Article View: comp.security.firewalls
Article #132Re: Cuervo, I disagree: ShareSniffer Released
From: John Navas
Date: Wed, 28 Feb 2001 08:28
Date: Wed, 28 Feb 2001 08:28
31 lines
2892 bytes
2892 bytes
[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]
In <zadig-D29876.21184927022001@news.dsli.com>, Zadig
<zadig@no.spam.thanks.aol.com> wrote:
>In article <s5Qm6.4721$S25.67862@typhoon.sonic.net>,
> John Navas <spamfilter@navasgrp.dublin.ca.us> wrote:
>
>> The service may or may not respond that way -- that's an error
>> condition, so behavior is undefined. There is no legitimate purpose
>> that a FIN probe serves; better firewalls block them. (Mine both blocks
>> and logs them, alerting me to repeated probes within a given time
>> window.)
>
>[snip]
>
>> A FIN probe is almost certainly a part of an attempted attack.
>
>No, any port scan can be used for legitimate reasons (to probe my own or
>an authorized network for weaknesses) or for cracking purposes. Moral
>absolution only makes a person look close-minded.
There is no legitimate purpose for anyone to use a FIN probe without
authorization. Makes moral absolution easy.
>[SNIP]
--
Best regards,
John Navas <http://navasgrp.home.att.net/>
CABLE MODEM/DSL GUIDE: <http://Cable-DSL.home.att.net/>
Technical Details
Message-ID:
<WE2n6.70$2w3.3571@typhoon.sonic.net>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!news-out.usenetserver.com!news-out-sjo.usenetserver.com!europa.netcrusader.net!208.184.7.66!newsfeed.skycache.com!Cidera!typhoon.sonic.net!not-for-mailReferences:
<3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com> <s5Qm6.4721$S25.67862@typhoon.sonic.net> <zadig-D29876.21184927022001@news.dsli.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f922c,b3c453f70036b961 X-Google-Attributes: gidf922c,public X-Google-Thread: 10090f,b3c453f70036b961 X-Google-Attributes: gid10090f,public X-Google-Thread: f5dc1,b3c453f70036b961 X-Google-Attributes: gidf5dc1,public X-Google-Thread: 113850,b3c453f70036b961 X-Google-Attributes: gid113850,public X-Google-ArrivalTime: 2001-02-28 00:34:08 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!news-out.usenetserver.com!news-out-sjo.usenetserver.com!europa.netcrusader.net!208.184.7.66!newsfeed.skycache.com!Cidera!typhoon.sonic.net!not-for-mail From: John Navas <spamfilter@navasgrp.dublin.ca.us> Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable Subject: Re: Cuervo, I disagree: ShareSniffer Released Organization: The Navas Group, Dublin, CA, USA References: <3A966412.9336DCD8@mynetwatchman.com> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <97cngt$mop$2@news.panix.com> <mAmm6.4120$S25.62449@typhoon.sonic.net> <MPG.1503be36f44f72a3989701@news.earthlink.net> <hPum6.4139$S25.63391@typhoon.sonic.net> <zadig-71A47A.15341926022001@news.dsli.com> <s5Qm6.4721$S25.67862@typhoon.sonic.net> <zadig-D29876.21184927022001@news.dsli.com> X-Newsreader: Forte Agent 1.8/32.548 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Lines: 31 Message-ID: <WE2n6.70$2w3.3571@typhoon.sonic.net> Date: Wed, 28 Feb 2001 08:28:38 GMT NNTP-Posting-Host: 209.204.185.87 X-Complaints-To: abuse@sonic.net X-Trace: typhoon.sonic.net 983348918 209.204.185.87 (Wed, 28 Feb 2001 00:28:38 PST) NNTP-Posting-Date: Wed, 28 Feb 2001 00:28:38 PST