I've pinged IP addrs that I later found out were MIL addrs. Nothing happened. Duh! There are a LOT of IP addrs that aren't in the DNS. How is one to know? I don't know about you, but I flunked telepathy in High School and did worse in clarvoyance. In fact, psionics wasn't wasn't something I was generally good at. That's why I went into engineering. Could it be, that is why ping and traceroute were invented? The argument against port-scanning applies equally well to just about every diagnostic tool we use. Be careful what you wish for, we might all get stuck with it. Then, where would we be?
-----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Tuesday, December 19, 2000 11:46 AM To: Shawn McMahon Cc: 'nanog@merit.edu' Subject: Re: Port scanning legal
On Tue, 19 Dec 2000, Shawn McMahon wrote:
Better lock me up; I can't count the number of times I've nmap-ed somebody just to find out what OS they were using, either for personal curiosity, or as part of an argument.
Cool. Since you're obviously in the right, how about scanning some U.S. military networks and letting us all know what OS they are using?
If you like, I'll start an argument with you so you have the justification you need to portscan.
-Dan
On Tue, 19 Dec 2000, Roeland Meyer wrote:
I've pinged IP addrs that I later found out were MIL addrs. Nothing happened. Duh!
Cool. Care to portscan a couple .mil /16's and get back to me?
There are a LOT of IP addrs that aren't in the DNS. How is one to know?
Hmm. whois perhaps? connecting to whois.arin.net [192.149.252.21:43] ... HQ 7th Signal Command (NETBLK-ARMY-C) NETBLK-ARMY-C198.49.183.0 - 198.49.192.0 INFORMATION SYSTEMS COMMAND (NET-NSMCNET) NSMCNET198.49.185.0 - 198.49.185.255 Naah, that makes too much sense. Can't have that now can we.
I don't know about you, but I flunked telepathy in High School and did worse in clarvoyance.
One might argue its not the only thing you flunked.
Could it be, that is why ping and traceroute were invented?
ping and traceroute are a far cry from nmap. I dont recall ping and traceroute having a 'decoy host' option, or 'stealth' option for example, nor any option to scan entire nets and ranges of ports.
The argument against port-scanning applies equally well to just about every diagnostic tool we use.
Only by the most convoluted thinking. -Dan
On Tue, 19 Dec 2000, Dan Hollis wrote:
On Tue, 19 Dec 2000, Roeland Meyer wrote:
I've pinged IP addrs that I later found out were MIL addrs. Nothing happened. Duh!
Cool. Care to portscan a couple .mil /16's and get back to me?
Dan is apparently suggesting that scanning *an* IP and scanning a /16 worth of IP's are one and the same action... -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH
On Tue, 19 Dec 2000, Steven J. Sobol wrote:
Dan is apparently suggesting that scanning *an* IP and scanning a /16 worth of IP's are one and the same action...
I suspect we've wandered from the point somewhat. The original discussion arose from a report of an individual landing himself in court as a result of scanning a network which housed (at the very minimum) a 911 center and a police department. I may be the only person to see scanning "a network" as being somewhat similar to scanning "a /16 worth of IP's" (it's merely a matter of scale, after all) when compared with scanning one IP alone, but I doubt it. Let's get this in perspective. Person connects machine to network, in the full knowledge that said network involves a police department, a 911 call center, and machines which are in some way related to local and/or state government. Portscan that lot, and if you're surprised that you start to attract some heat then you have to be asking for trouble. The comparison with scanning a /16 MIL network is, while something of an exaggeration, a reasonable comparison (IMNSHO). Either way, does it really warrant quite such a vociferous discussion? -- Patrick Evans - Net bloke, indie kid and lemonade drinker pre at pre dot org www dot pre dot org
I suspect we've wandered from the point somewhat.
a little.
The original discussion arose from a report of an individual landing himself in court as a result of scanning a network which housed (at the very minimum) a 911 center and a police department.
my read of it, in brief was like this: some dude was working for 911 at the task of adding a line between 911 and the police dept (easy work). concerned about security, he scanned the network where the 911 systems were and happened to hit upon another company's machine (imho, completely understandable). why this went to court is beyond me. this *ought*, imho, to have been tackled with a few phone calls between, say, the head of the 911 stuff, perhaps someone from the police dept, someone from the county (to vouch for the guy), and someone from the "other company". this court stuff is silly. -- |-----< "CODE WARRIOR" >-----| codewarrior@daemon.org * "ah! i see you have the internet twofsonet@graffiti.com (Andrew Brown) that goes *ping*!" andrew@crossbar.com * "information is power -- share the wealth."
participants (5)
-
Andrew Brown -
Dan Hollis -
Patrick Evans -
Roeland Meyer -
Steven J. Sobol