- WLUG - wlug.mailman3.com

Re: [Wlug] OT: Lindows

by Clint Moyer

On Thu, 27 Jun 2002 19:33:55 -0400 Chuck Homic <chuck(a)vvisions.com> wrote: >On Thu, Jun 27, 2002 at 07:18:01PM -0400, Michael >Frysinger wrote: >Off topic: By the way, any other Microsoft-haters out >there think Lindows >should have lost the infringement case? I mean, come on, >that name was >designed to be deliberately misleading. I'm sadly on >Microsoft's side on >this one. Course it's mostly bad for the poor sap who >doesn't know what >he's buying and tries to run actual applications on his >Lindows machine. > >It's also kinda dumb-sounding. "I know a geniune >Panaphonics when I see >it. And look, there's Magnetbox and Sorny!" > >Just a pointless rant... > > -Chuck No. You're right. Lindows is just another (destined to fail) money-making scheme of Michael Robertson of mp3.com fame. He's well known as a domain squatter: http://www.wired.com/news/politics/0,1283,34893-2,00.html Apparently, he also has issue with the GPL: http://newsforge.com/newsforge/02/04/11/148251.shtml?tid=23

June 28, 2002

OT: Lindows

by Chuck Homic

On Thu, Jun 27, 2002 at 07:18:01PM -0400, Michael Frysinger wrote: > Lindows was supposed to be a linux distro that ran > windows and linux applications. Off topic: By the way, any other Microsoft-haters out there think Lindows should have lost the infringement case? I mean, come on, that name was designed to be deliberately misleading. I'm sadly on Microsoft's side on this one. Course it's mostly bad for the poor sap who doesn't know what he's buying and tries to run actual applications on his Lindows machine. It's also kinda dumb-sounding. "I know a geniune Panaphonics when I see it. And look, there's Magnetbox and Sorny!" Just a pointless rant... -Chuck

June 27, 2002

Re: [Wlug] What are Lindows and Lycoris?

by Michael Frysinger

Lindows was supposed to be a linux distro that ran windows and linux applications. it was supposed to support all of windows in a linux environment without any hassle. the idea was to make linux for masses. with this distro, linux could finally break into the desktop market (at least the part of the market owned by the masses who dont know shit about linux, or even windows). well it hasnt worked out for them ;) wine (which is what lindows relys heavilty upon) still isnt to the point where it can emulate windows programs for the masses w/out the masses realizing they arent running windows. never heard of Lycoris -mike ----- Original Message ----- From: "Andy Stewart" <andystewart(a)attbi.com> To: "Worcester Linux Users' Group" <wlug(a)mail.wlug.org> Sent: Thursday, June 27, 2002 17:56 Subject: [Wlug] What are Lindows and Lycoris? > > HI all, > > Walmart is selling ultra-cheap PCs with Lindows on them (the PC is by > Microtel). The screen shots look alot like KDE. Lindows makes software > available for download on their website (the apps, not the OS) for a fee. > > I've also seen Lycoris, and on their website, they make passing references to > Redmond Linux. > > So, I ask the question, are these just some version of Linux "packaged for the > masses"? If not, what are they? Are there other similar products besides > Lindows and Lycoris? > > Thanks, > > Andy > -- > Andy Stewart, Founder > Worcester Linux Users' Group > Worcester, MA USA > http://www.wlug.org > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

June 27, 2002

What are Lindows and Lycoris?

by Andy Stewart

HI all, Walmart is selling ultra-cheap PCs with Lindows on them (the PC is by Microtel). The screen shots look alot like KDE. Lindows makes software available for download on their website (the apps, not the OS) for a fee. I've also seen Lycoris, and on their website, they make passing references to Redmond Linux. So, I ask the question, are these just some version of Linux "packaged for the masses"? If not, what are they? Are there other similar products besides Lindows and Lycoris? Thanks, Andy -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA USA http://www.wlug.org

