1= 00000001 Bit 0, 2^^0At 4:18 PM -0500 11/14/2002, Bill Cole wrote:At 11:01 AM -0700 11/14/02, Warren Michelsen imposed structure on a stream of electrons, yielding:OK, thanks. Question: they seem to use a different return value than other DNSBLs. They say:
Can anyone recommend a good DNSBL for open proxies and such, that might catch these, without collateral damage?opm.blitzed.org
In the combined zone (opm.blitzed.org) the A record has an IP address of 127.1.0.x where x is a bitmask of the types of proxy that have been reported to be running on the host. The values of the bitmask are as follows:
WinGate 1
Socks 2
HTTP Connect 4
Cisco 8
HTTP Post 16
Bitmask? I'm not sure I understand. Which open proxies should I be concerned about (WinGate, Socks, etc.) from the list above and what values do I place in my blacklist for each, what values are returned for each?
If I understand this bitmask thing correctly, then the list items would return values as follows:
WinGate 127.1.0.1 (1 bit of the last quad set)
Socks 127.1.0.3 (2 bits of the last quad set)
HTTP Connect 127.1.0.15 (4 bits of the last quad set)
Cisco 127.1.0.255 (all 8 bits of the last quad set)
HTTP Post ummm... (Heres where the bitmask thing doesn't seem quite right.)
Someone please 'splain "bitmask" to me in this application.
2= 00000010 Bit 1, 2^^1
4= 00000100 Bit 2, 2^^2
8= 00001000 Bit 3, 2^^3
16= 00010000 Bit 4, 2^^4
So a WinGate-only machine would be 127.1.0.1, a SOCKS-only machine would be 127.1.0.2, and a machine with both a WinGate and SOCKS proxy would be 127.1.0.3. If that machine also had HTTP-CONNECT, Cisco, and HTTP-POST proxies, the return code indicating all 5 varieties would have a last octet with all 5 bits together, 00011111, aka 31.
The 'bitmask' means that each element maps to one unique bit, so they add up cleanly and you can figure out what any number from 0-31 means by writing it out in binary (i.e. a series of bits) and looking at each place, 'masking' each place with the relevant feature.
--
Bill Cole
[EMAIL PROTECTED]
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
