[15576] in bugtraq
Re: Buggy ARP handling in Windoze
daemon@ATHENA.MIT.EDU (Jurjen Oskam)
Fri Jun 30 17:54:12 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <20000629195006.CAC361FEC7@lists.securityfocus.com>
Date: Thu, 29 Jun 2000 21:48:26 +0200
Reply-To: Jurjen Oskam <jurjen@STUPENDOUS.ORG>
From: Jurjen Oskam <jurjen@STUPENDOUS.ORG>
X-To: Paul Starzetz <paul@STARZETZ.DE>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <395B7E64.9FB3D4DB@starzetz.de>
Content-Transfer-Encoding: 8bit
On Thu, 29 Jun 2000 18:50:44 +0200, Paul Starzetz <paul@STARZETZ.DE>
wrote:
>I discovered a strange bug in the ARP handling under Windows 98/latest
>Winsock patch (IGMP). Win98 (at almost Win95 as far as tested) would not
>handle static ARP entries correctly. Setting up an static ARP cache
>entry like:
>
>c:\windows\arp.exe -s host_ip host_mac
I think this is a 'feature' - at least I read here in a preparation
guide for the Microsoft TCP/IP exam that "a static entry in the ARP
cache changes if an ARP broadcast that indicates a different hardware
address is received. In this case, the type of the entry changes to
dynamic, and the newly received hardware address replaces the current
one."
This is not official Microsoft-documentation, but it *is* from a
"Microsoft approved study guide", so it's what Microsoft teaches their
MCPs and MCSEs.
--
Jurjen Oskam * ICQ 11573303 * http://www.stupendous.org/ for PGP key
assassinate nuclear iraq clinton kill bomb USA eta ira cia fbi nsa kill
president wall street ruin economy disrupt phonenetwork atomic bomb sarin
nerve gas bin laden military -*- DVD Decryption at www.stupendous.org -*-
