Heya. It's not surprising that Kaboodle didn't find the
127.0.0.1 device after a shift-restart, as I'm betting it's a
bug having to do with multiple interfaces on the same PC. We'll
try some more testing to see if we can replicate it reliably.
Then we can fix it. :)
Last questions: how does your Netgear WGE101 bridge the
other devices (the ones Kaboodle can't seem to "find") onto your
LAN? Are they all wireless devices, and you're using the "ad-hoc"
mode of the bridge, or is there an wired-to-wireless bridge on
the other end of the connection?
thanks,
Scott
On Mon, 28 Jun 2004 [EMAIL PROTECTED] wrote:
> Oops, sorry, forgot to tell you, after the shift/kaboodle and the arp command, the
> 127.0.0.1 does not show up anymore......did not have time to play around like last
> time........for me its a mystery. Did you get in the older email the screenshot
> showig the 127.0.01 icon (got a message from list server back, that email was bigger
> then 40 k, so maybe it got stripped away)
>
>
> //Wolfgang
>
> On 28/Jun/2004 20:24:25, [EMAIL PROTECTED] wrote:
> > Hi Scott,
> >
> > Sorry for the late answer.
> >
> > to a) the bridges are Netgear WGE101
> >
> > to b)
> >
> > Yesterday, after your answer, i was playing around, found that the network
> > card is not on the Me PC, but on the main PC. I switched all the servers on
> > auditt off, but still it showed that 127.0.0.1 was connected. After a couple
> > of reboots and different servers on and off, now it shows that the 127.0.0.1
> > is always connected, independent if the Me PC is switched on or off or the
> > servers are running. The main PC has drives mapped to the ME PC, maybe this
> > has also a influence. The mac adress shown for 127.0.0.1 is e2-ff-94-f4-00-00,
> > the BIOS of the PC does not let me see the mac adress, so i am not sure if
> > it is the mac adress from the not used network card of the auditt (W2k) PC.
> > I checked on IEEE for the mac adress, there is no mac adress starting with
> > e2, also there is no mac adress starting in the reversed order, because all
> > mac adresses are starting with 00 or aa, so i have no idea what this means
> > (also the mac assigned to MSI starts completly different). I guess it is not
> > related to this integrated network card on the MSI board (and not activated
> > in BIOS and also no driver)
> >
> > next test:
> >
> > I started Kaboodle with shift to rebuidt the database. during that the arp -a,
> > this is what i got:
> >
> > 192.168.53.1 00-09-5b-4e-db-1e dynamic (router LAN mac)
> >
> > 192.168.53.9 00-05-5d-58-56-6c dynamic (IP is bridge 2 and mac is from my
> > connected webcam to this bridge)
> >
> > 192.168.53.10 00-e0-4c-b3-b0-76 dynamic ,this is my other PC "ferrari" with
> > correct mac and XP (other PCs and bridges are disconnected.)
> >
> > Do not know what the dynamic at the arp command means, all have static IP adresses?
> >
> > to d) will try to install the older WinPcap version
> >
> > //Wolfgang
> >
> > *******************************************************************
> > On 23/Jun/2004 19:32:36, Scott C. Best wrote:
> > > Wolfgang:
> > >
> > > Heya. Diving in again:
> > >
> > > > to a)
> > > > maybe to create a device group to show the bridge manually, then after
> > > > that devices. In my case i connected the devices manual directly to
> > > > network, and they show up, then i moved them back on the bridge (but
> > > > they show now as not active)
> > >
> > > Hurm. What vendor/model-number is your bridge/access-point? It
> > > sounds like it's doing a lot more than just bridging to me; it sounds
> > > as if it's acting as a router.
> > >
> > > > to b)
> > > > <snip>
> > > > Yesterday, after your answer, i was playing around, found that the
> > > > network card is not on the Me PC, but on the main PC. I switched all the
> > > > servers on auditt off, but still it showed that 127.0.0.1 was connected.
> > > > After a couple of reboots and different servers on and off, now it shows
> > > > that the 127.0.0.1 is always connected, independent if the Me PC is
> > > > switched on or off or the servers are running.
> > >
> > > This is very interesting. Try this: restart Kaboodle on your main
> > > PC with the shift-key held down (this forces it to re-discover your whole
> > > network). While it's doing that, open a Windows command line and type
> > > "arp -a" to see what the ARP cache is. Kaboodle uses this same information
> > > to build its network database. Can you find the MAC address getting associated
> > > with 127.0.0.1 in this list?
> > >
> > > > to d) on XP it is WinPcap 3.1 beta3 (same on all my PC)
> > >
> > > Hmmm. Try de-installing WinPcap 3.1-beta3, and "downgrading" it
> > > to version 3.01. The guys at Polito.it changed how WinPcap 3.1-beta3
> > > behaves, and it's been reported to break apps (like Nmap) which depend
> > > on it. I'll make sure the next release of Kaboodle works with both modes
> > > of WinPcap operation.
> > >
> > > > to e)
> > > > what i want to do is to have a pc on a corporate LAN
> > > > (on the corporate LAN, you can not run kaboodle or winPcap, because i assume
> > > > WinPcap is running in promiscuous mode and a security scanner on a corporate
> > > > LAN would drive gracy, also with the flash ping etc.)
> > >
> > > Yes, Kaboodle is easily detected on a corporate LAN running IDS
> > > systems.
> > >
> > > > so i would run sockscap (we have a socks server, or you could even use
> > > > a socks tunneling service to get out of the corporate firewall)
> > > >
> > > > then you start kaboodle out of sockscap, this would bring the kaboodle
> > > > via the socks server out on the internet, also there its not a good
> > > > ideas to have kaboodle and WinPcap sneaking around.
