[21988] in bugtraq
Re: UDP packet handling weird behaviour of various operating systems
daemon@ATHENA.MIT.EDU (Pavlos Parissis)
Sun Jul 29 07:20:20 2001
Date: Sun, 29 Jul 2001 14:25:21 +0300
From: Pavlos Parissis <p_pavlos@otenet.gr>
To: bugtraq@securityfocus.com
Message-Id: <20010729142521.7d6fada2.p_pavlos@otenet.gr>
In-Reply-To: <20010724233639.A5717@allianztiriac.ro>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="Multipart_Sun__29_Jul_2001_14:25:21_+0300_0833abd0"
--Multipart_Sun__29_Jul_2001_14:25:21_+0300_0833abd0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
When the time was Tue, 24 Jul 2001 23:36:39 +0300, Stefan Laudat wrote....
Hi Stefan,
Stefan->I would like to hear some other results for other operating systems.
I did some test in my home network.
Info of PC A
CPU : AMD 700
etho: RealTek RTL8139 Fast Ethernet at 0xd8800000, 00:50:bf:4a:bb:7d, IRQ 9
eth0: Identified 8139 chip type 'RTL-8139C'
RAM :393 MB
Kernel 2.4.7
ip:192.168.100.1
info of PC B
cpu : P133
eth0 RealTEK RTL 8139
RAM : 32 MB
kernel: 2.2.19
ip:192.168.100.2
No hub just cross link.
ON pc A
./a.out 127.0.0.1 cc
CPU 100% USAGE not slowdown
./a.out 192.168.100.2 cc
CPU 100% USAGE not slowdown
on pc B CPU USAGE was the same before the attack
ON pc B now
./a.out 192.168.100.1 cc
CPU 96% USAGE not slowdown,but i don'n use X on these machine i could not run same havy apps.
CPU 100 USAGE On pc A and slowdown i run it only for 25 secs because i couldn't even move the mouse!
Now, if i stop firewall and return to the default state and try from pc B do tha attack the pc A i
got
recvfrom:Connection refused!!!!!!!!!!!!!!
WHen i mean i stopped the firewall i mean that i had flush all rules and default policy is ACCEPT
for
all tables
but pc A can attack to pc B
THe firewall running on pc A.
Thanks in advance,
Pavlos
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I love having the feeling of being in control
while i have the sensation of speed
The surfer of life
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--Multipart_Sun__29_Jul_2001_14:25:21_+0300_0833abd0
Content-Type: application/octet-stream;
name="firewalloutput"
Content-Disposition: attachment;
filename="firewalloutput"
Content-Transfer-Encoding: base64
Q2hhaW4gSU5QVVQgKHBvbGljeSBEUk9QIDIzODkzIHBhY2tldHMsIDc2NUsgYnl0ZXMpCm51bSAg
