Re: ports 135, 445, 139 and 1433
From: Phillip Helbig---remove CLOTHES to reply (helbig_at_astro.multiCLOTHESvax.de)
Date: 03/31/05
- Next message: Richard Brodie: "Re: Possible faulty drive"
- Previous message: Phillip Helbig---remove CLOTHES to reply: "Re: ports 135, 445, 139 and 1433"
- In reply to: Michael Moroney: "Re: ports 135, 445, 139 and 1433"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Thu, 31 Mar 2005 06:45:29 +0000 (UTC)
In article <d2fdc3$kpk$1@pcls4.std.com>, moroney@world.std.spaamtrap.com
(Michael Moroney) writes:
> >However, each incoming request seems to have a matching outgoing
> >request, as expected to a port number > 1023, and these apparently come
> >from the TCPIP cluster-alias address. Thus, it at least looks like the
> >cluster is responding to these addresses.
>
> Is the response simply nothing more than the IP response "this port isn't
> open here!" which is the standard VMS response? (at least with the
> TCPIP/UCX stacks), The other possible action is to ignore such incoming
> connections as if there was no system there, but the IP specs say do the
> former.
That might be the case. From the router itself, I can't see the
contents of the responses. Perhaps I can if I manage to get the logs
sent to a VMS machine.
> >Would it make sense to block these ports at the router, rather than
> >having them passed through to the cluster?
>
> If you're worried about your VMS systems getting infected by those
> viruses, sure. :-)
No, I was thinking about cutting down unnecessary traffic.
> I personally have a different approach - about two years ago I adapted
> a 'tarpit' program called 'LaBrea' (intended for Unix/Linux) to VMS.
> It is a deliberately "broken" TCP/IP stack which tries to tie up any
> incoming connects to it. (The idea was to taunt hackers, but mostly
> it just ties up worms/viruses)
>
> I plugged an old DE435 adapter in my system, and ran this tarpit on it,
> and set up the NAT router to forward all incoming connections other than
> the ones I actually want to the tarpit's IP address. (the other "real"
> net adapter runs the standard TCP/IP stack and has a separate IP
> address, the NAT router forwards incoming connects that I _do_ want
> (such as HTTP) to it.
>
> It's pretty primitive and really isn't that useful since most of what
> it catches are just worms and not actual hackers.
Do you have a portable (to VMS), workable tarpit program? I have a VMS
machine with (at the moment) NO incoming connections. I've often
thought about distributing several valid email addresses for it over the
internet, then run a tarpit to tie up SMTP connections, to annoy
spammers.
- Next message: Richard Brodie: "Re: Possible faulty drive"
- Previous message: Phillip Helbig---remove CLOTHES to reply: "Re: ports 135, 445, 139 and 1433"
- In reply to: Michael Moroney: "Re: ports 135, 445, 139 and 1433"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
