Slashdot Mirror
Black Ops of TCP/IP: Paketto Keiretsu 1.0 Release
Effugas writes "After pushing OpenSSH
to perform feats of secure tunneling far beyond what I ever expected it could
do, it became clear that some genuinely useful modes of network operation were
simply inaccessable without either replacing or manipulating core network protocols.
Since the basic infrastructure of the Internet isn't likely to change any time
soon, that left...creative manipulation and reconstruction of the Lingua Reseaux:
TCP/IP. Taking advantage of expectations,
pitting layers against eachother, finding new uses for old options and data fields -- instead of simply
unleashing the latest incarnation of some "Ping of Death", could such work
unveil hidden functionality within existing networks? As I discussed at
Black Hat 2002 and the inimitable
Defcon X, the answer is yes. And now,
proof of this is ready. BSD Licensed (in deference to the very source of TCP/IP),
The Paketto Keiretsu, Version 1.0,
is a collection of five interwoven
"proof of concepts" that explore, extract, and expose previously
untapped capacities embedded deep within networks and their stacks, at Layers 2 through 4.
The five --
scanrand,
minewt,
lc
(
linkcat
),
paratrace,
and the OpenQVIS
cross-disciplinary-a-go-go phentropy --
demonstrate Stateless TCP Scanning, Inverse SYN Cookies, Guerrila Multicast, Parasitic Tracerouting, Ethernet Trailer
Cryptography, and quite a bit more. (For details, stop by DoxPara Research
or check out the latest slides. The academic paper is coming "soon".)
In terms of actual usefulness, scanrand is no
nmap, but it's still interesting: During an authorized test inside a multinational corporation's class B,
scanrand detected 8300 web servers across 65,536 addresses. Time elapsed: approximately 4 seconds."
Let's make sure that the script kiddies get a pressed CD-ROM copy mailed to their houses too, while we're at it.
...how I wish Babel Fish would have a Geek->English translation option...
Anyone here want to sum it up IN PLAIN ENGLISH, without involving beowulf clusters or "Profit!"?
4 seconds for 65k address is damn fast.
I roomed with the guy and can attest to the year or so he spent cobbling this stuff together. Go Dan!!
-david
David E. Weekly
Code / Think / Teach / Learn
h4x0r for
linkcat, scissors and glue. is there a hidden meaning?
"a quote" -me
"During an authorized test inside a multinational corporation's class B, scanrand detected 8300 web servers across 65,536 addresses. Time elapsed: approximately 4 seconds."
That is crazy! Does anyone have information, for comparison, on what a scan like that would take using other tools?
Hi - www.doxpara.com is temporarily pointed at shaitan.lightconsulting.com, a quad Xeon hosted at Via.net in Palo Alto. Please be nice to my server so I don't have to drive over there and fix it...
-- thalakan
Was that ROT13 or Dutch?
In the free world the media isn't government run; the government is media run.
Lingua Reseaux? The Paketto Keiretsu? What's this guy been smoking? I'm not sure what's worse, pretentious techno-Latin babble, or "lol, k thx bye" MSN-speak.
What'd he say?
What'd he say?
time to go back to TCP/IP Network Administration to learn how to decode this Slashdot article...
Just raise the taxes on crack.
Let loose the hounds.
Buzzwords mainly, but basically some bloke picked over the specs for TCP/IP, put together some tools that do really pathological things with packets and take advantage of what various TCP/IP implementations expect and use that to agressively map networks.
Uh... in other words, nothing new whatsoever. NMAP's been doing this for ages, this is just more of the same. At least that's what it looks like, the submitter did an absolutely lousy job of actually getting to the point (what the fuck does "Paketto Keiretsu" actually DO!?)
we could exploit now... muahahahah
KRS
How come I go through my day feeling my little code is soo smart until I log in to Slasdot and read about C-level hacking of the core infrastructure of the internet by gods on human thrones and feel like a little 1st grader who has to deliver a note to a sixth grade teacher and marvels at the complex stuff on the chalk board....
*sigh*... I'm important! I swear...
Bruce Werner http://www.kidventus.com
This is waaaaay to much to read while written in italics
Long ago, when I was first thinking of network security as a career field, I thought "in a few years there might not be enough work to go around..." It looks like it could be another record year.
