iplogger Ymas problem

[antirez () SPEEDCOM IT (Salvatore Sanfilippo -antirez-)]

Re,

        tcplog is part of iplogger-1.2.

        from tcplog.c

#ifdef DETECT_BOGUS
                /* Nmap and Queso use a bogus tcp flag to "fingerprint" OS'es.. */
                if ((hdr.tcp.th_flags & TH_BOG) && last_bogus != hdr.ip.ip_src.s_addr) {
                        last_bogus = hdr.ip.ip_src.s_addr;
                        syslog(LEVEL, "bogus tcp flags set by %s (%s)",                                                 
                                hostlookup(hdr.ip.ip_src.s_addr, (syncount != SYN_FLOOD)),                              
                inet_ntoa(hdr.ip.ip_src));
                }
#endif

        but this isn't enought. Ymas (0x80) bogus flag
        must be logged.

        try hping -Y to test if your port scanning
        detector have the same problem.

        poblem noticed with ntf <emanuele () secnet dyndns org>.

        Here is the patch (but i think it's better to rewrite)

--- tcplog.c    Mon Jul 19 05:32:58 1999
+++ tcplog-new.c        Mon Jul 19 05:46:48 1999
@@ -59,6 +59,7 @@

 #ifdef DETECT_BOGUS
 #      define TH_BOGUS         0x40
+#      define TH_OTHER_BOG     0x80
 #      define TH_BOG           TH_BOGUS
 #endif

@@ -133,7 +134,7 @@

 #ifdef DETECT_BOGUS
                /* Nmap and Queso use a bogus tcp flag to "fingerprint" OS'es.. */
-               if ((hdr.tcp.th_flags & TH_BOG) && last_bogus != hdr.ip.ip_src.s_addr) {
+               if ((((hdr.tcp.th_flags & TH_BOG) || (hdr.tcp.th_flags & TH_OTHER_BOG))) && last_bogus != 
hdr.ip.ip_src.s_addr) {
                        last_bogus = hdr.ip.ip_src.s_addr;
                        syslog(LEVEL, "bogus tcp flags set by %s (%s)",                                                 
                                hostlookup(hdr.ip.ip_src.s_addr, (syncount != SYN_FLOOD)),                              
                inet_ntoa(hdr.ip.ip_src));
                }

ciao,
antirez

--
Salvatore Sanfilippo - antirez -                  antirez () alicomitalia it
try hping: http://www.kyuzz.org/antirez           antirez () speedcom it