🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.firewalls
Article #122

Re: Cuervo, I disagree: ShareSniffer Released

#122
From: Philip J. Koenig
Date: Tue, 27 Feb 2001 04:04
46 lines
3644 bytes
In article <zadig-71A47A.15341926022001@news.dsli.com>, 
zadig@no.spam.thanks.aol.com (Zadig) writes...
> In article <hPum6.4139$S25.63391@typhoon.sonic.net>,
>  John Navas <spamfilter@navasgrp.dublin.ca.us> wrote:
> 
> > >But making that TCP connection is NOT analogous to entering a 
> > >building.  It is analogous to turning a doorknob.  You apply the force 
> > >to the knob (SYN).  The knob responds by turning (SYN-ACK).  You can 
> > >then push on the door to enter, or maybe you need a key (password).
> > 
> > I suggest you put a packet sniffer on the line and look at what is
> > really going on.  These aren't SYN Floods (a different form of abuse);
> > they are attempts to connect.
> 
> What about FIN scans, John? FIN scans find out if a service is available 
> by specifically NOT connecting to it... it sends a packet to close a 
> non-existent connection, and the service (if it's running on that port) 
> responds with an RST (packet that closes the session), thus confirming 
> that it exists.
> 
> That's a port scan that doesn't really connect... do you have a problem 
> with this kind, too? It's kind of the equivalent (to follow your flawed 
> "trying the doors on the street" analogy) of standing in the street 
> shouting "Anyone home?" at each house... if someone shouts back, you 
> know they're home. No laws broken, though.


The important question of course is: what is the point?

Just as I reserve the right to be skeptical of your motives
if you walk down *my* street and yell "anyone home" at all
the houses (even though it's technically legal), I reserve
the same sort of skepticism for someone who tries to make 
the ultimately rather ridiculous and laughable contention
that they are scanning ports just because they like to scan
them. (keeping their modem warm?)

Makes no sense whatsoever.  See previous posts.


-- 
Philip J. Koenig         The Electric Kahuna Organization       [anti-spammed]
----------------Computers & Communications for the New Millennium-------------
* To send email, remove numbers and spaces:  pjkunet64 @  ekahuna27 . com    *
*      Vision impaired?  Try taking off the blacklist-colored glasses.       *
* Simple answers are for simple minds.  Try a new way of looking at things.  *
Technical Details
Message-ID: <MPG.1504c73c67dee5a598a020@207.126.101.100>
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mail
References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-ArrivalTime: 2001-02-26 20:07:36 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!sn-post-01!supernews.com!corp.supernews.com!not-for-mail
From: See_email_@ddress_below.This_one_is.invalid (Philip J. Koenig)
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
Date: Mon, 26 Feb 2001 20:04:48 -0800
Organization: The Ekahuna Organization
Message-ID: <MPG.1504c73c67dee5a598a020@207.126.101.100>
References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com>
X-Newsreader: MicroPlanet Gravity v2.10
X-Complaints-To: newsabuse@supernews.com
Lines: 46