What's up with the pseudo-Japanese name?
---
Open Source Shirts
Granted, most of that post was Greek to me, it's still interesting in that I think in any technology or practically any invention, people will find ways to make them do things never even conceived of by the originator. Coming up with new uses for obscure parts of the TCP/IP stack isn't really any different than other inventive uses for common, everyday items. In all actuality, I think it's all about the oft-used phrase, "thinking outside the box."
I will post a comment here when I'm done reading the main abstract and supplementaries. I'm also hoping to earn a PhD by proxy. Anyone got a text to speech adapter, it might be nice to hear this in my sleep. Seriously, this d00d got skillz.
"This isn't a study in computer science, its a study in human behavior"
This is similar to the work we did at UANC in the 1996 era. We did a lot of thing with source fragmenting of ethernet moduli, so to speak. This person's research is eerily similar, but clearly his own. I am not posting to claim copyright, blah blah. Just to point out the respect I have for someone who made it "this far!"
One of the things we did was design an ethernet hashing system that would function sort of like a dynamic roulette wheel of SYN types and packet sequence numbers. Using differing protocol sweeps, we could monitor different states without creating state ourselves! The ultimate goal was to provide inverse cascade across multiple routers and switches, allowing an attack to be sourced directly to a particular ethernet interface without the attacker's spoofing even mattering. By rotating state in real-time, using different queueing techniques, we could esentially traverse the entire network, sort of a big de-randomized traceroute, and virtually re-route all attack traffic back into the ethernet "netherworld", in a nutshell.
Very advanced stuff! I applaud your work wholeheartedly!
i don't know a damn thing about what this story is talking about, but i've never been more scared in my life
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Nobody on their death bed ever said "I wish I had spent more time alone in front of my computer".
I imagine this guy would have said something along those lines.
Have you been stalked by Seth today?
1. I have plenty of time to play with it.
2. I don't have to worry about someone doing it to me.
Is anyone working on SNORT signatures for this stuff?
ah yea, now that you say I can remember working at USANC! Woa, it was a cool time with you guys :-) Designing a ethernet hashing system at 2 in the morning and ordering a new pizza.. very cute. Actually I really miss these times.
I'd be glad to see you again guys!
The Paketto Keiretsu, Version 1.0, is a collection of five interwoven "proof of concepts" that explore, extract, and expose previously untapped capacities embedded deep within networks and their stacks, at Layers 2 through 4.
;)
Hmm let me guess you have to compile this as root, after that it will give "proof of concept" to the black hat 2002 people that indeed there are previously untapped capacities deep within my server, somewhere remotely hidden on the outer reaches of my port range?
He should have spent more time writing decent error pages for his website, ones that don't reveal the absolute path directory structure to his stuff. Try clicking on the "paratrace" link from the slashdot story and you'll see this URL in your browser's bar:
d ox para/writings/docs/paratrace.xml
http://www.doxpara.com/404.php?f=/home/effugas/
Yeah, but that's still two seconds slower than he finishes with his girlfriend.
When choosing to post articles, some quick things to bear in mind:
1) What the hell is he talking about?
2) No Really, I got layer 2-4 networking, I even got "TCP/IP", but what, precisely has he done that is worthy of note here?
3) Besides which, to whom is this software suite useful? Does it have exploit probing, does it simply tell you what stuff lives where? Is it something faster than normal scanning procedures?
4) Background?
All of these things could be (if you were so inclined) attached to the end of our user's posts so that those of us who are interested, but completely lost by the pure amount of jargon flying about to understand, can figure out what is going on...
On a side note,
What the hell is the general purpose of these tools, indivdually or as a group?
hmmmm?
I just wish I understood half of it.
It's Christmas everyday with BitTorrent.
Word.
"the protocols the internet uses today are not conducive to certain types of networking tasks. however, tcp/ip, one of the internet's framework protocols, has a bunch of obscure parameters and fields that can be exploited to do new things [this isn't a very new concept.] i wrote a network scanner, fake NAT client, packet sniffer, traceroute utility, and some odd visualization tool. i like big words."
basically he wrote some new tools that are like the tools we already have but implemented in a slightly different way, except these tools were heralded by an obtuse 500-word self-aggrandizing technobabbling post on slashdot.