June 27, 2002

Re: [Wlug] Lilo :-)

by doug waud

Aaron Haviland wrote: > > doug waud said: > > Hi all > <snip info about that *other* lilo> > > > > Heh... When I saw the subject, I thought it'd be about lilo (Rob Levin, > head of operations at OpenProjects...). He's been making quite an > impression on just about everyone over there lately. > just a few: > http://openprojects.nu/ > http://www.lilofree.net/ > http://www.kainx.org/ > and one from a year ago: > http://crackmonkey.org/pipermail/crackmonkey/2001q1/017271.html > > ahhh, don't you love politics? I was unaware of lilo/levin. Do you see him as a model for what will happen to our Andy as time goes on? :-) doug

June 27, 2002

Re: [Wlug] Lilo :-)

by Aaron Haviland

doug waud said: > Hi all <snip info about that *other* lilo> > Heh... When I saw the subject, I thought it'd be about lilo (Rob Levin, head of operations at OpenProjects...). He's been making quite an impression on just about everyone over there lately. just a few: http://openprojects.nu/ http://www.lilofree.net/ http://www.kainx.org/ and one from a year ago: http://crackmonkey.org/pipermail/crackmonkey/2001q1/017271.html ahhh, don't you love politics? -- Aaron Haviland orion [at] tribble [dot] dyndns [dot] org orion [at] parsed [dot] net Someone is trying to thank me, he thought to himself. He wondered who, and for what.

June 27, 2002

Lilo :-)

by doug waud

Hi all On the TV lately I have heard a lot about Lilo. It seems to be in the context of something called Stitch. I am not clear on the details but Stitch apparently is some sort of extraterrestial with a bent to destroying everything it encounters. I assume the reference is, therefore, to Microsoft. The interesting thing about Lilo is that it never seems to be spelled LILO. The first letter is captialized so I assume there is some degree of case sensitivity involved. If any of you can decipher what all of this means perhaps you could fill me in! :-) I do notice that Disney seems to be involved so it would seem that Pixar is not the only place Linux seems to be making inroads. doug

June 27, 2002

RE: [Wlug] Installing Redhat on HP machines

by Hemstreet, Jeffrey

Thank you all for your help.... just wanted to let you know the outcome of the installs... On the HP Vectra, there appears to be some hardware issues, as Windows 2K boot floppy fails with a Boot I/O Error. This machine has been suspect, and I will probably scavenge it for parts (CD, Memory) (It has had some intermittent problems finding the HDD.) On the HP Kayak..... it's UP! I downloaded the new boot disk image from the email below, and the install ran without a hitch. It must not like the 7.2 standard boot image since it failed both from the install disk and from the boot floppy I made straight from the CDROM. (This was a CD burned from the WLUG installfest in February and it has installed faithfully on about a dozen machines.) Thank you again. jeff -----Original Message----- From: Charles R. Anderson [mailto:cra@WPI.EDU] Sent: Tuesday, June 25, 2002 7:49 PM To: 'wlug(a)mail.wlug.org' Subject: Re: [Wlug] Installing Redhat on HP machines Have you tried booting the latest errata install disks? You can get them here: ftp://angus.ind.wpi.edu/pub/updates/7.2/en/os/images/i386/boot.img ftp://angus.ind.wpi.edu/pub/updates/7.2/en/os/images/i386/update-disk-200201 17.img Make sure you rawrite/dd them to brand new floppy disks, since if there is even a single byte error on the floppy disk, the install will fail. Boot the first one (boot.img) and see below... On Tue, Jun 25, 2002 at 06:25:44PM -0400, Hemstreet, Jeffrey wrote: jhemstreet> One is an HP Vectra (2Gb IDE, 56MB, P200). I can fdisk and select jhemstreet> packages, but when it goes to jhemstreet> format the disk to install the packages, I get a signal 11 fatal error. I jhemstreet> think there may be something jhemstreet> flaky with this system (HDD or memory problem?) Just wondering if anyone jhemstreet> else has seen this type jhemstreet> of failure and could give me any more insight. I plan on replacing the HDD jhemstreet> to see if that is the problem. It depends. Does the signal 11 always happen at exactly the same point? If so, that doesn't necessarily point to flakey hardware, but rather a software bug. If it IS random, then it does sound like a memory error. You can test your RAM with memtest86, available here: http://www.memtest86.com/ Another thing you can try is making sure the amount of memory is detected correctly by Linux (check the boot up messages of the Linux kernel). If not, you can force the correct amount by appending the mem option to the linux boot command line: linux updates mem=56M You need the "updates" bit to use the update-disk mentioned earlier. Insert the updates disk when it asks. jhemstreet> The other is a dual-300 PII HP Kayak with a SCSI Drive. I get a boot error jhemstreet> when trying to boot from the jhemstreet> CDROM or Install Disk. This system is currently running NT 5. Any ideas jhemstreet> why the boot would fail? Bad floppy disk and/or CD-ROM? How did you acquire your Red Hat 7.2 CD-ROM? If it isn't an official disk, then it might have been burned incorrectly. Red Hat recommends burning ISO's in Disk-At-Once mode, and checking the images and disks with md5sum to be sure they burned correctly. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886 _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