IHBrdHMgYnl0ZXMgdGFyZ2V0ICAgICBwcm90IG9wdCBpbiAgICAgb3V0ICAgICBzb3VyY2UgICAg
ICAgICAgICAgICBkZXN0aW5hdGlvbgoxICAgICAgICAwICAgICAwIExPRyAgICAgICAgdGNwICAt
LSAgKiAgICAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAg
IHRjcApmbGFnczoweDNGLzB4MjkgbGltaXQ6IGF2ZyAxL21pbiBidXJzdCA1IExPRyBmbGFncyAw
IGxldmVsIDUgcHJlZml4IGBYbXMgU2NhbiAnCjIgICAgICAgIDAgICAgIDAgRFJPUCAgICAgICB0
Y3AgIC0tICAqICAgICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAg
ICAgICAgdGNwCmZsYWdzOjB4M0YvMHgyOQozICAgICAgICAwICAgICAwIExPRyAgICAgICAgdGNw
ICAtLSAgKiAgICAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAg
ICAgIHRjcApmbGFnczoweDNGLzB4MDEgc3RhdGUgSU5WQUxJRCxORVcsUkVMQVRFRCBsaW1pdDog
YXZnIDEvbWluIGJ1cnN0IDUgTE9HIGZsYWdzIDAgbGV2ZWwgNSBwcmVmaXggYEZpbgpTY2FucyAn
CjQgICAgICAgIDAgICAgIDAgRFJPUCAgICAgICB0Y3AgIC0tICAqICAgICAgKiAgICAgICAwLjAu
MC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgdGNwCmZsYWdzOjB4M0YvMHgwMSBz
dGF0ZSBJTlZBTElELE5FVyxSRUxBVEVECjUgICAgICAgIDAgICAgIDAgTE9HICAgICAgICBhbGwg
IC0tICAqICAgICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAg
ICAgc3RhdGUKSU5WQUxJRCBsaW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGZsYWdzIDAgbGV2
ZWwgNSBwcmVmaXggYEludmFsaWQgSU5QVVQgc3RhdGUgJwo2ICAgICAgICAwICAgICAwIERST1Ag
ICAgICAgYWxsICAtLSAgKiAgICAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAu
MC8wICAgICAgICAgIHN0YXRlCklOVkFMSUQKNyAgICAgICAgMCAgICAgMCBMT0cgICAgICAgIGFs
bCAgLS0gIHBwcDAgICAqICAgICAgIDAuMC4wLjAvMCAgICAgICAgICAgIDAuMC4wLjAvMCAgICAg
ICAgICBzdGF0ZQpORVcgbGltaXQ6IGF2ZyAxL21pbiBidXJzdCA1IExPRyBmbGFncyAwIGxldmVs
IDUgcHJlZml4IGBOZXcgSU5QVVQgc3RhdGUgJwo4ICAgICAgICAwICAgICAwIERST1AgICAgICAg
YWxsICAtLSAgcHBwMCAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAg
ICAgICAgIHN0YXRlCk5FVwo5ICAgICAgICAwICAgICAwIExPRyAgICAgICAgaWNtcCAtLSAgcHBw
MCAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAgIGljbXAK
dHlwZSA4IGxpbWl0OiBhdmcgMS9taW4gYnVyc3QgNSBMT0cgZmxhZ3MgMCBsZXZlbCA1IHByZWZp
eCBgSU5QVVQgUG9EIGF0dGFjayAnCjEwICAgICAgIDAgICAgIDAgRFJPUCAgICAgICBpY21wIC0t
ICBwcHAwICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAg
aWNtcAp0eXBlIDgKMTEgICAgICAgMCAgICAgMCBBQ0NFUFQgICAgIGFsbCAgLS0gIHBwcDAgICAq
ICAgICAgIDAuMC4wLjAvMCAgICAgICAgICAgIDAuMC4wLjAvMCAgICAgICAgICBzdGF0ZQpSRUxB
VEVELEVTVEFCTElTSEVECjEyICAgICAgIDAgICAgIDAgQUNDRVBUICAgICB0Y3AgIC0tICAhcHBw
MCAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgc3RhdGUK