-fren
"Where are we going, and why am I in this handbasket?"
Let's see...
ping 160.1.255.255
Duck and cover, here comes the smurf...
I guess he refers to embedding a code in each packet sent out to validate that only "real" packets are accepted by the receiver as "Inverse SYN Cookie". I don't understand why this is important, tho.
The "paratrace" program is quite interesting-- from the README:
Nutshell summary: this uses an existing open TCP connection to run a traceroute through a firewall that would otherwise tell you to take off. I could certainly see this being useful.
Some good background reading on O'Reilly's Safari online books site if your TCP/IP internals are a bit rusty:
Internet Core Protocols: The Definitive Guide
TCP/IP Illustrated, Volume 1: The Protocols
but i'm better looking and get laid more.
http://www.doxpara.com/pics/index.php?album=phen tropy%2F&pic=slashdot_comments1.jpg
> scanrand detected 8300 web servers across 65,536
> addresses. Time elapsed: approximately 4 seconds.
I was a little curious how much detections I would get, so I started scanrad on this 256*256*256*256 adresses network. Time it will take: approximately 3 days. Stay tuned for the results...
You are so mean, making fun of a man who lost his right hand in a terrible accident.
Are the parentheses around LinkCat hyperlinks to glue and scissors??
Because most people won't lift a finger when someone says "theoretical" or "possible" or "probable" -- but watch those deadlines jump up when you have an actual break in!
Because insurance companies don't require an authorized audit of computer security (yet), most places are wide-open. Think of this as the example of how to start fires, and why the government should have laws about the fire protection that public theatres (ecommerce sites) should have. Most companies are happy to let a room full of patrons burn to death -- that's why we need examples and government intervention. Besides, I'd rather that fellows like this release what they've been working on, so I know what to look out for, and can apply their methods against my systems at leisure in order to find problems and address them.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
Um, I'm so confused about the scissors and paste that I need to sit down. Note the links attributed to the open and close parens around 'linkcat'
(linkcat)
Would someone please call me dumb and tell me the answer?
"You never know when some crazed rodent with cold feet might be running loose in your pants."
-Calvin
Even if all he did was manage to do the same thing nmap does but in a diffrent manner. I still thing being able to scan a class B in 4 seconds is nothing to laugh about. I think we should not forget this simply a repackaging of some proof of point software.
This winter will truly be the season of the lanjacker.
I can haxor the Gibson and become 3l33t
OK, this pretty much pushes me over. I've been considering becoming a slashdot troll for some time and I think this article finishes it. First interesting story in a week or two. It gets more moronic posts than anything I've ever seen on slashdot. The best posts here are of the type "this is way over my head". If this is over your head, but you think it's interesting stfu and don't post anything. I don't even want to talk about others.
The compost bin story got a more meaningful discussion that this.
90% of people here think that case mods are cool
99% of people here look at a program which allows you to traceroute without icmp or udp (just to name one thing) and say "yeah, but what's the use"?
WTF?
I shall go and troll in the story about case with 6 neon lights attached to it now. See ya.
I passed the Turing test.
which *@#$ing multinational would allow their Class B network to be used for "proof of Concept" work by some BlackHats ?
Authorise my a$$.
for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
basically, this guy found a way to say "i will die alone" in over five hundred words, including the words "link layer" and "phentropy".
SCANRAND
========
Really, really fast port scanner, that can also trace network paths. Port scanning is simply the act of asking a machine if you can start up a conversation with a certain port of its, and marking down "yes" or "no" depending on the response. Normally, there's lots of overhead as you keep track of who you sent requests to and thus who you're expected responses from. Overhead, or "state", makes things slow. So scanrand is stateless -- right when you start up, it splits in two. One half asks everyone, "Heh! What are you hosting!" The other half picks up responses, "Hmmm, some guy just said he has a web server."
Now, there's a problem: If someone knows I'm not keeping track of who I'm scanning, they can just throw fake responses back at me. But TCP lets me embed a little signature with every connection request -- the "Sequence Number". This number will be returned to me when I get a valid response from a host that I scanned. So I take the IP and the port of the machine I scan, encrypt it into the sequence, and send off the request. When I get the response back, I look at the ACKnowledgement, compare it to the IP and port of the machine that's talking to me, and immediately know whether I ever scanned this guy in the first place.
