mailing list archives
Re: Req. Clarification on Stacheldraht Analysis (fwd)
From: dittrich () CAC WASHINGTON EDU (Dave Dittrich)
Date: Tue, 1 Feb 2000 15:42:01 -0800
... your analysis seems to contradict a comment appearing in your GAG
The comment indicates that GAG is a detection tool which searches for
Stacheldraht agents. Specifically it states:
"Send an ICMP_ECHOREPLY packet with ID of 668 to a stacheldraht agent,
causing it to reply to the sending host with an ICMP_ECHOREPLY packet with
an ID of 669 and the string 'sicken\n'"
Checking the source, the agent (leaf/td.c) is the one that sends the
packet with ID=669 and data="sicken\n". The ID_TEST macro is not used
in the handler (mserv.c) code, but is used in a case statement in
the agent, so the gag (and dds) program comments are correct.
$ grep 669 leaf/*.c
$ grep 668 config.h
#define ID_TEST 668 /* test of the master server */
$ grep ID_TEST mserv.c
$ grep ID_TEST leaf/*.c
leaf/td.c: case ID_TEST:
However, the analysis says 668 packets are sent FROM an agent TO a handler.
If that's true, it seems that GAG is in fact searching for handlers not
agents (or the analysis is incorrect). In fact, the analysis indicates 3
cases in which the agent is the one initiating communication with the
handler, who in turn replies with the appropriate response.
You are correct. I made a mistake in the analysis in one place.
The paragraph should (and now does) read:
There is also a code in the agent to perform an ID test, sending an
ICMP_ECHOREPLY packet with an ID field value of 669, and the string
"sicken\n" in the data field. This code is triggered if the agent
is sent an ICMP_ECHOREPLY packet with an ID field containing the value
668. The program "gag" (see Appendix A) will allow you to probe for
stacheldraht agents, which will show up with "ngrep" like this:
The other packet exchange ("skillz"/"ficken") should be able to detect
handlers, but I haven't added that to dds yet.
Thanks to Jason Barlow for pointing this out.
Dave Dittrich Client Services
dittrich () cac washington edu Computing & Communications
University of Washington
Dave Dittrich / dittrich () cac washington edu [PGP Key]</a>
PGP 6.5.1 key fingerprint:
FE 97 0C 57 08 43 F3 EB 49 A1 0C D0 8E 0C D0 BE C8 38 CC B5
- Re: Req. Clarification on Stacheldraht Analysis (fwd) Dave Dittrich (Feb 01)