Re: Possible cable modem denial of service ?

From: skybuck2000at_private
Date: Thu Aug 01 2002 - 20:33:59 PDT

  • Next message: Declan McCullagh: "Re: Comment on DMCA, Security, and Vuln Reporting]"

    
     ('binary' encoding is not supported, stored as-is)
    In-Reply-To: <HPEKJHKCLJALHKKNBDAIOEEKCNAA.sebasat_private>
    
    Hi
    
    I received this e-mail from Gyrniff <frohnat_private>:
    
    *** start: ***
    I used ethereal to sniff a connection and looked at the SYN-ACK packet. 
    This 
    SYN-ACK did no look like any SYN-ACK packets I ever have looked at (and I 
    have looked at a few, I'm working on making a TCP fingerprint better than 
    nmap ;-)) so I just wonder if your cabel modem died on the first SYN-ACK 
    or 
    did you resive any of the html content too ? 
    
    My theory is, that it could be a malfunction in the TCP-stack, I don't 
    think the html content contains any thread. 
    *** end ***
    
    To help him and others to figure out what is going on I used ethereal to 
    capture all packets and print them out to 3 textfiles ( summary, detail 
    and hex data ). I have compressed the files into a zipfile which can be 
    downloaded via this link:
    
    skybuck.soshost.net/VanDaleCrash.zip
    
    Anyone that is interested can freely download it :)
    
    Please dont use it to nuke me or stuff like that :)
    
    To bad www.vandale.nl does not work on my cable modem... I used it 
    regularly to search for the meaning of dutch words. It's a very well known 
    dutch dictionary called 'Van Dale'. The online version is just a tiny 
    version.
    
    Greetz
      Skybuck.
    



    This archive was generated by hypermail 2b30 : Fri Aug 02 2002 - 00:58:40 PDT