TkVXCjEzICAgICAgIDAgICAgIDAgQUNDRVBUICAgICBpY21wIC0tICBldGgwICAgKiAgICAgICAw
LjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgc3RhdGUKUkVMQVRFRCxFU1RB
QkxJU0hFRAoxNCAgICAgICAwICAgICAwIEFDQ0VQVCAgICAgaWNtcCAtLSAgZXRoMCAgICogICAg
ICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAgIGljbXAKdHlwZSA4IGxp
bWl0OiBhdmcgMTAvc2VjIGJ1cnN0IDUKMTUgICAgICAgMCAgICAgMCBBQ0NFUFQgICAgIHRjcCAg
LS0gIGV0aDAgICAqICAgICAgIDE5Mi4xNjguMTAwLjAvMjQgICAgIDE5Mi4xNjguMTAwLjEgICAg
ICB0Y3AKZHB0OjEzOQoxNiAgICAgICAwICAgICAwIEFDQ0VQVCAgICAgdGNwICAtLSAgZXRoMCAg
ICogICAgICAgMTkyLjE2OC4xMDAuMC8yNCAgICAgMTkyLjE2OC4xMDAuMSAgICAgIHRjcApkcHQ6
MzEyOAoxNyAgICAgICAwICAgICAwIEFDQ0VQVCAgICAgdGNwICAtLSAgbG8gICAgICogICAgICAg
MC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAgIHRjcApzcHQ6MzEyOAoxOCAg
ICAgICAwICAgICAwIEFDQ0VQVCAgICAgdGNwICAtLSAgbG8gICAgICogICAgICAgMC4wLjAuMC8w
ICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAgIHRjcApkcHQ6MzEyOAoxOSAgICAgICAwICAg
ICAwIEFDQ0VQVCAgICAgdGNwICAtLSAgZXRoMCAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAg
ICAgMC4wLjAuMC8wICAgICAgICAgIHRjcApkcHQ6MjIgc3RhdGUgRVNUQUJMSVNIRUQKCkNoYWlu
IEZPUldBUkQgKHBvbGljeSBEUk9QIDAgcGFja2V0cywgMCBieXRlcykKbnVtICAgcGt0cyBieXRl
cyB0YXJnZXQgICAgIHByb3Qgb3B0IGluICAgICBvdXQgICAgIHNvdXJjZSAgICAgICAgICAgICAg
IGRlc3RpbmF0aW9uCjEgICAgICAgIDAgICAgIDAgTE9HICAgICAgICBhbGwgIC0tICAqICAgICAg
KiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgc3RhdGUKSU5W
QUxJRCBsaW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGZsYWdzIDAgbGV2ZWwgNSBwcmVmaXgg
YEludmFsaWQgRk9SV0FSRCBzdGF0ZSAnCjIgICAgICAgIDAgICAgIDAgRFJPUCAgICAgICBhbGwg
IC0tICAqICAgICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAg
ICAgc3RhdGUKSU5WQUxJRAozICAgICAgICAwICAgICAwIExPRyAgICAgICAgYWxsICAtLSAgcHBw
MCAgICogICAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAgICAgIHN0YXRl
Ck5FVyBsaW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGZsYWdzIDAgbGV2ZWwgNSBwcmVmaXgg
YE5ldyBGT1JXQVJEIHN0YXRlICcKNCAgICAgICAgMCAgICAgMCBEUk9QICAgICAgIGFsbCAgLS0g
IHBwcDAgICAqICAgICAgIDAuMC4wLjAvMCAgICAgICAgICAgIDAuMC4wLjAvMCAgICAgICAgICBz
dGF0ZQpORVcKNSAgICAgICAgMCAgICAgMCBMT0cgICAgICAgIGljbXAgLS0gIHBwcDAgICAqICAg
ICAgIDAuMC4wLjAvMCAgICAgICAgICAgIDAuMC4wLjAvMCAgICAgICAgICBpY21wCnR5cGUgOCBs
aW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGZsYWdzIDAgbGV2ZWwgNSBwcmVmaXggYEZPUldB
