HDTenEightyP/NetNews huggingface dataset:
From: mjr@hussar.dco.dec.com (Marcus J. Ranum)
Subject: Firewall analogies (was Re: Firewall usage)
Organization: Digital Equipment Corporation, Washington ULTRIX Resource Center
Date: Fri, 31 Jul 1992 00:05:43 GMT

>I think this analogy to a home and rooms is very poor.

	I really don't think there *IS* a particularly good analogy.

	Part of the problem is that firewalls and their implementation
is not merely a technical problem. There is a whole set of "management"
issues that usually need to be addressed. There are whole sets of CYA
issues that need to be addressed, which don't necessarily improve the
security of the network, but definitely improve the network manager's
claim to showing diligence in securing the network.

	In the consulting work I've done for DEC (setting up firewalls)
I've run across various combinations of these issues. Compared to them,
the actual details of locking things down tight are real simple. Every
time I run into these discussions, I try to come up with an analogy for
Internet security - it's pretty hard. Part of the problem is that unlike
a house, you don't always know that you've been robbed; people don't
break into your house and steal a *COPY* of your gun collection, and
vanish after shaving (or somehow magically cleaning) all the rugs to
hide their footprints. This makes the whole thing harder to understand,
especially for someone who is not used to modern networked computing.
You get strange policies like: "it must be impossible to export data
out over the network"  - never mind that a fistful of DATs is easier
to hide.

mjr.
Newsgroups: comp.protocols.tcp-ip,comp.protocols.pcnet
From: eengelke@sail.uwaterloo.ca (Erick Engelke)
Subject: Re: Clemson University Packet Driver: I have one problem B-(.
Organization: University of Waterloo
Date: Tue, 28 Jul 1992 02:28:42 GMT

 saty@ntc.togliatti.su writes:

>>I write some application ( TSR type ) based on Packet Driver
>>( Clemson University Engineering Comp Ops Version 9) and I have
>>one tragic problem. I can not send ethernet packets while
>>my receive handle works. How can I do it correctly?

The 'preferred' solution is to not send the packet during the upcall
but to schedule it for later. 

If you find 23 ms average delay acceptable, you can just transmit on
the next timer tick.  

If you want faster response, use the packet driver GET_INFO function
to ask the driver which hardware interrupt it generates.  Then chain
to that interrupt so it looks like this:

	pushf
	call dword  old_irq_handler	; will be the packet driver
	; now safe for us to do things
	jmp our_post_irq_handler

This will invoke your routine immediately after the packet driver
is done processing the interrupt, and you will have extremely small
delays between receipt of packets and your reply.


Erick
-- 
Erick Engelke					  Engineering Computing
						 University of Waterloo
Waterloo TCP Architect		 erick@development.watstar.uwaterloo.ca
From: kearns@actcon.canton.oh.us (Steve Kearns)
Newsgroups: comp.protocols.tcp-ip
Subject: rwho core dumping under SCO UNIX
Keywords: SCO, rwho, TCP/IP
Date: 22 Jul 92 21:06:05 GMT
Organization: A.C.T. Consulting, Inc.

My rwhod process is core dumping on a freshly installed system.  I'm
running SCO UNIX 3.2.4 and TCP/IP 1.1.3f.  TCP/IP is started on boot up;
all of my daemons start up normally.  However, for no apparent reason 
(at least to me), after about 10 minutes, the rwhod core dumps in the
/usr/spool/rwho directory.  This occurs with no TCP/IP traffic whatsoever;
there are no other servers and no workstations active. 

Any ideas?  Thanks for any help.

steve
-- 
Steve Kearns              A.C.T. Consulting, Inc.                  216-455-1444

Internet: kearns@actcon.canton.oh.us                
UUCP    : uunet!aablue!redpoll!mrsmouse!actcon!kearns
Newsgroups: comp.protocols.tcp-ip,comp.dcom.lans
From: miller@tgv.com (Vagrant)
Subject: Re: SLIP over a TELNET Link?
Reply-To: miller@tgv.com
Organization: TGV Incorporated in Santa Cruz, CA
Date: Wed, 29 Jul 1992 22:23:19 GMT


In article <1992Jul24.142554.12716@emr1.emr.ca>, fillmore@emr1.emr.ca (Bob Fillmore 992-2832) writes:
#
#In article <CKD.92Jul20140814@loiosh.eff.org> ckd@eff.org (Christopher Davis) writes:
#>David> == David Barr <barr@darwin.psu.edu> 
#>
#> David> And I thought it was sick when the College of Engineering
#> David> decided to use DECNET to encapsulate IP packets so they could
#> David> have one virtual ethernet spanning buildings.  (It was
#> David> apparently the only solution.  I still can't believe it)
#>
#>Sickest of all was the "proposal" to put IP packets in MIME-format
#>multimedia messages.  That gives you IP over UUCP, even over a
#>multiple-hop UUCP path.
#>
#
#How about IP-over-SLIP-over-DECNETsethost-over-X.25?
#Somebody here is actually using that in a production network!

I once set up an IP-over-X.25-over-DECNET-over-IP link.  The X.25
router was located in Melbourne and we are in Santa Cruz, California.
Round-trip-time was something like 2 seconds on a good day.  Sometimes
it took up to three minutes.  I would have been faster to call up
and have someone read the datagram to you.

Currently we are working on IP-over-email using the MIME standard.
Thank god for the slow-start algorithm.  The thing should be useable
with batch FTP.  Telnet's right out.  The three-way handshake is a
royal pain.  This is defintely a back-burner project.