June 26, 2002

Re: [Wlug] Installing Redhat on HP machines

by Bill Mills-Curran

On Tue, 25 Jun 2002, Bill Mills-Curran wrote: > Date: Tue, 25 Jun 2002 21:18:10 -0400 (EDT) > From: Bill Mills-Curran <subssn594(a)charter.net> > Reply-To: wlug(a)mail.wlug.org > To: "'wlug(a)mail.wlug.org'" <wlug(a)mail.wlug.org> > Subject: Re: [Wlug] Installing Redhat on HP machines > <snip> > Jeff, > > I had a problem that sounds similar when installing on a Data General > Aviion (old, slow) machine. I was using one of the standard (server?) > installs. I tried a "custom" install, and everything went smoothly. > > Bill > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > I was wrong about the machine (I have too many) -- I was installing on an HP Vectra VL, so my experience should be the same as yours. Bill

June 26, 2002

Re: [Wlug] Installing Redhat on HP machines

by Gary J. Hanley

Ah, the Aviion, AKA Nova II. I was working at DG as a computer operator when they took the plunge with UNIX. I remember the hype about the power of the Aviion line and I was totally blown away the first time I used X on DG/UX-Aviion (First exposure to UNIX in general, actually). Giant workstation screen. Beautiful graphics. I clicked an icon, and no less than 30 seconds, and xterm appeared! :-) -- Gary On Tue, 25 Jun 2002, Bill Mills-Curran wrote: > I had a problem that sounds similar when installing on a Data General > Aviion (old, slow) machine. I was using one of the standard (server?) > installs. I tried a "custom" install, and everything went smoothly. > Bill

June 26, 2002

Re: [Wlug] Installing Redhat on HP machines

by Nate Godin

On Tue, 25 Jun 2002, Hemstreet, Jeffrey wrote: > The other is a dual-300 PII HP Kayak with a SCSI Drive. I get a boot error > when trying to boot from the > CDROM or Install Disk. This system is currently running NT 5. Any ideas > why the boot would fail? I've had some serious problems with an dual PII-266 HP Kayak XU that I recently acquired... I'd get read errors on the IDE CDROM while trying to install Mandrake 8.2, after many failed install attempts, I finally got it to the part where it was actually installing RPM's, and it would go very slowly, with frequent read errors that caused about a third of the packages to fail to install. The system would boot, but wasn't much good beyond that. Putting a SCSI CDROM drive in helped some, though the install was still dog slow due to read errors, and bombed twice. Maybe it needs ECC memory or some BIOS tweaking, or maybe it's a SCSI driver issue? I really have no idea, I just know mine has been a pain in the ass too! Nate -- Experience is not what happens to you; it is what you do with what happens to you. -- Aldous Huxley

June 26, 2002

Re: [Wlug] Installing Redhat on HP machines

by Bill Mills-Curran

On Tue, 25 Jun 2002, Hemstreet, Jeffrey wrote: > Date: Tue, 25 Jun 2002 18:25:44 -0400 > From: "Hemstreet, Jeffrey" <jhemstreet(a)avaya.com> > Reply-To: wlug(a)mail.wlug.org > To: "'wlug(a)mail.wlug.org'" <wlug(a)mail.wlug.org> > Subject: [Wlug] Installing Redhat on HP machines > > I am having a problem installing Redhat 7.2 on 2 different HP machines. I > thought I might be > able to get some information from the plethera of people who have done > installs. Or any ideas > on what to do next? > > One is an HP Vectra (2Gb IDE, 56MB, P200). I can fdisk and select packages, > but when it goes to > format the disk to install the packages, I get a signal 11 fatal error. I > think there may be something > flaky with this system (HDD or memory problem?) Just wondering if anyone > else has seen this type > of failure and could give me any more insight. I plan on replacing the HDD > to see if that is the problem. > > The other is a dual-300 PII HP Kayak with a SCSI Drive. I get a boot error > when trying to boot from the > CDROM or Install Disk. This system is currently running NT 5. Any ideas > why the boot would fail? > > Thanks, > jeff > Jeff, I had a problem that sounds similar when installing on a Data General Aviion (old, slow) machine. I was using one of the standard (server?) installs. I tried a "custom" install, and everything went smoothly. Bill