So, that's why I get to scan really fast. Mind you, it's the least impressive part of Paketto in raw technical terms -- but it's definitely useful as hell.
MINEWT
======
What if you could just run a program, and a router showed up on your network? I don't mean physically, but I also don't mean "having anything visibly related to the computer hosting it". It'd be virtual, with its own separate IP addresses and it's own MAC addresses too. It'd be portable to any machine on the LAN, maybe it'd be fast, but it'd definitely be amazingly flexible -- no chips to make, no wires to crimp. Run this software, and there's something new on your net.
That's what minewt is -- a new router that just shows up and works. Now, it happens to do some funky things -- Guerilla Multicast involves taking what your local network sees as a broadcast or multicast address and attaches it to what the outside world sees as just another IP of a single host. So the single host communication goes out, but once the packet returns, it's flooded to a host of happy listeners. (Such is the theory.) MAC Address Translation is also slightly cool -- NAT is all about using a Layer 4 TCP/UDP port to figure out which Layer 3 IP address (the 10.*'s an 192.168.*'s all us Linksys folk live behind) an incoming packet from the internet is really supposed to be going to.
It ain't your gateway that downloaded all those MP3's, even if that's the IP address on that flow of music.
Well, there's also this tech called ARP -- the Address Resolution Protocol. Your local network doesn't have a clue about IP addresses -- it just has these unique factory assigned bitstrings that uniquely identify everyone. ARP is used to translate the Layer 3 IP -- 10.* or whatever -- to the MAC address the factory assigned.
NAT goes from L4(Port) to L3(IP). ARP goes from L3(IP) to L2(MAC).
MAT -- MAC Address Translation -- just combines the two. L4(Port) leads to the combination L3(IP)/L2(MAC).
End result? Multiple hosts can share the same IP address. Cool.
LC [LINKCAT]
============
I've got a wire. I want to talk on it -- but I can't, I've got all these sockets and programs and limitations in the way. Or at least, I had them.
1) Execute lc -m00 and start typing hex. Whatever hex bytes I type show up on the ether.
3) Profit.
Or,
1) Execute lc -l00 and start watching everything on the network go by in hex. ANything I like, I can copy, then run lc -m00 and paste back onto the wire once again.
3) Profit.
lc has a really interesting mode that's based on the fact that you can actually put data in a frame *after* IP is done with it -- it's called an ethernet trailer, and happens all the time when you try to send a packet smaller than the minimum legal length for ethernet. Well, as long as we can throw data after our packet, lets put crypto in it -- lets sign our frame! Basic support for SHA-1 HMAC's is provided.
PARATRACE
=========
Alright, this is kinda neat. You've got a connection to some host, right? You want to know how your packets are getting there. But if you use normal traceroute, you're gonna start up a whole new connection. Paratrace gets around that -- you see, TCP lets you repeat packets; actually, by repeat, it's more like "The network can break and accidentally cause packets that were assumed to have been dropped to mysteriously come back to life; we handle this screwup just fine." So instead of spawning a whole new connection for our traces, we run our traceroute -- which is entirely a Layer 3 IP hack -- using a legitimate Layer 4 TCP packet. When the data eventually gets there, it's mostly ignored -- oh, the network screwed up again.
If there's a stateful firewall in the way, well, it's looking at Layer 4 data, which is 100% valid.
PHENTROPY
=========
See a cloud? Might be random. See a bunch of triangles? That ain't random. See the Borg Cube? Yeah, that's the FreeBSD kernel. This is an extension of Michel Zalewski's excellent Phase Space Analysis of TCP/IP Sequence Numbers, done with an incredibly interesting tool called OpenQVIS. Those images render *fast*, folks. 15-45fps fast.
Terribly sorry I didn't do a writeup like this to begin with; hopefully the Keiretsu makes a bit more sense now.
