| |
ZL3AI > APRDIG 08.09.03 20:13l 241 Lines 9270 Bytes #999 (0) @ WW
BID : 1876-ZL3AI
Read: GUEST
Subj: TAPR Digest, Sep 05, 1/2
Path: DB0FHN<DB0RGB<OK0PPL<DB0RES<ON0AR<ZL2TZE<ZL3VML
Sent: 030907/1333Z @:ZL3VML.#80.NZL.OC #:7927 [Chch-NZ] FBB7.00i $:1876-ZL3AI
From: ZL3AI@ZL3VML.#80.NZL.OC
To : APRDIG@WW
TAPR APRS Special Interest Group Digest for Friday, September 05, 2003.
1. WAS APRS Map AND AZ Digi
2. RE: aprsfl.net appearing as "port-scanner"
3. Re: sponge
4. RE: aprsfl.net appearing as "port-scanner"
5. RE: aprsfl.net appearing as "port-scanner"
6. RE: aprsfl.net appearing as "port-scanner"
7. Re: sponge
8. RE: aprsfl.net appearing as "port-scanner"
9. Re: sponge
10. Re: sponge
11. Re: sponge
12. Re: sponge
13. Re: sponge
14. Re: sponge
15. Re: sponge
16. Re: sponge
17. Re: sponge
----------------------------------------------------------------------
Subject: WAS APRS Map AND AZ Digi
From: Mark Cheavens <mcheavens@usa.net>
Date: Thu, 04 Sep 2003 23:05:42 -0500
X-Message-Number: 1
WHAT?
Use UI-Digi code in your TNC-2's. It's support of n-n is MUCH better than
the looping Kantronics (I haven't tested a version 9 rom YET. Next week
maybe!) For those unaware Kantronics ONLY stores packets in it's duplicate
suppression buffer IF it did a decrement for N-N.
For the other ODD Tnc's use Digi-Ned or UI-View. In the case of the other
email about path problems. In those areas if the sysop of the SUPER wide
would use Digi-Ned to FIX the offenders path then that eliminates that
issue as well!
Mark Cheavens
KC5EVE
PS I have NO bias against ANY of the software or hardware listed above.
They ALL have there pros and cons and I use EACH of them in different
locations! (What is BEST for the specific site involved)
----------------------------------------------------------------------
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "Scott Miller" <scott@home.miller.org>
Date: Thu, 4 Sep 2003 21:51:21 -0700
X-Message-Number: 2
If you think that's fun, try a .mil network with a couple class B's -
roughly 128,000 addresses. Add to that the fact that one of those blocks is
a nice round number that for some reason many companies decided to use
rather than an RFC 1918 block for their private networks, which eventually
get misconfigured. Yeah, I know there are bigger targets out there, but
this is the biggest I've worked with where it's all funneled through one
point. Getting better though with more upstream blocking.
But back on topic, I wouldn't worry about the IDS 'hits' until you actually
capture some suspect packets yourself and see what's going on. I've seen
IDS boxes drop packets and not follow connection state properly, leading to
a false scan indication. And something like an nmap scan is probably going
to generate a lot more hits than what that report shows.
And to go totally off-topic again... I got myself a new Weller digital
soldering station a few weeks ago, and I noticed that the sponge grows black
mold very quickly - nasty stuff that actually destroys the sponge. I looked
around the radio shop at work and the sponge mold seems to be common. My
old iron had it, but it wasn't so apparent since it had a cheap sponge
anyway. Does anyone have a cure for this stuff? I just got a new sponge
and wet it with a dilute iodine solution - I'll see if it helps. I can't be
the only one who's run into this, but I can't find anything about it on the
web. 'In Googlis non est, ergo non est.'
Scott
N1VG
----------------------------------------------------------------------
Subject: Re: sponge
From: David L Norris <kg9ae@webaugur.com>
Date: 05 Sep 2003 01:14:04 -0500
X-Message-Number: 3
I carve up a cheap antibacterial household sponge. The kind you might
use to wash a countertop or dishes. They seem to deter growths very
well. Just don't wipe when they're dry else it stinks. ;-)
--
David Norris, ARS: KG9AE
http://www.webaugur.com/dave/kg9ae/
ICQ - 412039
----------------------------------------------------------------------
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "Dave Anderson" <dandersn@citicom.com>
Date: Fri, 5 Sep 2003 02:41:43 -0400
X-Message-Number: 4
>But back on topic, I wouldn't worry about the IDS 'hits'
>until you actually
>capture some suspect packets yourself and see what's going
>on. I've seen
>IDS boxes drop packets and not follow connection state
>properly, leading to
>a false scan indication. And something like an nmap scan is
>probably going
>to generate a lot more hits than what that report shows.
