Re: [Full-Disclosure] Odd packet?

From: Maarten (fulldisc_at_ultratux.org)
Date: 05/25/04

  • Next message: Eric Scher: "[Full-Disclosure] Re: Cisco's stolen code"
    To: Disclosure Full <full-disclosure@lists.netsys.com>
    Date: Tue, 25 May 2004 23:57:33 +0200
    
    

    On Tuesday 25 May 2004 22:35, Steffen Schumacher wrote:
    > On 25.05.2004 21:55:19 +0000, Maarten wrote:
    > > On Tuesday 25 May 2004 15:57, Gregh wrote:
    > > > Getting quite a few 127.0.0.1 on differing ports lately and I know it
    > > > isn't originating FROM this machine. Haven't sniffed any packets but
    > > > they come up in logs.
    > >
    > > Not saying what you see must be wrong but, if your routing / packetfilter
    > > / kernelsettings were properly configured you would not ever get these
    > > packets as they would be dropped before they would reach your machine.
    > > If not your ISP, then you (indeed everyone) should always drop packets
    > > coming from interfaces they _cannot_ originate from. Antispoofing,
    > > that's called. Especially 127.x.x.x is not routed by any ISP which is
    > > worth their name.
    >
    > Logs may still detect packets constructed with a 127/8 address.
    > However, as you said, no ISP, which has to follow rules and regulations in
    > the western world allows spoofing of or even routing of the 127/8 net.
    >
    > So Maarten, if you want to write again, please have packetdumps proving you
    > case.

    Hum... Aren't you confusing me with Gregh, the OP ?
    And if not, what do you want me to prove ? That 127.0.0.1 is not routed...?

    Maarten

    > /Steffen

    -- 
    Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO CARRIER
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    

  • Next message: Eric Scher: "[Full-Disclosure] Re: Cisco's stolen code"

    Relevant Pages

    • Re: Happiness is ...
      ... I remember Bear ... saying something like: ... Bet they are, but worth a shot. ... Worth a try for a couple of packets though, ...
      (uk.rec.motorcycles)
    • Re: Sockets Refresh Problem
      ... Can you post your code that reads data from the socket? ... In TCP, ... No, in TCP, *packets* are sent and received. ... packet's worth of data, ...
      (comp.unix.programmer)
    • Re: Happiness is ...
      ... Bet they are, but worth a shot. ... Worth a try for a couple of packets though, ... lose, ie, tell Customs/PO to sling it if they get arsey and ask for too ... either a) paying the duty on them if caught ...
      (uk.rec.motorcycles)
    • Re: Filter driver communication with application
      ... not by any significant amount, nor will any scheme you come up with make enough of a difference to be worth the effort and technical risk. ... If I'm passing mouse packets from an upper lever filter driver to my application, and my application has to repost the request after each packet - won't the application always be behind the mouse movement? ...
      (microsoft.public.development.device.drivers)
    • Re: [Full-Disclosure] Odd packet?
      ... On Wed, 26 May 2004, Steffen Schumacher wrote: ... > However, as you said, no ISP, which has to follow rules and regulations ... have 127.0.0.1 as the source of the packets. ...
      (Full-Disclosure)