Subject: npds Digest V2 #71

From: Listar <nospam_listar_at_ml.free_dot_fr>
Date: Wed, 19 Sep 2001 03:11:25 +0200 (CEST)

------------------------------------
npds Digest	Tue, 18 Sep 2001	Volume: 02  Issue: 071

In This Issue:
		[NPDS] shoo fly
		[NPDS] Re: shoo fly

----------------------------------------------------------------------

From: "Filmer, Paul E." <nospam_pfilmer_at_nsf_dot_gov>
Subject: [NPDS] shoo fly
Date: Tue, 18 Sep 2001 11:20:08 -0400

I have taken my Newt offline due to repeated attacks that generate 30 to 40
BugTrap Reports within a few minutes.

Anyone else seeing this?  Seems directed at WinNT...

I suppose I could just freeze BugTrap, but that's not the point of it all is
it?

Paul F.

------------------------------

Date: Tue, 18 Sep 2001 08:19:44 -0700
Subject: [NPDS] Re: shoo fly
From: <nospam_senorwences_at_mac_dot_com>

> I have taken my Newt offline due to repeated attacks that generate 30 to 40
> BugTrap Reports within a few minutes.
> 
> Anyone else seeing this?  Seems directed at WinNT...
> 
> I suppose I could just freeze BugTrap, but that's not the point of it all is
> it?
> 
> Paul F.

Precisely because of this type of activity I have switched my NPDS server to
using port 8080.  Is this an option with you?

Josh Burker

------------------------------

Date: Tue, 18 Sep 2001 17:29:25 +0200
From: Paul Guyot <nospam_pguyot_at_kallisys_dot_net>
Subject: [NPDS] Re: shoo fly

>Anyone else seeing this?

http://slashdot.org/articles/01/09/18/151203.shtml

>I suppose I could just freeze BugTrap, but that's not the point of it all is
>it?

I'm sorry that NPDS isn't strong enough to face those attacks.

Paul
-- 
Home page: http://www.kallisys.com/
Newton-powered WebServer: http://newt.dyndns.org:8080/

------------------------------

Subject: [NPDS] Re: shoo fly
Date: Tue, 18 Sep 2001 09:58:03 -0600
From: "Grant [Decompressing] Hutchinson" <nospam_grant_at_splorp_dot_com>

>>Anyone else seeing this?
>http://slashdot.org/articles/01/09/18/151203.shtml

I've been getting a steady trickle of Code Red hits, but nothing like 
they've been describing on /. We could be in for a worse bout of attacks 
vased on what I read on that thread.

Nice timing, eh?

>>I suppose I could just freeze BugTrap, but that's not the point
>>of it all is it?

Personally, I'd rather disable BugTrap for the time being and have a more 
stable server than go through the hassle of changing over ports again. It 
would probably be a different story if I was using a dynamic DNS service 
- then it wouldn't be as big an issue. But since I'm using a fixed static 
IP and have just started telling people about the URL, I'd hate to have 
to go back and star over again. Fortunately, this too shall pass.

>I'm sorry that NPDS isn't strong enough to face those attacks.

Paul, every day I'm happy when I realize that my Newton can run a web 
server in the first place. :)

g.

......................................................................

Grant Hutchinson                       Interface Considerations & Toys

Live video served fresh since 1996.    http://www.splorp.com/
Now fortified with daily ramblings.    http://www.splorp.com/blog/
Newton. It's the Palm with a brain.    http://www.splorp.com/newton/

------------------------------

Date: Tue, 18 Sep 2001 08:57:42 -0700
Subject: [NPDS] Re: shoo fly
From: <nospam_senorwences_at_mac_dot_com>

> 
>>> Anyone else seeing this?
>> http://slashdot.org/articles/01/09/18/151203.shtml
> 

Yeah, I just saw this too.  Just what we all need.

I've been running on port 8080 since Code Red.  It almost makes sense in the
post-Code Red days to run NPDS servers on port 8080; they are less likely to
be hit in an attack like this.  Most people are getting to the Newtons from
the trackers anyhow, so it shouldn't be too hard to redirect people to the
site on port 8080.  Here's how to configure NPDS to serve on port 8080:

To set your Newton up to serve on port 8080, go into the NPDS Setup package,
and then tap on the Security tab.  Under the TCP/IP prefs, you can set it to
port 8080.

Back in the Tracker Client leave the "Newton is in a LAN (behind a gateway)"
checked.  The Public IP address should be your IP address, without the port;
mine is 123.45.67.8 for example.  Everything else in the Tracker Client has
nothing to do with your server, per se; leave the misato or Matt's tracker
settings alone.  The ports you see in the Tracker Client refer to the ports
on the Tracker servers:  port 2110 for misato, port 80 for Matt's tracker.

HTH,

Josh Burker

------------------------------

Subject: [NPDS] Re: shoo fly
Date: Tue, 18 Sep 2001 17:34:47 -0600
From: "Grant [Decompressing] Hutchinson" <nospam_grant_at_splorp_dot_com>

In a previous message, Josh Burker typed vigorously:

>I've been running on port 8080 since Code Red.  It almost makes sense in the
>post-Code Red days to run NPDS servers on port 8080; they are less likely to
>be hit in an attack like this.  Most people are getting to the Newtons from
>the trackers anyhow, so it shouldn't be too hard to redirect people to the
>site on port 8080.

Ok, I caved in. I changed NPDS over to 8080 and things seem to be happier 
now. It's just a pain in the collective rumpus that we have to keep 
adapting and reconfiguring our own systems because Microsoft can't seem 
to keep the barn door closed.

Oh well.

g.

......................................................................

Grant Hutchinson                       Interface Considerations & Toys

Live video served fresh since 1996.    http://www.splorp.com/
Now fortified with daily ramblings.    http://www.splorp.com/blog/
Newton. It's the Palm with a brain.    http://www.splorp.com/newton/

------------------------------

End of npds Digest V2 #71
*************************