Re: Quick BugBear Detection

2003-06-12 Thread MKlinke
On Thursday 12 June 2003 23:49, Cliff Wells wrote: > On Fri, 2003-06-06 at 07:07, Jonathan Bartlett wrote: > > I'm sure most of you know this, but there's a simple way to detect > > bugbear infections on your network using Linux, since it opens up > > port 1080: > > > > nmap -sT -p 1080 network/net

Re: Quick BugBear Detection

2003-06-12 Thread Cliff Wells
On Fri, 2003-06-06 at 07:07, Jonathan Bartlett wrote: > I'm sure most of you know this, but there's a simple way to detect bugbear > infections on your network using Linux, since it opens up port 1080: > > nmap -sT -p 1080 network/netmask > > For my internal network I use > > nmap -sT -p 1080 19

RE: Quick BugBear Detection

2003-06-08 Thread Jason Staudenmayer
Your firewall is blocking the output for the scan iptables OUTPUT -P ACCEPT Will fix that. -Original Message- From: Mark Neidorff [mailto:[EMAIL PROTECTED] Sent: Sunday, June 08, 2003 10:02 AM To: [EMAIL PROTECTED] Subject: Re: Quick BugBear Detection Here's what mine reports:

Re: Quick BugBear Detection

2003-06-08 Thread Mark Neidorff
Here's what mine reports: nmap -sT -p 1080 192.168.1.0/24 Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ ) sendto in send_ip_raw: sendto(4, packet, 28, 0, 192.168.1.0, 16) => Operation not permitted and this message keeps repeating (once for send_ip_raw and once for send_tcp_raw) all the

RE: Quick BugBear Detection

2003-06-06 Thread Go, Jeffrey
Hi Jason, I saw both...Open and Filtered.. I am trying to scan machines that has possible Bugbear virus... thanks -Original Message- From: Gordon Messmer [mailto:[EMAIL PROTECTED] Sent: Friday, June 06, 2003 9:11 AM To: [EMAIL PROTECTED] Subject: Re: Quick BugBear Detection Jason

Re: Quick BugBear Detection

2003-06-06 Thread Robert Canary
Mine said open.?? Gordon Messmer wrote: > > Jason Staudenmayer wrote: > > Why would it also see that port open on a Linux box? > > I ran netstat -an |grep 1080 but didn't see anything watching that port. > > Was it reported "open" or "filtered"? The latter will happen if you > have a firewa

RE: Quick BugBear Detection

2003-06-06 Thread Jason Staudenmayer
"Filtered" So it sees the firewall dropping it. My INPUT policy is DROP -Original Message- From: Gordon Messmer [mailto:[EMAIL PROTECTED] Sent: Friday, June 06, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: Re: Quick BugBear Detection Jason Staudenmayer wrote: > Why woul

Re: Quick BugBear Detection

2003-06-06 Thread Gordon Messmer
Jason Staudenmayer wrote: Why would it also see that port open on a Linux box? I ran netstat -an |grep 1080 but didn't see anything watching that port. Was it reported "open" or "filtered"? The latter will happen if you have a firewall set to DROP packets on that port. -- redhat-list mailing l

Re: Quick BugBear Detection

2003-06-06 Thread Robert Canary
. > Using nmap -sT -v -p 1080" > > Any ideas> > thanks > > -Original Message- > From: Robert Canary [mailto:[EMAIL PROTECTED] > Sent: Friday, June 06, 2003 7:35 AM > To: [EMAIL PROTECTED] > Subject: Re: Quick BugBear Detection > > hmmm, I neve

RE: Quick BugBear Detection

2003-06-06 Thread Jason Staudenmayer
Why would it also see that port open on a Linux box? I ran netstat -an |grep 1080 but didn't see anything watching that port. -Original Message- From: Go, Jeffrey [mailto:[EMAIL PROTECTED] Sent: Friday, June 06, 2003 11:46 AM To: '[EMAIL PROTECTED]' Subject: RE: Quick Bu

RE: Quick BugBear Detection

2003-06-06 Thread Go, Jeffrey
I am using Nmap to scan a subnet.. And it is coming up with each IP and saying "Interesting port".. Using nmap -sT -v -p 1080" Any ideas> thanks -Original Message- From: Robert Canary [mailto:[EMAIL PROTECTED] Sent: Friday, June 06, 2003 7:35 AM To: [EMAIL PROTECTED]

Re: Quick BugBear Detection

2003-06-06 Thread Skip Morrow
Good point. Skip On Fri, 2003-06-06 at 11:08, Jonathan Bartlett wrote: > > You could also just do a netstat -tapn and look for an open port 1080. > > That only works for the local machine. nmap will get your entire network > in about 10 seconds. > > Jon > > > > > nmap is a port scanner for li

Re: Quick BugBear Detection

2003-06-06 Thread Jonathan Bartlett
> You could also just do a netstat -tapn and look for an open port 1080. That only works for the local machine. nmap will get your entire network in about 10 seconds. Jon > > nmap is a port scanner for linux (and a pretty good one at that) > > Skip > > On Fri, 2003-06-06 at 10:35, Robert Canary

Re: Quick BugBear Detection

2003-06-06 Thread Skip Morrow
You could also just do a netstat -tapn and look for an open port 1080. nmap is a port scanner for linux (and a pretty good one at that) Skip On Fri, 2003-06-06 at 10:35, Robert Canary wrote: > hmmm, I never seen nmap before, what is it? > > Jonathan Bartlett wrote: > > > > I'm sure most of you

Re: Quick BugBear Detection

2003-06-06 Thread Robert Canary
hmmm, I never seen nmap before, what is it? Jonathan Bartlett wrote: > > I'm sure most of you know this, but there's a simple way to detect bugbear > infections on your network using Linux, since it opens up port 1080: > > nmap -sT -p 1080 network/netmask > > For my internal network I use > >