VanLUG Email Archive

Traduisez - Übersetzen - Traduzca - Traduza - Tradurre - Translate

VanLUG Mailing List
Re: Portscan of 00-20-78-d0-db-48.bconnected.net

Andrew Daviel (andrew@andrew.triumf.ca)
Sat, 20 Jan 2001 00:18:42 -0800 (PST)

• Next message: Derek Kranefeld: "In lew of a backup :("
• Previous message: Yakov N Miles: "nmap -sU an.ip.add.ress from "root""

On Fri, 19 Jan 2001, Derek Kranefeld wrote:

> Not bad uptime :) I guess if I what to explore further I'll have to start
> reading "Managing Internetworks with SNMP" so I'll know just what the heck
> I'm suppose to do :)

snmpwalk 209.53.44.25 public
.iso.3.6.1.2.1.1.1.0 = "BEFSR81"
.iso.3.6.1.2.1.1.2.0 = OID: .iso.3.6.1.4.1.3955.1.1
.iso.3.6.1.2.1.1.3.0 = Timeticks: (81029011) 9 days, 9:04:50.11
.iso.3.6.1.2.1.1.4.0 = "Linksys"
.iso.3.6.1.2.1.1.5.0 = "none" Hex: 6E 6F 6E 65
.iso.3.6.1.2.1.1.6.0 = "-" Hex: 2D
.iso.3.6.1.2.1.2.2.1.2.1 = "LAN Interface"
.iso.3.6.1.2.1.2.2.1.2.2 = "WAN Interface"
.iso.3.6.1.2.1.2.2.1.5.1 = Gauge: 10000000
.iso.3.6.1.2.1.2.2.1.5.2 = Gauge: 10000000
.iso.3.6.1.2.1.2.2.1.6.1 = Hex: 00 20 78 D0 DB 47
.iso.3.6.1.2.1.2.2.1.6.2 = Hex: 00 20 78 D0 DB 48
   I have some doc. suggesting that 002078 is a Runtop, Inc. MAC address
.iso.3.6.1.2.1.2.2.1.9.1 = Timeticks: (101) 0:00:01.01
.iso.3.6.1.2.1.2.2.1.9.2 = Timeticks: (103) 0:00:01.03
.iso.3.6.1.2.1.2.2.1.10.1 = 15779863
.iso.3.6.1.2.1.2.2.1.10.2 = 49700834
.iso.3.6.1.2.1.2.2.1.11.1 = 123056
.iso.3.6.1.2.1.2.2.1.11.2 = 202236
  I think these are the packet counts on the internal and external
  interfaces
.iso.3.6.1.2.1.2.2.1.21.1 = Gauge: 0
.iso.3.6.1.2.1.2.2.1.21.2 = Gauge: 0
.iso.3.6.1.2.1.2.2.1.22.1 = OID: .ccitt.0.0
.iso.3.6.1.2.1.2.2.1.22.2 = OID: .ccitt.0.0
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.1 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.2 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.3 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.4 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.5 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.6 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.7 = 1
.iso.3.6.1.2.1.3.1.1.1.0.192.168.1.8 = 1
  I think these are the ip addresses on your internal network.

SNMP is a good thing to block. On Digital Unix it gives away tons of stuff
- addresses of all connected machines, names of mounted filesystems,
device names for disks, lists of running processes, system version number.
Linux SNMP is not turned on by default, fortunately, and if enabled does
not give away much - system name, owner and location as I recall - unless
more features are turned on.
Many things like network printers, etc. use SNMP and will tell you
addresses of connected machines, hinting at trust relationships.
Common suggestions are to rename "public" to something else - not
"private" or "yourorgname".

Andrew

--
This message came to you via the Vancouver Linux Users Group mailing list.
For unsubscription instructions do not email the list, but rather send mail
to <vanlug-request@gweep.bc.ca>.

• Next message: Derek Kranefeld: "In lew of a backup :("
• Previous message: Yakov N Miles: "nmap -sU an.ip.add.ress from "root""