Messages in this thread | | | From | Werner Almesberger <> | Subject | Re: How to survive in a Micro$oft environment?? | Date | Mon, 28 Feb 2000 19:07:22 +0100 (MET) |
| |
Alan Cox wrote: > DNS queries sweeping my address range are tagged hostile yes - its someone > scanning for BIND and hoping to find an old named to hit.
Yep, pretty much any type of scanning can be considered "hostile" in certain contexts. About the only thing that's usually considered harmless are things like DHCP.
Maybe some of the networking people of distribution makers should join their forces and build a network configuration assistant that implements things in the right way, so that this type of surprises won't happen in the future. Some ideas:
- make it three-phase, with a non-GUI backend: 1) passive monitoring 2) active discovery: DHCP, BOOTP, RARP 3) verification of user-provided input against monitoring results - make the non-GUI backend generate reports with hyperlinks for additional information, e.g. "Network traffic [1,2] does not agree with suggested IP address 1.2.3.4" [1] "Address ranges seen from non-routers [3]: [4] 10.0.0.0/25 [5] 123.45.67.80/30 [2] DHCP reply from 10.0.0.1: ... [3] The following hosts have sent/received packets with multiple IP addresses: [6] MAC 01:02:03:04:05:06: 10.0.0.2 [7], 10.0.0.12 [8] etc. - before sending anything, it should ask for confirmation. If it's something other than DHCP and friends, the default answer should be "no". That way, people will at least have an idea what they may have done, when the network security police storms their office. etc.
I like the concept of "intelligent" discovery, but if it's not done with utmost care, the result can be disastrous.
- Werner
-- _________________________________________________________________________ / Werner Almesberger, ICA, EPFL, CH werner.almesberger@ica.epfl.ch / /_IN_N_032__Tel_+41_21_693_6621__Fax_+41_21_693_6610_____________________/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |