On Tue, 11 Dec 2001, Mihai RUSU wrote:
> primesc de la kernel tot felul de mesaje de genul:
> TCP: Treason uncloaked! Peer 213.233.73.159:8581/80 shrinks window
> 2661896986:2661898058. Repaired.
> TCP: Treason uncloaked! Peer 213.233.73.159:8581/80 shrinks window
> 2661896986:2661898058. Repaired.
> TCP: Treason uncloaked! Peer 213.233.73.159:8581/80 shrinks window
> 2661896986:2661898058. Repaired.
> TCP: Treason uncloaked! Peer 213.233.73.159:8581/80 shrinks window
> 2661896986:2661898058. Repaired.
>
> banuiesc ca pot sa le ignor dar sunt curios exact care-i faza. stie careva
> ?
Aparent, mesajul nu e generat decat daca window-ul aluia este 0.
Probabil esti scanat cu vre-o jucarie care face pachetele de mana si nu se
deranjeaza sa trimita toate campurile valide.
Tot mai primesti mesajele? Ce zice tcpdump?
Totusi, un astfel de scanner nu prea ar functiona, pentru ca:
--cut--
/* Catch exceptional cases, when connection requires
reset.
* 1. Last segment was sent recently. */
if ((s32)(tcp_time_stamp - tp->lsndtime) <=
TCP_TIMEWAIT_LEN ||
/* 2. Window is closed. */
(!tp->snd_wnd && !tp->packets_out))
do_reset = 1;
if (do_reset)
tcp_send_active_reset(sk, GFP_ATOMIC);
--cut--
..deci trimite RST daca window=0.
"I may be wrong, though..."
Tu stii de vre-o problema cu pachetele cu win=0 ? (le-a incercat cineva pe
windoaze? ;))
-- sekure at gmx dot co dot uk
.include 'send pgp key' in the subject to get my pgp key
"There is a penguin sitting on the top left corner of my monitor...
He's watching you!"
---
Send e-mail to '[EMAIL PROTECTED]' with 'unsubscribe rlug' to
unsubscribe from this list.