But too much techno babbling, such as in statements like "Userspace manipulation of packets can lead to less overhead" because "Kernels are optimized to talk to other hosts, not to scan them". Ok so you invented raw sockets, not to mention the fact that it's possible to send arbitrary packets from the kernel too, although from userspace it's for sure a more portable way. And MAC based networking , i can mention at least 3 commercial products that do that ( and in a much more flexible way). ( i maintain one of them :) Anyway, some stuff is really interesting, a few new toys to play with i guess ;)
It's quite simple. Either the submitter or /. have resorted to not-so-well disguised subliminal advertising within submissions. Look how many people have questioned why those links exist - hell, the links are nearly slashdotted. Someone is making traffic revenue off that, I reckon... or maybe I need a bigger tinfoil hat. Whatever.
1. Make a Geek/English translator 2. ...
3. Profit!
boldly going forward, 'cause we can't find reverse
Dan enjoys being witty with words. A "keiretsu" is a conglomeration of not-100%-related business units under a single roof. Mitsubishi makes cars and huge boats, Yamaha makes motorcycles and electronic synthesizers, etc.
;) Dan, for those curious, is (AFAIK) not proficient in Japanese. =)
The Paketto Keirestu is a conglomeration of program units that do really bastardized and interesting things with packet manipulation and flow. It's a catchy little title, I thought, but that's MHO.
-david
David E. Weekly
Code / Think / Teach / Learn
h4x0r for
French gov't not nice to foreigners? Bollocks! The Vichy state was perfectly friendly to the Nazis.
I was the Dog of the guy and can attest to nothing 'cause I don't understand this. But I had to pee on the floor way too much
Cut and Paste. Linkcat lets you do that with packets :-)
--Dan
Bandwith MATH:
1) assume that each scan probe is a byte and a reply is a byte.
2) 65000 scans mean that 65000x2=130000 bytes
were exchanged in 4 seconds, or in bps, we
multiply by 8 to arrive at
1040000 bps or 1040kbps all accross the organizations......
Socket MATH:
the scan requires at least 65535 sockets initiated, if sequential and each socket takes 4/60000 of a second to do, than this will happen in 4 seconds, not counting processing the replies.
- (-1, Trigger Happy) Because he didn't wait for an explanation of what the tool does before bashing it;
- (-1, Troll) Because he explains what the tool does, and then admits in the end he has no clue;
- (-1, Flamebait) Because the tone of the first sentence is quite inflammatory;
- (-1, Overrated) Because it is overrated.
(-1, Overrated) is perhaps the best one to choose, or else you'll be negatively metamoderated by people who didn't read the context (and I can quite understand them).Moderators, do your job!
Am I missing the importance of safety scissors & Elmer's glue? Or are the links on the parentheses around linkcat just for kicks?
If you read a little earlier in the comments you'll see that in order to prevent his site getting slashdotted he very kindly moved it to a temporary higher-capacity server.
So yeah, maybe he didn't transition the site perfectly - just be glad you even got to see that URL!!
Where can I get the mentioned programs?
Luke-Jr
yeah, that was pretty lame. you obviously don't have too much time infront of your computer hey?
My guess...
"Paketto Keiretsu"
Engrish: Paketto - Packet
Japanese: Keiretsu - To crack..
Correct Bandwidth Math:
1) A scan is probably about 40 bytes (ip+tcp headers) + 40 bytes in reply, say 80 bytes. (Much more than the 2 you posit...)
2) 65000 scans is 5200000 bytes, just under 5Mb.
Pretty trivial to send 2.5 Mbytes in 4 seconds, and get 2.5Mbytes back again - thats about 600kbytes/second in each direction - well within the capacity of a standard 10M ethernet.
Socket Math:
What Dan Said. The whole point of these tools is they don't do stuff the 'conventional' way. I tried them, they work and are very fast...
I saw that too. Sublime, yet obvious. Just beautiful. As is the rest of your work, BTW.
A tip of my tin-foil hat to you, sir.
Soko
"Depression is merely anger without enthusiasm." - Anonymous
Maybe it's too early for anybody to make sense of this thing... but here's what I've got so far: It seems that the great advance here is based on using the IP protocol all by itself in situations where conventionally we use TCP wrapping IP. (Remember class, we had a discussion on leaky abstractions recently where we remembered that TCP is what we use when we want to forget that IP exists.) By taking advantage of obscure parts of the IP protocol that we don't usually concern ourselves with, he's been able to use intentionally wayward packets to learn about the network. For example, sending an IP packet with a hopelessly short time to live to take advantage of the fact that whomever has the packet when it when it times out is supposed to send back a packet indicating that error. Turns out most routers do, so he collects that information and gets a traceroute that can go into places where a traditonal traceroute meets with a firewall. And that brings up the potentially dangerous side of things. This flies below our radars, it stays below our firewalls. His packets never go higher than the IP layer of our OSI model stack. (Remember that 7-layer thing that we all had to memorize in networking classes...) I'm not quite sure yet what poking around there gets them other than network topology info, but I kinda get the feeling that if there is something destructive that can be done, we're gonna get blindsided with it.
