news.dsli.com>, zadig@no.spam.thanks.aol.com (Zadig) writes... > In article <hPum6.4139$S25.63391@typhoon.sonic.net>, > John Navas <spamfilter@navasgrp.dublin.ca.us> wrote: > > > >But making that TCP connection is NOT analogous to entering a > > >building. It is analogous to turning a doorknob. You apply the force > > >to the knob (SYN). The knob responds by turning (SYN-ACK). You can > > >then push on the door to enter, or maybe you need a key (password). > > > > I suggest you put a packet sniffer on the line and look at what is > > really going on. These aren't SYN Floods (a different form of abuse); > > they are attempts to connect. > > What about FIN scans, John? FIN scans find out if a service is available > by specifically NOT connecting to it... it sends a packet to close a > non-existent connection, and the service (if it's running on that port) > responds with an RST (packet that closes the session), thus confirming > that it exists. > > That's a port scan that doesn't really connect... do you have a problem > with this kind, too? It's kind of the equivalent (to follow your flawed > "trying the doors on the street" analogy) of standing in the street > shouting "Anyone home?" at each house... if someone shouts back, you > know they're home. No laws broken, though. The important question of course is: what is the point? Just as I reserve the right to be skeptical of your motives if you walk down *my* street and yell "anyone home" at all the houses (even though it's technically legal), I reserve the same sort of skepticism for someone who tries to make the ultimately rather ridiculous and laughable contention that they are scanning ports just because they like to scan them. (keeping their modem warm?) Makes no sense whatsoever. See previous posts. -- Philip J. Koenig The Electric Kahuna Organization [anti-spammed] ----------------Computers & Communications for the New Millennium------------- * To send email, remove numbers and spaces: pjkunet64 @ ekahuna27 . com * * Vision impaired? Try taking off the blacklist-colored glasses. * * Simple answers are for simple minds. Try a new way of looking at things. *
Technical Details
Message-ID:
<MPG.1504c73c67dee5a598a020@207.126.101.100>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mailReferences:
<3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f922c,b3c453f70036b961 X-Google-Attributes: gidf922c,public X-Google-Thread: 10090f,b3c453f70036b961 X-Google-Attributes: gid10090f,public X-Google-Thread: f5dc1,b3c453f70036b961 X-Google-Attributes: gidf5dc1,public X-Google-Thread: 113850,b3c453f70036b961 X-Google-Attributes: gid113850,public X-Google-ArrivalTime: 2001-02-26 20:07:36 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mail From: See_email_@ddress_below.This_one_is.invalid (Philip J. Koenig) Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable Subject: Re: Cuervo, I disagree: ShareSniffer Released Date: Mon, 26 Feb 2001 20:04:48 -0800 Organization: The Ekahuna Organization Message-ID: <MPG.1504c73c67dee5a598a020@207.126.101.100> References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com> X-Newsreader: MicroPlanet Gravity v2.10 X-Complaints-To: newsabuse@supernews.com Lines: 46