UkQgUG9EIGF0dGFjayAnCjYgICAgICAgIDAgICAgIDAgRFJPUCAgICAgICBpY21wIC0tICBwcHAw
ICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgaWNtcAp0
eXBlIDgKNyAgICAgICAgMCAgICAgMCBBQ0NFUFQgICAgIGFsbCAgLS0gIHBwcDAgICAqICAgICAg
IDAuMC4wLjAvMCAgICAgICAgICAgIDAuMC4wLjAvMCAgICAgICAgICBzdGF0ZQpSRUxBVEVELEVT
VEFCTElTSEVECjggICAgICAgIDAgICAgIDAgQUNDRVBUICAgICB0Y3AgIC0tICAhcHBwMCAgKiAg
ICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgc3RhdGUKTkVXCjkg
ICAgICAgIDAgICAgIDAgQUNDRVBUICAgICBpY21wIC0tICAqICAgICAgcHBwMCAgICAwLjAuMC4w
LzAgICAgICAgICAgICAwLjAuMC4wLzAgICAgICAgICAgaWNtcAp0eXBlIDgKMTAgICAgICAgMCAg
ICAgMCBBQ0NFUFQgICAgIHRjcCAgLS0gICogICAgICBwcHAwICAgIDE5Mi4xNjguMTAwLjAvMjQg
ICAgIDAuMC4wLjAvMCAgICAgICAgICB0Y3AKZHB0OjI1IHN0YXRlIE5FVyxFU1RBQkxJU0hFRAox
MSAgICAgICAwICAgICAwIEFDQ0VQVCAgICAgdGNwICAtLSAgcHBwMCAgICogICAgICAgMTkyLjE2
OC4xMDAuMC8yNCAgICAgMC4wLjAuMC8wICAgICAgICAgIHRjcApzcHQ6MjUgc3RhdGUgRVNUQUJM
SVNIRUQKMTIgICAgICAgMCAgICAgMCBBQ0NFUFQgICAgIHRjcCAgLS0gICogICAgICBwcHAwICAg
IDE5Mi4xNjguMTAwLjAvMjQgICAgIDAuMC4wLjAvMCAgICAgICAgICB0Y3AKZHB0OjExMCBzdGF0
ZSBORVcsRVNUQUJMSVNIRUQKMTMgICAgICAgMCAgICAgMCBBQ0NFUFQgICAgIHRjcCAgLS0gIHBw
cDAgICAqICAgICAgIDE5Mi4xNjguMTAwLjAvMjQgICAgIDAuMC4wLjAvMCAgICAgICAgICB0Y3AK
c3B0OjExMCBzdGF0ZSBFU1RBQkxJU0hFRAoxNCAgICAgICAwICAgICAwIEFDQ0VQVCAgICAgdWRw
ICAtLSAgKiAgICAgIHBwcDAgICAgMC4wLjAuMC8wICAgICAgICAgICAgMC4wLjAuMC8wICAgICAg
ICAgIHVkcApkcHQ6NTMgc3RhdGUgTkVXLEVTVEFCTElTSEVECjE1ICAgICAgIDAgICAgIDAgQUND
RVBUICAgICB1ZHAgIC0tICBwcHAwICAgKiAgICAgICAwLjAuMC4wLzAgICAgICAgICAgICAwLjAu
MC4wLzAgICAgICAgICAgdWRwCnNwdDo1MyBzdGF0ZSBFU1RBQkxJU0hFRAoKQ2hhaW4gT1VUUFVU
IChwb2xpY3kgQUNDRVBUIDAgcGFja2V0cywgMCBieXRlcykKLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS1uYXQgdGFibGUtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCkNoYWluIFBSRVJP
VVRJTkcgKHBvbGljeSBBQ0NFUFQpCnRhcmdldCAgICAgcHJvdCBvcHQgc291cmNlICAgICAgICAg
ICAgICAgZGVzdGluYXRpb24gICAgICAgICAKTE9HICAgICAgICB0Y3AgIC0tICBhbnl3aGVyZSAg
ICAgICAgICAgICBhbnl3aGVyZSAgICAgICAgICAgdGNwCmZsYWdzOkZJTixTWU4sUlNULFBTSCxB
Q0ssVVJHL0ZJTixTWU4gbGltaXQ6IGF2ZyAxL21pbiBidXJzdCA1IExPRyBsZXZlbCBub3RpY2Ug
cHJlZml4IGBPcGVuLUNsb3NlCnNjYW4gJyAKRFJPUCAgICAgICB0Y3AgIC0tICBhbnl3aGVyZSAg
ICAgICAgICAgICBhbnl3aGVyZSAgICAgICAgICAgdGNwCmZsYWdzOkZJTixTWU4sUlNULFBTSCxB
Q0ssVVJHL0ZJTixTWU4gCkxPRyAgICAgICAgdGNwICAtLSAgYW55d2hlcmUgICAgICAgICAgICAg