A friend of mine wrote an LSR scanner and an LSR tunnel tool which you probably won't understand either. Go get them, play with them, and then think about what it means. Here's his short paper on LSR.
;-)
While I'm here, let me just bitch for a second. I "love" slashdot. I can sort of understand the people who complain when a non-geeky story gets posted, but I just can't understand someone who complains when a technical story gets posted. "News for Nerds" dude! You can't get a whole lot nerdier than this. Stop complaining and go read some FMs. If you can't handle it, go read Wired or something instead. I'm happy to have a story posted here that my 7 year old doesn't understand yet...it gives us something new to talk about.
IMHO,
Michael
Okay first off let me say I am not a TCP/IP expert by any means however this does present some interesting points.
Firstly as a poster has noted before, by going under the radar by directly using the IP layer, this is going to open up a whole new rash of attack methods which we would be much better investigating and defending against.
Secondly, I think its cool, it renews my faith in the basic tenet of geekdom - play with it until you break it, then learn to fix it again.
funnily enough Dan Kaminski himself begins describing LinkCat:
:)
"
I've got a wire. I want to talk on it -- but I can't, I've got all these sockets and programs and limitations in the way. Or at least, I had them.
1) Execute lc -m00 and start typing hex. Whatever hex bytes I type show up on the ether.
3) Profit.
"
absolutely priceless
forgot the main reason of my post which is that he wrote a nice description for those with a clue, but without hardcore knowledge of the lower levels of tcp/ip. 'tis here
Since this is thick and requires people to actually read the links to actually understand what's being discussed, of course every post within the first minutes of this thread is of the innane nature of somebody who doesn't understand what this is about. Yet, instead of filtering these clueless posters out... they get mod points for "Funny". Huh? I don't think there's anything funny in people proclaiming they know nothing in an attempt to do slightly better than just try to blurt out "First Post!" Moderators, there's a lot of Overrated (-1)'s that need to be applied up here...
Moron. This guy's got skills, and you don't even see it. These tools are very impressive. Paketto Kieretsu is to nmap what a Ferrari is to a Pinto.
11*43+456^2
I became equally disillusioned and have been trolling since...
I wrote an article about my dirersion at About.com
a kieretsu is actually a little more than just the word for corporation. it's a structure whereby multiple companies own stock in each other in a ring formation. so A owns stock in B which owns stock in C which owns stock in A. good and bad theories on the purpose. some think it's a useful way of monitoring performance because companys are watching other companies (but are in turn being watched etc...) which is more efficient than individual shareholders watching companies. others thinks its a way for managers to remain entrenched (i won't vote to fire you if you don't vote to fire me). not sure what any of tha that has to do with packet scanning/mangling tools.
why not mention those 3 commercial products? Provide some enlightenment here instead of just saying "no big deal"
The point isn't that he can send raw packets, it's that he can send them in a useful, simple way.
And in other news, METROID PRIME IS OUT !!! GameCube Platinum with Metroid bundle = $169!!
It's by far the best meta-slashdot comment I've ever read:
i d=4592270
http://apple.slashdot.org/comments.pl?sid=44091&c
drink less of it :)
... I am only saying that because I care - there's a lot of decaffeinated brands on the market that are just as tasty as the real thing.
Chris Knight:
"8300 web servers across 65,536 addresses. Time elapsed: approximately 4 seconds.."
God damnit. It doesn't take an ISS consultant to figure out that the above stats + a slapper/scalper worm = Oh shit some monday morning when one arrives at work. Above stats + asiapacific spammers = Useless mailboxi
Seriously, if these stats hold true it could streamline the whole process of scanning for exploitable hosts to a degree that if you're service is exploitable it will be exploited. Kinda scary to me..