June 26, 2002

Re: [Wlug] Installing Redhat on HP machines

by Charles R. Anderson

Have you tried booting the latest errata install disks? You can get them here: ftp://angus.ind.wpi.edu/pub/updates/7.2/en/os/images/i386/boot.img ftp://angus.ind.wpi.edu/pub/updates/7.2/en/os/images/i386/update-disk-20020… Make sure you rawrite/dd them to brand new floppy disks, since if there is even a single byte error on the floppy disk, the install will fail. Boot the first one (boot.img) and see below... On Tue, Jun 25, 2002 at 06:25:44PM -0400, Hemstreet, Jeffrey wrote: jhemstreet> One is an HP Vectra (2Gb IDE, 56MB, P200). I can fdisk and select jhemstreet> packages, but when it goes to jhemstreet> format the disk to install the packages, I get a signal 11 fatal error. I jhemstreet> think there may be something jhemstreet> flaky with this system (HDD or memory problem?) Just wondering if anyone jhemstreet> else has seen this type jhemstreet> of failure and could give me any more insight. I plan on replacing the HDD jhemstreet> to see if that is the problem. It depends. Does the signal 11 always happen at exactly the same point? If so, that doesn't necessarily point to flakey hardware, but rather a software bug. If it IS random, then it does sound like a memory error. You can test your RAM with memtest86, available here: http://www.memtest86.com/ Another thing you can try is making sure the amount of memory is detected correctly by Linux (check the boot up messages of the Linux kernel). If not, you can force the correct amount by appending the mem option to the linux boot command line: linux updates mem=56M You need the "updates" bit to use the update-disk mentioned earlier. Insert the updates disk when it asks. jhemstreet> The other is a dual-300 PII HP Kayak with a SCSI Drive. I get a boot error jhemstreet> when trying to boot from the jhemstreet> CDROM or Install Disk. This system is currently running NT 5. Any ideas jhemstreet> why the boot would fail? Bad floppy disk and/or CD-ROM? How did you acquire your Red Hat 7.2 CD-ROM? If it isn't an official disk, then it might have been burned incorrectly. Red Hat recommends burning ISO's in Disk-At-Once mode, and checking the images and disks with md5sum to be sure they burned correctly. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

June 25, 2002

Installing Redhat on HP machines

by Hemstreet, Jeffrey

I am having a problem installing Redhat 7.2 on 2 different HP machines. I thought I might be able to get some information from the plethera of people who have done installs. Or any ideas on what to do next? One is an HP Vectra (2Gb IDE, 56MB, P200). I can fdisk and select packages, but when it goes to format the disk to install the packages, I get a signal 11 fatal error. I think there may be something flaky with this system (HDD or memory problem?) Just wondering if anyone else has seen this type of failure and could give me any more insight. I plan on replacing the HDD to see if that is the problem. The other is a dual-300 PII HP Kayak with a SCSI Drive. I get a boot error when trying to boot from the CDROM or Install Disk. This system is currently running NT 5. Any ideas why the boot would fail? Thanks, jeff

June 25, 2002

Re: [Wlug] Who is port scanning me?

by Josh Huber

Joe Riopel <joe(a)crankhouse.com> writes: > You could download and use a program called Sam Spade. It will tell > you alot about an IP/Hostname. Who registered it, and their contact > information. I dont have a link but I bet a quick search on google > should work. This won't be too useful, since the original request/comment was about an IP address on an _internal_ company network. It won't be registered by anyone! Heh, I like the NS entries listed for reserved IP blocks: BLACKHOLE-1.IANA.ORG 192.0.32.18 BLACKHOLE-2.IANA.ORG 192.0.32.19 ttyl, -- Josh Huber

