lkml.org 
[lkml]   [2000]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: How to survive in a Micro$oft environment??
Date
Alan Cox wrote:
> DNS queries sweeping my address range are tagged hostile yes - its someone
> scanning for BIND and hoping to find an old named to hit.

Yep, pretty much any type of scanning can be considered "hostile" in
certain contexts. About the only thing that's usually considered
harmless are things like DHCP.

Maybe some of the networking people of distribution makers should
join their forces and build a network configuration assistant that
implements things in the right way, so that this type of surprises
won't happen in the future. Some ideas:

- make it three-phase, with a non-GUI backend:
1) passive monitoring
2) active discovery: DHCP, BOOTP, RARP
3) verification of user-provided input against monitoring results
- make the non-GUI backend generate reports with hyperlinks for
additional information, e.g.
"Network traffic [1,2] does not agree with suggested IP address 1.2.3.4"
[1] "Address ranges seen from non-routers [3]:
[4] 10.0.0.0/25
[5] 123.45.67.80/30
[2] DHCP reply from 10.0.0.1: ...
[3] The following hosts have sent/received packets with multiple IP
addresses:
[6] MAC 01:02:03:04:05:06: 10.0.0.2 [7], 10.0.0.12 [8]
etc.
- before sending anything, it should ask for confirmation. If it's
something other than DHCP and friends, the default answer should
be "no". That way, people will at least have an idea what they
may have done, when the network security police storms their
office.
etc.

I like the concept of "intelligent" discovery, but if it's not done
with utmost care, the result can be disastrous.

- Werner

--
_________________________________________________________________________
/ Werner Almesberger, ICA, EPFL, CH werner.almesberger@ica.epfl.ch /
/_IN_N_032__Tel_+41_21_693_6621__Fax_+41_21_693_6610_____________________/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.174 / U:0.172 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site