> > > >
> > > > So for this reason i would like to have the possiblility to start
> > > > kaboodle in a "passive" mode (no pinging, no winpcap etc0 and only when
> > > > a tunnel is established via zebedee to my home network, you would
> > > > switch kaboodle to "running mode' with all the sneaking around.
> > >
> > > Yes, I think my "sub-LAN" plans for Kaboodle will support this.
> > >
> > > cheers,
> > > Scott
> > >
> > >
> > > > On 22/Jun/2004 19:24:17, Scott C. Best wrote:
> > > > > Wolfgang:
> > > > >
> > > > > Heya. Let me dive right into your questions:
> > > > >
> > > > > > a) seems to be when there is a wireless bridge in the network, kaboodle
> > > > > > does not correctly identify the attached devices. Kaboodle shows a
> > > > > > device with the IP adress of the wireless bridge (netgear) and the mac
> > > > > > adress of the attached device. does not see port 80 on attached device.
> > > > > > when attached device is connected directly to network with bridge it is
> > > > > > detected correctly (this is the case with a Dlink camera, also a RIO
> > > > > > receiver, and also a Lindows PC). Did not check what happens when there
> > > > > > are more then one device is connected behind bridge. I have 3 wireless
> > > > > > bridges in network (2x netgear, 1x Dlink, all act the same)
> > > > >
> > > > > In the current version, Kaboodle uses a MAC address as a unique
> > > > > identifier for a device. So if the wireless bridge is "proxy ARP'ing" for
> > > > > the devices behind it, it will get confused. I would guess that it will
> > > > > display only one device with that MAC address: the one with the
> > > > > numerically lowest IP address in the subnet.
> > > > >
> > > > > Given the lack of any other "permanent" identifier for a discovered
> > > > > device (besides the MAC address), I'm not sure yet what a good solution
> > > > > is. I'm investigating some methods of trying to detect what MAC addresses
> > > > > a bridge acts as a proxy for.
> > > > >
> > > > > > b) also Kaboodle detects a device with IP 127.0.0.1 (how is this
> > > > > > possible?) with a mac adress not existing on the network. This device is
> > > > > > only detected when a PC with ME is on the network, this PC has a second
> > > > > > network card, not installed, not connected to any network installed (mac
> > > > > > not known).....i assume it sees this network card...no explanation for
> > > > > > whatever reason (i can not check the mac adress at the moment of this
> > > > > > not used network card to check if this is really the case)
> > > > >
> > > > > Do you see this error when Kaboodle is run on the WinME PC with
> > > > > the two network cards? Or do you see this error when Kaboodle is running
> > > > > on one of the other PC's, when the WinME PC is attached to the network?
> > > > > The loopback address error might be an artifact of (a) above, when
> > > > > Kaboodle thinks it has two devices with the same "unique" identifier.
> > > > >
> > > > > > c) this brings up the point that it would be nice to have the
> > > > > > possibility to suppress the display of a device, like this or when a
> > > > > > laptop is only visiting once your network and then can not be removed
> > > > > > anymore.
> > > > >
> > > > > I call this a "Hidden List" functionality, to tell Kaboodle not
> > > > > to display a group of devices. It should be in the 1.0 release.
> > > > >
> > > > > > Also to "join" two or more devices, for example the same laptop one
> > > > > > time connected wireless and the next time wired, show up as separate
> > > > > > devices.
> > > > >
> > > > > That's a good point.
> > > > >
> > > > > > d) Kaboodle works on w2k and ME with pcap (my main kaboodle runs on
> > > > > > w2k), when installed on XP it seems only working when pcap is NOT
> > > > > > installed. After I installed pcap, kaboodle only comes up, identifies
> > > > > > the network and devices and then crashes and closes. (have not tried
> > > > > > yet to uninstall pcap, if this solves the problem)
> > > > >
> > > > > Yikes. Which version of WinPcap?
> > > > >
> > > > > > e) i would like to connect from a external PC (external to my home
> > > > > > kaboodle network) to my kaboodle network. As this PC is on a large
> > > > > > network or directly on the internet, it would be great to switch of the
> > > > > > detection function of kaboodle as long it is not connected via zebedee
> > > > > > to my home kaboodle network via the VPN. Any way to do this ?
> > > > >
> > > > > Not yet, no. Right now, by default, Kaboodle can be used to
> > > > > connect one entire network to another entire network, only. In future
> > > > > releases, I plan to support "sub-LANs", so that when Kaboodle makes a
> > > > > remote connection, only some of the devices on either side are exposed
> > > > > to the other side. I think that's what you're looking for.
> > > > >
> > > > > Please let me know when you can about the (b) and (d)
> > > > > clarifications. Thanks!
> > > > >
> > > > > -Scott
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > -------------------------------------------------------
> > > > > This SF.Net email sponsored by Black Hat Briefings & Training.
> > > > > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > > > > digital self defense, top technical experts, no vendor pitches,
> > > > > unmatched networking opportunities. Visit www.blackhat.com
> > > > > _______________________________________________
> > > > > Kaboodle-user mailing list
> > > > > [EMAIL PROTECTED]
> > > > > https://lists.sourceforge.net/lists/listinfo/kaboodle-user
> > > > > To UNSUBSCRIBE, click on the above link.
> > > > >
> > > > >
> > > > >
> > > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
>
>
>
>
>
>
-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Kaboodle-user mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/kaboodle-user
To UNSUBSCRIBE, click on the above link.