June 25, 2002

RE: [Wlug] Who is port scanning me?

by Joe Riopel

You could download and use a program called Sam Spade. It will tell you alot about an IP/Hostname. Who registered it, and their contact information. I dont have a link but I bet a quick search on google should work. -Joe

June 25, 2002

Re: [Wlug] fsck, segmantation fault, etc.

by Baris Hasdemir

On Mon, 2002-06-24 at 11:37, Charles R. Anderson wrote: > On Mon, Jun 24, 2002 at 11:26:38AM -0400, Baris Hasdemir wrote: > penguen> I bought a new hard drive, Maxtor 7200 RPM, ATA133, 40GB, and began > penguen> using it at ATA100. > > Did you upgrade your IDE cable to an ATA100-capable one at the same > time? > yes, otherwise it was seeing the ATA1333 drive as ATA33 or ATA66, I don't remember exactly.

June 24, 2002

Re: [Wlug] fsck, segmantation fault, etc.

by Charles R. Anderson

On Mon, Jun 24, 2002 at 11:26:38AM -0400, Baris Hasdemir wrote: penguen> I bought a new hard drive, Maxtor 7200 RPM, ATA133, 40GB, and began penguen> using it at ATA100. Did you upgrade your IDE cable to an ATA100-capable one at the same time? -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

June 24, 2002

fsck, segmantation fault, etc.

by Baris Hasdemir

Hi, I bought a new hard drive, Maxtor 7200 RPM, ATA133, 40GB, and began using it at ATA100. I formatted my /dev/hda5 with mkfs.ext2 and mounted it under /home. I have been using this mount with the Slackware 8.0 at /dev/hda6 for several days without any problems. Two days ago I installed Slackware8.1 on /dev/hda8 and used the same device mounted to /home. (/dev/hda5) Yesterday under root privileges I attempted to delete a user's two big files, and got the following error (or warning, I don't know): root@penguen:/home/avci# rm more_than_700MB_files* EXT2-fs error (device ide0(3,5)): ext2_free_blocks: Freeing blocks not in datazone - block = 1083636778, count = 1 EXT2-fs error (device ide0(3,5)): ext2_free_blocks: Freeing blocks not in datazone - block = 1083606420, count = 1 EXT2-fs error (device ide0(3,5)): ext2_free_blocks: Freeing blocks not in datazone - block = 1083602068, count = 1 EXT2-fs error (device ide0(3,5)): ext2_free_blocks: Freeing blocks not in datazone - block = 1083602292, count = 1 root@penguen:/home/avci# ls -al total 24 drwx--x--x 2 avci misafir 4096 Jun 23 12:47 ./ drwxr-xr-x 10 root root 4096 Feb 25 2001 ../ -rw------- 1 avci misafir 36 Jun 17 17:26 .bash_history -rw-r--r-- 1 avci misafir 34 Jun 17 16:44 .less -rw-r--r-- 1 avci misafir 114 Jun 17 16:44 .lessrc -rw-r--r-- 1 avci misafir 3394 Jun 17 16:44 .screenrc However, rm deleted the files. But I couldn't understand the warning. And then, just because of curiosity I tried to copy one of the same big files from another partition to the same location, and cp gave out those: root@penguen:/home/avci# time cp /mnt/hda10/one_of_the_big_files . Unable to handle kernel NULL pointer dereference at virtual address 00000004 *pde = 00000000 Oops: 0002 CPU: 0 EIP: 0010:[<c0128240>] Tainted: P EFLAGS: 00010046 eax: cbf58000 ebx: 00000003 ecx: ca000000 edx: 00000000 esi: c1405e50 edi: 00000202 ebp: c12f1f80 esp: c14e7efc ds: 0018 es: 0018 ss: 0018 Process kswapd (pid: 4, stackpage=c14e7000) Stack: ca000240 cbe9b8c0 cbe9bb40 c12f1f80 c0130f12 c1405e50 ca000240 c0132a9c ca000240 ca000240 c12f1f80 000001d0 00000009 00000200 c013118c c12f1f80 000001d0 cbe9bb40 c12f1f80 c0128f62 c12f1f80 000001d0 00000020 000001d0 Call Trace: [<c0130f12>] [<c0132a9c>] [<c013118c>] [<c0128f62>] [<c01291a6>] [<c012921c>] [<c01292b3>] [<c0129316>] [<c012942d>] [<c0105708>] Code: 89 42 04 89 10 8b 46 08 89 48 04 89 01 8d 56 08 89 51 04 89 real 0m54.986s user 0m0.060s sys 0m7.330s And then of course I did a couple of fsck on this partition after unmounting. first one quitted after several error correcting, second fsck did segmentation fault but the last one did finish fsck. and lots of error were corrected. It might give an idea if I mount it like this #mount /dev/hda5 /home file names appear as $@#$#%#$ etc. but if I mount it like that #mount /dev/hda5 /home -t ext2 no problem seem to occur. I am thinking about whether I did something missing at the fdisk stage or formatting stage. Or is my new hard disk a dead-born? Or any other things you may notice? thank you, baris