I dont' :) We analyse the logs daily looking for those doing more than
rattling, and for the fun graphs, but thats all I use it for. As long as
the traffic is blocked, in the day-and-age the internet is in now i'm happy.
>And to go totally off-topic again... I got myself a new Weller digital
>soldering station a few weeks ago, and I noticed that the
>sponge grows black
>mold very quickly - nasty stuff that actually destroys the
>sponge. I looked
>around the radio shop at work and the sponge mold seems to be
>common. My
>old iron had it, but it wasn't so apparent since it had a cheap sponge
>anyway. Does anyone have a cure for this stuff? I just got
>a new sponge
>and wet it with a dilute iodine solution - I'll see if it
>helps. I can't be
>the only one who's run into this, but I can't find anything
>about it on the
>web. 'In Googlis non est, ergo non est.'
I have a 2000 some odd number weller digital model - and i've come to note
that only dampening the sponge keeps it mold-free. :)
Seeya,
Dave
KG4YZY
www.aprsfl.net
----------------------------------------------------------------------
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "Dave Anderson" <dandersn@citicom.com>
Date: Fri, 5 Sep 2003 03:01:46 -0400
X-Message-Number: 5
>Here are the server lines from aprsd.conf file:
>
>Server aprswest.net 10152 hub-sr
>Server aprsca.net 10152 hub-sr
>Server aprsfl.net 10152 hub-sr
>
>What these logs are telling me that aprsfl attempts to
>connect to my aprsd
>server on a regular basis.
Again, aside from acknowledgment packets, my router(s) prevent any outbound
connects from the server.
Look very careful at what the log shows:
Date Source Source Port Target Port Protocol Flags
Description
2003-08-12 064.058.200.020 10152 6016 6
You connect to port 10152 here. Each and every packet moved on the server
results in a acknowledgement packet that my, and all TCP connection create
back to the client. This appears to be a normal connect.
The catch here is that the real time nature of APRS-IS, and some timing
issues that I personally feel need addresses in the "next generation" of
APRS, causes a single connection to any server with a full feed to produces
a -TON- of packets and acknowledgments. I'm talking packet rates around
10 -times- the normal rate for the same amount of data being moved. Again,
I'm hoping Pete chimes in here, he can explain more the exacts of this.
What is -probably- happening is one of a couple scenarios.
1: Packets of unusually small size will get flagged as a attack, or denial
of service attack packets. For example, several attacks on Microsoft were
all based on very-small packets in an attempt to exhaust resources on the
server. APRS-IS -uses- legitimate small packets, some so small that I had
to build special rules in my Cisco PIX Firewall -just- to let those packets
thru here when I setup the server, as -it- thought it was an attack and
auto-blocked it.
2: Due to the -quantity- of packets being sent, it's a possibility with
asymmetrical routing (packets going one way, coming back a alternate path),
that packets are getting -out of order- as they are arriving, and they are
getting flagged.
3: Due to the shere -quantity- of packets, it's flagging them.
I have -no- idea what the D-Link boxes use as criteria for logging. It's
hard to say what in the D-Link is catching these packets and logging them.
Honestly a TCPdump of the packets would also show more - and explain more -
and if there is an issue with javARPSrv, Pete, the author, could look into
it. I'd be more apt to believe the router is falsly catching the packets.
73 de Dave
KG4YZY
www.aprsfl.net
----------------------------------------------------------------------
Subject: RE: aprsfl.net appearing as "port-scanner"
From: "AE5PL Lists" <HamLists@ametx.com>
Date: Fri, 5 Sep 2003 06:43:48 -0500
X-Message-Number: 6
You stay up too late, Dave :-)
javAPRSSrvr does not initiate any connect sequences outbound except for
those defined by the sysop for hubs. And those connections would not
show port 10152 as port 10152 is already taken as a listening port.
As Dave pointed out earlier, due to the real-time nature of APRS and the
use of TCP for a UI protocol, each APRS packet is sent in its own TCP/IP
packet (TCP_NODELAY is set). This can cause extremely small packets to
be exchanged with servers. If you take a look, aprsfl.net was the most
obvious, but ip12.cc7673.adsl.digitaldune.net is aprswest.net and
user-112vlf3.biz.mindspring.com is aprsca.net so you are getting reports
from all the servers. I believe that Dave is correct in guessing that
the Dlink thinks that these small packets are some type of DoS attack
and is flagging those packets.
I can say with certainty that javAPRSSrvr is not initiating any
connections to your system.
73,
Pete Loveall AE5PL
pete@ae5pl.net
----------------------------------------------------------------------
Read previous mail | Read next mail
| |
