* Nathan Valentine
| I wish I could remember where I read this so that I could
| provide a pointer. TCP/IP Illustrated V2.
"Design and implementation of the 4.4 BSD operating system" has
something about it, iirc. My book is about 500kms away, so I can't
check.
--
Tollef Fog Heen
This is the
Nuno Faria <[EMAIL PROTECTED]> writes:
> I haven't noticed any. I think that the original goal of pinging a
> broadcast adress is to know which machines are on that network. When you
> disable it, you just stop "announcing" your presence when someone asks
> "who is on this network?". It is a serv
Micah Anderson wrote:
>
> Is there any detrimental effect to disabling broadcast ICMP on the Linux
> side? Esseentiall doing a echo 1 >
> /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts?
>
I haven't noticed any. I think that the original goal of pinging a
broadcast adress is to know which machin
Is there any detrimental effect to disabling broadcast ICMP on the Linux
side? Esseentiall doing a echo 1 >
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts?
On Thu, Jul 27, 2000 at 09:46:14AM -0400, Michael Stone wrote:
> On Thu, Jul 27, 2000 at 01:15:13PM +0100, Nuno Faria wrote:
> > Ranko Vesel
Thank you very much for your help. I will now contact the person in
charge of the local network and explain exactly what you have told me. I
had already reported this attack but they were unable to solve the
problem...
If this doesn't work I will try to block these ping broadcasts at the
local Uni
* John Vivian ([EMAIL PROTECTED]) [000727 10:43]:
> Just a small correction: the broadcast address is
> (typically) .255, but a bit of experimentation has
> shown that pings to .0 and .255 result in the same
> response. You would be best to block both.
I seem to remember
Thank you very much for your help. I will now contact the person in
charge of the local network and explain exactly what you have told me. I
had already reported this attack but they were unable to solve the
problem...
If this doesn't work I will try to block these ping broadcasts at the
local Un
[mailto:[EMAIL PROTECTED]
Sent: Thursday, July 27, 2000 9:46 AM
To: Nuno Faria
Cc: debian-security@lists.debian.org
Subject: Re: icmp: echo reply? Am I being attacked?
On Thu, Jul 27, 2000 at 01:15:13PM +0100, Nuno Faria wrote:
> Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the f
On Thu, Jul 27, 2000 at 01:15:13PM +0100, Nuno Faria wrote:
> Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the followin
> e-mail which I think might be relevant for the issue in question:
> ___
> I'm not sure but I think when you send an ICMP ECHO-Request to a
> broadc
* John Vivian ([EMAIL PROTECTED]) [000727 10:43]:
> Just a small correction: the broadcast address is
> (typically) .255, but a bit of experimentation has
> shown that pings to .0 and .255 result in the same
> response. You would be best to block both.
I seem to remember
I'm sorry, the first line of the previous e-mail is wrong!
It was:
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp >
tcpdump_results3".
it should have been:
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp |grep
request > tcpdump_results3".
Nuno Faria
[mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 27, 2000 9:46 AM
To: Nuno Faria
Cc: [EMAIL PROTECTED]
Subject: Re: icmp: echo reply? Am I being attacked?
On Thu, Jul 27, 2000 at 01:15:13PM +0100, Nuno Faria wrote:
> Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the followin
> e-
OK, it's done!
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp >
tcpdump_results3".
The files are at: http://xenon4.fe.up.pt/tcpdump_results2 and
http://xenon4.fe.up.pt/tcpdump_results3
Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the followin
e-mail which I think migh
On Thu, Jul 27, 2000 at 01:15:13PM +0100, Nuno Faria wrote:
> Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the followin
> e-mail which I think might be relevant for the issue in question:
> ___
> I'm not sure but I think when you send an ICMP ECHO-Request to a
> broad
On Thu, Jul 27, 2000 at 08:56:21AM +0100, Nuno Faria wrote:
> Yes, I had already noticed that when I ping a machine, the packets show
> up in tcpdump as a series of echo-requests and echo-replys, but in this
> case I can't find the echo-requests.
Try "tcpdump icmp". That will show you all icmp tra
I'm sorry, the first line of the previous e-mail is wrong!
It was:
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp >
tcpdump_results3".
it should have been:
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp |grep
request > tcpdump_results3".
Nuno Faria
-
OK, it's done!
I have tried: "tcpdump icmp > tcpdump_results2" and "tcpdump icmp >
tcpdump_results3".
The files are at: http://xenon4.fe.up.pt/tcpdump_results2 and
http://xenon4.fe.up.pt/tcpdump_results3
Ranko Veselinovic <[EMAIL PROTECTED]> sent me privatly the followin
e-mail which I think mig
On Thu, Jul 27, 2000 at 08:56:21AM +0100, Nuno Faria wrote:
> Yes, I had already noticed that when I ping a machine, the packets show
> up in tcpdump as a series of echo-requests and echo-replys, but in this
> case I can't find the echo-requests.
Try "tcpdump icmp". That will show you all icmp tr
-
> John Vivian
> Exxecom
> Network Security Analyst
> ------------------
>
> -Original Message-
> From: Nuno Faria [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, July 26, 2000 2:42 PM
> To: debian-security@lists.debian.org
> Su
-
> John Vivian
> Exxecom
> Network Security Analyst
> --------------
>
> -Original Message-
> From: Nuno Faria [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, July 26, 2000 2:42 PM
> To: [EMAIL PROTECTED]
> Subject: icmp:
John Vivian <[EMAIL PROTECTED]> a écrit :
| A 'ping' consists of two types of ICMP packets; an "echo-request",
| and an "echo-reply".
|
| Take a look at the network traffic for "echo-requests" from the
| hosts
| that your machine is sending the "echo-reply" to; you should
John Vivian <[EMAIL PROTECTED]> a écrit :
| A 'ping' consists of two types of ICMP packets; an "echo-request",
| and an "echo-reply".
|
| Take a look at the network traffic for "echo-requests" from the
| hosts
| that your machine is sending the "echo-reply" to; you should
Security Analyst
--
-Original Message-
From: Nuno Faria [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 26, 2000 2:42 PM
To: debian-security@lists.debian.org
Subject: icmp: echo reply? Am I being attacked?
Dear list members,
First of all let
Dear list members,
First of all let me state where I stand.
I've been using Linux (Debian) for one year now. During this year I've
learnt quite a lot but on the issue of network and security I'm a
complete newby.
Now I think I have a security problem (although it is not exclusively
mine). The pr
Security Analyst
--
-Original Message-
From: Nuno Faria [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, July 26, 2000 2:42 PM
To: [EMAIL PROTECTED]
Subject: icmp: echo reply? Am I being attacked?
Dear list members,
First of all let me state whe
Dear list members,
First of all let me state where I stand.
I've been using Linux (Debian) for one year now. During this year I've
learnt quite a lot but on the issue of network and security I'm a
complete newby.
Now I think I have a security problem (although it is not exclusively
mine). The p
26 matches
Mail list logo