June 24, 2002

RE: [Wlug] Who is port scanning me?

by Simoncini, Matthew

Hi again, Over the weekend, I received some "creative" feedback and all of it is appreciated. Why question was intended to find an easy way to track down the owner of an IP address within our corporate network (unregistered with DNS/WINS). Not to hack, crack, spam, or DOS them, but to gain information on that particular node. I have to bring this IP address to the attention of our Security Team, but wanted more information to give them. Given all the feedback, it seems easier just to contact the Security Team and let them figure this out. Thanks again for your time. Matthew -----Original Message----- From: Phillip G Deneault [mailto:deneault@WPI.EDU] Sent: Sunday, June 23, 2002 9:27 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Who is port scanning me? Chances are the machine that is performing the portscan is hacked himself. It does no good to "hack them back" because your not hacking the hackers...your hacking the hack. :-) On top of that, you'll only cloud the issue and, if the matter is taken to the authorities, you could also get in trouble. Not to mention the entire concept of hacking without authorization is unethical and illegal. I'm going to go say its not worth it. This does happen constantly if your connected to the Internet. Your best offense is a good defense. Phil On Sun, 23 Jun 2002, Michael Frysinger wrote: > try and hack them back???????? > or just move on because it doesnt matter that much. > in the real world that shit happens all the time > -mike > > On Sunday 23 June 2002 08:42 am, David Goss wrote: > > and if it is a hacker???... what's the best way to send them back a little > > something to let them know you care??? > > > > dave goss > > > > > > ----- Original Message ----- > > From: "George Metz" <wolfstar(a)shadownet.wox.org> > > To: <wlug(a)mail.wlug.org> > > Sent: Sunday, June 23, 2002 12:49 AM > > Subject: Re: [Wlug] Who is port scanning me? > > > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > > Hi everyone, > > > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > > internal corporate network. I'd really like to find out where and who > > > > this > > > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > > > etc > > > > > > .... I was wondering if anyone knows of any tools that can get me more > > > > information on this person? This happens to be on our private network, > > > > so > > > > > > most internet tools I don't think will help much. > > > > > > If it's on your internal net, then talking to the network admins for your > > > site should give you a good idea of where they're at and why they're > > > doing it. > > > > > > If there's no network admin on site, then you'll have to do some footwork > > > yourself. The suggestion to use IPTables to ignore data from that address > > > is a good one if possible; you might even be able to track down the > > > culprit when they suddenly can't access your system anymore and ask why. > > > (Possible if it's a somehow compromised system on the internal network.) > > > > > > Another possibility is using host or nslookup if you've got internal > > > nameservers behind whatever's running your NAT setup (I'm making the > > > assumption that you're running NAT if you're on a private net.) > > > > > > If you happen to be the guy who's had Network admin position shoved upon > > > you, then you can try getting a null route added to the router for your > > > net connection at work and use that to see who complains about a sudden > > > lack of net access too, but I'd definitely be careful of that method. =) > > > > > > -- > > > George Metz > > > Commercial Routing Engineer > > > wolfstar(a)shadownet.wox.org > > > > > > "We know what deterrence was with 'mutually assured destruction' during > > > the Cold War. But what is deterrence in information warfare?" -- > > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > > Center > > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Phillip G Deneault