Everyone is entitled to their own opinion. It's just that yours is stupid.
I remember my first checksum.
His "router" seems pointless, unless it's attached to someone else's LAN. Yes, you can write a single-port NAT router that allows multiple machines on the same LAN to have the same IP address. But then they can't talk to each other. (They can talk to the "router" and perhaps, via it, the outside world.) Apparently he did this to get around some restriction on his dorm LAN in college.
TCP Traceroute is useful enough that it's already been implemented by somebody else. GPL, and for Linux, with an RPM available, even.
+1 Insightful
I don't care why you're posting AC
Hey thanks for that. most informative... alas no mod points...
i don't read slashdot anymore.
He who sendith the Ping of Death must answer thee these packets three. Ere the other router he see...
"Dancing is the vertical expression of a horizontal desire" --Robert Frost
People interested in this might also be interested in, "Covert Channels in the TCP/IP Protocol Suite".
some day you will find yourself senile, requiring medical attention, speaking in a langauge that you once taught yourself and ONLY yourself to speak. then you'll die, thinking that the doctor "should have just understood you"
There is no Class B. It's called a /16.
Warning: Serious TCP/IP territory here!
p roduct/1,4096, 0201776316,00.html
Of limits for ye olde slashdotters.
Let me fist get the Crab-Book (http://www.oreilly.com/catalog/tcp3/) and read it. And then post this thing again a half a year later, so I can add my smartass remark.
Here's for the ones who like pictures (Hehehe...):
http://www.aw.com/catalog/academic/
Geez, I really have to get my TCP/IP sorted out. This stuff sounds to cool to miss out.
We suffer more in our imagination than in reality. - Seneca
This, sir, was genius. After reading your presentation at 5AM and not having my head explode, seeing this made me laugh out loud. I'd love to see the look on some webmaster's face trying to figure out why their obscure online store got so much traffic in a 4 hour window their server crashed.
"Linkcat? Whats that? Is Radio Shack giving away useless toys again? Who are all these geeks and why did they crash my store? Hey Lloyd, we better quadruple our stock of scissors - don't ask!"
Top Most Bizarre/Disturbing Error Messages
Personally, I regard paranoia as a necessity.
Best Slashdot Co
I bet you this new scanner is EXACTLY what Steve Gibson over at grc.com is claming to have done with his "nano probe technology" http://grc.com/np/np.htm which can instantly scan a huge network. He's been promising this for at least a year with no sign of relase date. The reason I believe this to be true is because he supposedly created syn-cookies on his own without the knowledge that it even existed and this fast scanner uses syn-cookie technology to work.
I'll have to play with this some. Then I'll have to figure out how the hell to write Firewall-1 rules to mess with anyone using it to scan my network..
This is complete nonsense...
fuckin' penis popper... find something better to do
This is total bullshit. Why do people moderate stuff they do not actually understand?
You can be as secure as you want to be.
P.
Paul "Say no to feeping creaturism"
.......said the shifty fellow.
UANC! I wank! We all wank for... ice cream?
Must be cold out.
Why would someone wank for ice cream if it's cold out?
that will be the challenge. Remember, these are completely legitimate uses of the IP protocol. It's not like we could (probably) detect any of these techniques.
The traceroute bit offers some interesting MITM possibilities. Yes, it requires a connection to be established, which assumes that the client is legitimate, but what about someone upstream that's messing with the IP packet before passing it on?
All in all these are incredibly clever hacks. My compliments to the chef.
From the quality of the work here you should get some recognition. There really should be an award for stuff like this. It's first class and thourougly deserves the score 5, it's a great pitty you at the UANC don't believe in karma.
Very effective stuff!I applaud your work wholeheartedly!
--
And bigger trolls have lesser trolls and so ad-infinitum.
nmap's much more mature and reliable -- but perhaps it's reliability starts too early...
I said "probably", implying to everyone but you that I don't KNOW what it used, because I haven't read the article yet.
Next time, be more fucking polite.
windoze blows.
Okay, Okay -- I admit it. You didn't change that program that worked
just a little while ago; I inserted some random characters into the
executable. Please forgive me. You can recover the file by typing in
the code over again, since I also removed the source.
- this post brought to you by the Automated Last Post Generator...