YW55d2hlcmUgICAgICAgICAgIHRjcApmbGFnczpGSU4sU1lOLFJTVCxQU0gsQUNLLFVSRy9GSU4s
UFNILFVSRyBsaW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGxldmVsIG5vdGljZSBwcmVmaXgK
YFByZXJvdXRpbmcgc2NhbnMgJyAKRFJPUCAgICAgICB0Y3AgIC0tICBhbnl3aGVyZSAgICAgICAg
ICAgICBhbnl3aGVyZSAgICAgICAgICAgdGNwCmZsYWdzOkZJTixTWU4sUlNULFBTSCxBQ0ssVVJH
L0ZJTixQU0gsVVJHIApMT0cgICAgICAgIHRjcCAgLS0gIGFueXdoZXJlICAgICAgICAgICAgIGFu
eXdoZXJlICAgICAgICAgICB0Y3AgZmxhZ3M6RklOLFNZTixSU1QsUFNILEFDSyxVUkcvRklOCmxp
bWl0OiBhdmcgMS9taW4gYnVyc3QgNSBMT0cgbGV2ZWwgbm90aWNlIHByZWZpeCBgUHJlcm91dGlu
ZyBzY2FucyAnIApEUk9QICAgICAgIHRjcCAgLS0gIGFueXdoZXJlICAgICAgICAgICAgIGFueXdo
ZXJlICAgICAgICAgICB0Y3AgZmxhZ3M6RklOLFNZTixSU1QsUFNILEFDSyxVUkcvRklOIApMT0cg
ICAgICAgIHRjcCAgLS0gIGFueXdoZXJlICAgICAgICAgICAgIGFueXdoZXJlICAgICAgICAgICB0
Y3AKZmxhZ3M6RklOLFNZTixSU1QsUFNILEFDSyxVUkcvRklOLFNZTiBsaW1pdDogYXZnIDEvbWlu
IGJ1cnN0IDUgTE9HIGxldmVsIG5vdGljZSBwcmVmaXggYFByZXJvdXRpbmcKc2NhbnMgJyAKRFJP
UCAgICAgICB0Y3AgIC0tICBhbnl3aGVyZSAgICAgICAgICAgICBhbnl3aGVyZSAgICAgICAgICAg
dGNwCmZsYWdzOkZJTixTWU4sUlNULFBTSCxBQ0ssVVJHL0ZJTixTWU4gCkxPRyAgICAgICAgdGNw
ICAtLSAgYW55d2hlcmUgICAgICAgICAgICAgYW55d2hlcmUgICAgICAgICAgIHRjcCBmbGFnczpT
WU4sUlNULEFDSy9TWU4gbGltaXQ6IGF2ZwoxL21pbiBidXJzdCA1IExPRyBsZXZlbCBub3RpY2Ug
cHJlZml4IGBQUkVST1VUSU5HIFN5bi1mbG9vZCAnIApEUk9QICAgICAgIHRjcCAgLS0gIGFueXdo
ZXJlICAgICAgICAgICAgIGFueXdoZXJlICAgICAgICAgICB0Y3AgZmxhZ3M6U1lOLFJTVCxBQ0sv
U1lOIApMT0cgICAgICAgIGFsbCAgLS0gIGFueXdoZXJlICAgICAgICAgICAgIDIyNC4wLjAuMC8y
NCAgICAgICBsaW1pdDogYXZnIDEvbWluIGJ1cnN0IDUgTE9HIGxldmVsCm5vdGljZSBwcmVmaXgg
YE11bHRpY2FzdGluZyAnIApEUk9QICAgICAgIGFsbCAgLS0gIGFueXdoZXJlICAgICAgICAgICAg
IDIyNC4wLjAuMC8yNCAgICAgICAKRFJPUCAgICAgICBhbGwgIC0tICAxOTIuMTY4LjAuMC8xNiAg
ICAgICBhbnl3aGVyZSAgICAgICAgICAgCkRST1AgICAgICAgYWxsICAtLSAgMTAuMC4wLjAvOCAg
ICAgICAgICAgYW55d2hlcmUgICAgICAgICAgIApEUk9QICAgICAgIGFsbCAgLS0gIDE3Mi4xNi4w
LjAvMTIgICAgICAgIGFueXdoZXJlICAgICAgICAgICAKCkNoYWluIFBPU1RST1VUSU5HIChwb2xp
Y3kgQUNDRVBUKQp0YXJnZXQgICAgIHByb3Qgb3B0IHNvdXJjZSAgICAgICAgICAgICAgIGRlc3Rp
bmF0aW9uICAgICAgICAgCk1BU1FVRVJBREUgIGFsbCAgLS0gIGFueXdoZXJlICAgICAgICAgICAg
IGFueXdoZXJlICAgICAgICAgICAKCkNoYWluIE9VVFBVVCAocG9saWN5IEFDQ0VQVCkKdGFyZ2V0
ICAgICBwcm90IG9wdCBzb3VyY2UgICAgICAgICAgICAgICBkZXN0aW5hdGlvbiAgICAgICAgIAoK
--Multipart_Sun__29_Jul_2001_14:25:21_+0300_0833abd0--