Chances are the machine that is performing the portscan is hacked himself. It does no good to "hack them back" because your not hacking the hackers...your hacking the hack. :-) On top of that, you'll only cloud the issue and, if the matter is taken to the authorities, you could also get in trouble. Not to mention the entire concept of hacking without authorization is unethical and illegal. I'm going to go say its not worth it. This does happen constantly if your connected to the Internet. Your best offense is a good defense. Phil On Sun, 23 Jun 2002, Michael Frysinger wrote: > try and hack them back???????? > or just move on because it doesnt matter that much. > in the real world that shit happens all the time > -mike > > On Sunday 23 June 2002 08:42 am, David Goss wrote: > > and if it is a hacker???... what's the best way to send them back a little > > something to let them know you care??? > > > > dave goss > > > > > > ----- Original Message ----- > > From: "George Metz" <wolfstar(a)shadownet.wox.org> > > To: <wlug(a)mail.wlug.org> > > Sent: Sunday, June 23, 2002 12:49 AM > > Subject: Re: [Wlug] Who is port scanning me? > > > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > > Hi everyone, > > > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > > internal corporate network. I'd really like to find out where and who > > > > this > > > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > > > etc > > > > > > .... I was wondering if anyone knows of any tools that can get me more > > > > information on this person? This happens to be on our private network, > > > > so > > > > > > most internet tools I don't think will help much. > > > > > > If it's on your internal net, then talking to the network admins for your > > > site should give you a good idea of where they're at and why they're > > > doing it. > > > > > > If there's no network admin on site, then you'll have to do some footwork > > > yourself. The suggestion to use IPTables to ignore data from that address > > > is a good one if possible; you might even be able to track down the > > > culprit when they suddenly can't access your system anymore and ask why. > > > (Possible if it's a somehow compromised system on the internal network.) > > > > > > Another possibility is using host or nslookup if you've got internal > > > nameservers behind whatever's running your NAT setup (I'm making the > > > assumption that you're running NAT if you're on a private net.) > > > > > > If you happen to be the guy who's had Network admin position shoved upon > > > you, then you can try getting a null route added to the router for your > > > net connection at work and use that to see who complains about a sudden > > > lack of net access too, but I'd definitely be careful of that method. =) > > > > > > -- > > > George Metz > > > Commercial Routing Engineer > > > wolfstar(a)shadownet.wox.org > > > > > > "We know what deterrence was with 'mutually assured destruction' during > > > the Cold War. But what is deterrence in information warfare?" -- > > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > > Center > > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Michael Frysinger

try and hack them back???????? or just move on because it doesnt matter that much. in the real world that shit happens all the time -mike On Sunday 23 June 2002 08:42 am, David Goss wrote: > and if it is a hacker???... what's the best way to send them back a little > something to let them know you care??? > > dave goss > > > ----- Original Message ----- > From: "George Metz" <wolfstar(a)shadownet.wox.org> > To: <wlug(a)mail.wlug.org> > Sent: Sunday, June 23, 2002 12:49 AM > Subject: Re: [Wlug] Who is port scanning me? > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > Hi everyone, > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > internal corporate network. I'd really like to find out where and who > > this > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > etc > > > > .... I was wondering if anyone knows of any tools that can get me more > > > information on this person? This happens to be on our private network, > > so > > > > most internet tools I don't think will help much. > > > > If it's on your internal net, then talking to the network admins for your > > site should give you a good idea of where they're at and why they're > > doing it. > > > > If there's no network admin on site, then you'll have to do some footwork > > yourself. The suggestion to use IPTables to ignore data from that address > > is a good one if possible; you might even be able to track down the > > culprit when they suddenly can't access your system anymore and ask why. > > (Possible if it's a somehow compromised system on the internal network.) > > > > Another possibility is using host or nslookup if you've got internal > > nameservers behind whatever's running your NAT setup (I'm making the > > assumption that you're running NAT if you're on a private net.) > > > > If you happen to be the guy who's had Network admin position shoved upon > > you, then you can try getting a null route added to the router for your > > net connection at work and use that to see who complains about a sudden > > lack of net access too, but I'd definitely be careful of that method. =) > > > > -- > > George Metz > > Commercial Routing Engineer > > wolfstar(a)shadownet.wox.org > > > > "We know what deterrence was with 'mutually assured destruction' during > > the Cold War. But what is deterrence in information warfare?" -- > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > Center > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Karl Hiramoto

