Re: Seeking UFFI for sockets on Linux

From: Karl A. Krueger (kkrueger_at_example.edu)
Date: 12/03/03 

Date: Wed, 3 Dec 2003 17:08:15 +0000 (UTC)

Luke Gorrie <luke@bluetail.com> wrote:
> Network latency can make you spend a lot of time waiting. The worst
> case is if a firewall is discarding your packets, so that your
> connects will have to timeout. Making requests in parallel will
> probably be important.

It's true. I have a couple of approaches in mind for this ...

My eventual goal is not a clone of nmap, but rather a port of an
existing program I have written in Python. This is a multi-threaded
program that doesn't scan 65535 ports on a host; rather, it scans a few
ports on each of many hosts. It then invokes external programs that do
the actual vulnerability testing, and it records its results in a
PostgreSQL database.

This program is kind of tailored to networks that look like my
workplace's: thousands of machines of several different kinds, scattered
sparsely over many subnets. So it spends a lot of effort eliminating
addresses and ports it doesn't need to scan before spawning threads for
those it does -- it doesn't beat on Windows vulnerabilities on Unix
hosts or nonexistent ones. It isn't meant to be good for "bad guys"
scanning other people's networks through firewalls.

What I hope out of porting it to Lisp is really twofold: first, to
learn a lot more Lisp; second, to bring more of the external code inside
and make it faster.

> If the remote end accepts a lot of your connections, this causes a
> lot of work for the kernel. If they didn't want to be scanned, they
> could possibly crash your computer just by acknowledging your
> connection requests and ignoring everything else, forcing your
> kernel to open and hold a lot of sockets. Maybe you'll want to be
> careful to avoid some bad cases.

Sure, if people are running things like LaBrea, a scanner has to eat a
timeout for every port touched. That would suck. :) 

-- 
Karl A. Krueger <kkrueger@example.edu>
Woods Hole Oceanographic Institution
Email address is spamtrapped.  s/example/whoi/
"Outlook not so good." -- Magic 8-Ball Software Reviews

Relevant Pages

  • PPTPd + pptp-client / Linux Net-2-Net VPN / Slow connection
    ... I can connect the tunnel on both networks without any problems and ... instance) from Client A to Client B (or from Client A to Firewall B) ... I tried to copy data from and to all hosts via a direct TCP/IP ...
    (comp.os.linux.networking)
  • RE: N00b Question
    ... easy to change/add ports. ... there are port bouncers available to bypass firewall rules. ... The method you mention has man flaws, namely, multiple hosts. ... For instance I-Tunes: I-Tunes has built in Internet Radio which can ...
    (Security-Basics)
  • RE: N00b Question
    ... The method you mention has man flaws, namely, multiple hosts. ... uses multiple IP address and ports for connecting. ... No need to sit there and block ports. ... For MSN/yahoo chat you can block the ports in your external firewall. ...
    (Security-Basics)
  • Re: Linux server as it own firewall
    ... Linux server as it own firewall ... > that I couldn't get from simply deciding to only run secure daemons. ... so firewalling those ports doesn't add too much.) ... them from other hosts, unless attacking hosts perform tcp session ...
    (Focus-Linux)
  • Re: SSHD: Limit login attempt rate
    ... Find a real news server. ... be able to access it from a handful of networks that lock down all ... but standard ports (i.e., from within these networks, you can't ... It then opens (via temporary firewall rule) ...
    (comp.os.linux.networking)