What I would try is setting up a firewall LOG chain in iptables. Have iptables default to closed/drop ports on a host. with the log chain you could see who is attempting to access the closed/drop ports. \ This would track the offending IP. IP adress fake? Not sure on that one. Should give you some usefull info though. On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > Hi everyone, > > I'm constantly getting port scanned from a certain IP address on our > internal corporate network. I'd really like to find out where and who this > person is, but don't know much outside of ping, traceroute, nslookup, etc > .... I was wondering if anyone knows of any tools that can get me more > information on this person? This happens to be on our private network, so > most internet tools I don't think will help much. > > Thanks for your time. > > Matthew -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø QOTD: "Like this rose, our love will wilt and die."

June 23, 2002

Re: [Wlug] Who is port scanning me?

by David Goss

and if it is a hacker???... what's the best way to send them back a little something to let them know you care??? dave goss ----- Original Message ----- From: "George Metz" <wolfstar(a)shadownet.wox.org> To: <wlug(a)mail.wlug.org> Sent: Sunday, June 23, 2002 12:49 AM Subject: Re: [Wlug] Who is port scanning me? > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > Hi everyone, > > > > I'm constantly getting port scanned from a certain IP address on our > > internal corporate network. I'd really like to find out where and who this > > person is, but don't know much outside of ping, traceroute, nslookup, etc > > .... I was wondering if anyone knows of any tools that can get me more > > information on this person? This happens to be on our private network, so > > most internet tools I don't think will help much. > > If it's on your internal net, then talking to the network admins for your > site should give you a good idea of where they're at and why they're doing > it. > > If there's no network admin on site, then you'll have to do some footwork > yourself. The suggestion to use IPTables to ignore data from that address > is a good one if possible; you might even be able to track down the > culprit when they suddenly can't access your system anymore and ask why. > (Possible if it's a somehow compromised system on the internal network.) > > Another possibility is using host or nslookup if you've got internal > nameservers behind whatever's running your NAT setup (I'm making the > assumption that you're running NAT if you're on a private net.) > > If you happen to be the guy who's had Network admin position shoved upon > you, then you can try getting a null route added to the router for your > net connection at work and use that to see who complains about a sudden > lack of net access too, but I'd definitely be careful of that method. =) > > -- > George Metz > Commercial Routing Engineer > wolfstar(a)shadownet.wox.org > > "We know what deterrence was with 'mutually assured destruction' during > the Cold War. But what is deterrence in information warfare?" -- Brigadier > General Douglas Richardson, USAF, Commander - Space Warfare Center > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

June 23, 2002

Re: [Wlug] Who is port scanning me?

by George Metz

On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > Hi everyone, > > I'm constantly getting port scanned from a certain IP address on our > internal corporate network. I'd really like to find out where and who this > person is, but don't know much outside of ping, traceroute, nslookup, etc > .... I was wondering if anyone knows of any tools that can get me more > information on this person? This happens to be on our private network, so > most internet tools I don't think will help much. If it's on your internal net, then talking to the network admins for your site should give you a good idea of where they're at and why they're doing it. If there's no network admin on site, then you'll have to do some footwork yourself. The suggestion to use IPTables to ignore data from that address is a good one if possible; you might even be able to track down the culprit when they suddenly can't access your system anymore and ask why. (Possible if it's a somehow compromised system on the internal network.) Another possibility is using host or nslookup if you've got internal nameservers behind whatever's running your NAT setup (I'm making the assumption that you're running NAT if you're on a private net.) If you happen to be the guy who's had Network admin position shoved upon you, then you can try getting a null route added to the router for your net connection at work and use that to see who complains about a sudden lack of net access too, but I'd definitely be careful of that method. =) -- George Metz Commercial Routing Engineer wolfstar(a)shadownet.wox.org "We know what deterrence was with 'mutually assured destruction' during the Cold War. But what is deterrence in information warfare?" -- Brigadier General Douglas Richardson, USAF, Commander - Space Warfare Center

June 23, 2002