-bruce

Newsgroups: comp.protocols.tcp-ip,comp.protocols.pcnet
From: saty@ntc.togliatti.su (Sergey A. TsYbanov)
Subject: Clemson University Packet Driver: I have one problem B-(.
Reply-To: saty@ntc.togliatti.su
Organization: AutoVAZ Research & Development Centre
Date: Wed, 22 Jul 92 14:39:20 +0400

Hi !

I write some application ( TSR type ) based on Packet Driver
( Clemson University Engineering Comp Ops Version 9) and I have
one tragic problem. I can not send ethernet packets while
my receive handle works. How can I do it correctly?
My ethernet card is 3C505.
Thanx.

! iH




-- 
 ******************* Is There Anybody Out There ? **********************
 *                   SATY ( Sergey A. TsYbanov ).                      *
 *  E-mail : saty@ntc.togliatti.su Phone : number +7 (8482) 378-17-53. *
 ***********************************************************************



Newsgroups: comp.protocols.tcp-ip
From: reece@eco.twg.com (Reece R. Pollack)
Subject: Re: Decnet Packets over Sun Router ??
Reply-To: reece@eco.twg.com (Reece R. Pollack)
Organization: The Wollongong Group (East Coast Operations)
Distribution: world,local
Date: Thu, 23 Jul 92 19:38:24 GMT


In article <1992Jul22.200123.3530@arizona.edu>, leonard@telcom.arizona.edu 
|>| In article <1992Jul20.151114.9155@ee.eng.ohio-state.edu>, redmill@ee.eng.ohio-state.edu (Keith A.
|>| Redmill) writes:
|>| |> I have a Sun 4 (IPC) with two ethernet cards running as a router for
|>| |> a small subnet.  I would like to install some vax stations under this
|>| |> subnet but Decnet packets don't seem to make it through the sun routed
|>| |> software.  
|>| |> 
|>| |> Can this be done??
|>There's one more solution which we use here in similar situations:
|>if the VAXen are running MultiNet, then just set up MultiNet to 
|>encapsulate DECnet IV in TCP/IP.  (You also need a friendly 
|>VAX on the backboneward side of the Sun to pull the DECnet
|>out of the TCP/IP packets and route them onward to the
|>rest of your DECnet.)  A fast, reliable, cheap solution (assuming
|>you've already got MultiNet!)

Or WIN/TCP. The next release (called Pathway for VMS V1.0; don't ask why)
also supports DECnet over IP.

--
Reece R. Pollack
Senior Software Engineer
The Wollongong Group, Inc.
Newsgroups: comp.protocols.tcp-ip,comp.dcom.lans
From: ravi@mercury.uucp (Ravindra P Nirgudkar)
Subject: Re: SLIP over a TELNET Link?
Organization: Electrical Engineering Dept. Mississippi State University
Date: Sat, 25 Jul 1992 14:46:31 GMT

In article <CKD.92Jul20140814@loiosh.eff.org> ckd@eff.org (Christopher Davis) writes:
>David> == David Barr <barr@darwin.psu.edu> 
>
> David> And I thought it was sick when the College of Engineering
> David> decided to use DECNET to encapsulate IP packets so they could
> David> have one virtual ethernet spanning buildings.  (It was
> David> apparently the only solution.  I still can't believe it)
>
>Sickest of all was the "proposal" to put IP packets in MIME-format
>multimedia messages.  That gives you IP over UUCP, even over a
>multiple-hop UUCP path.
>
>(You definitely have to tweak the retransmit timers though :-)
>--
>Christopher Davis * ckd@eff.org * System Administrator, EFF * +1 617 864 0665
>   ``The First Amendment is often inconvenient.  But that is besides the
>  point.  Inconvenience does not absolve the government of its obligation
>         to tolerate speech.'' --Justice Anthony Kennedy, in 91-155


Hello Netters,

I am Ravi Nirgudkar, a graduate student in Electrical Engg. at Mississippi
State Univ. I would like to have information on following terms.

(1) F.L.D.I. Fiber Line Distributed Interface.

(2) Dual F.D.D.I.

I will appreciate, if any of you can send me references, where I can get more information.

Thanks

Ravi
P.S. Please send me the mail at ravi@ee.msstate.edu
Newsgroups: comp.protocols.tcp-ip
From: drw@euclid.mit.edu (Dale R. Worley)
Subject: Re: Firewall usage (was: Re: ping works, but ftp/telnet get "no route)
Organization: MIT Dept. of Tetrapilotomy, Cambridge, MA, USA
	<DRW.92Jul27143657@jordan.mit.edu> <17011@ulysses.att.com>
Date: Thu, 30 Jul 1992 20:34:27 GMT

In article <17011@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
   About all I can say is that the outside port number in one
   direction is 513, and the inside port number is something less than
   1024.  But when such a packet floats by, the router has no way of
   knowing that that's really rlogin.  The *real* definition is that
   the connection was initiated from the inside.  Otherwise, the
   packet could be from a connection initiated *from* port 513 on a
   dedicated attacker's machine, and to some service on an inside
   machine.  But routers don't keep track of connections, they look at
   individual packets.

I haven't studied the matter, but I believe that the more
sophisticated firewalling routers actually *do* track connections.  At
least, I've heard claims about what some routers could do that I
couldn't figure out how to do without tracking connections.

Dale Worley		Dept. of Math., MIT		drw@math.mit.edu
--
Anything that's not nailed down is mine.  Anything I can pry loose is not
nailed down.
Newsgroups: comp.protocols.tcp-ip
From: beame@maccs.dcss.mcmaster.ca (Carl Beame)
Subject: Re: Stopping only incoming TCP connections (was: Firewall usage)
Organization: McMaster University, Hamilton, Ontario, Canada.
Date: Fri, 31 Jul 1992 00:11:41 GMT

In article <chrisc.21.712446813@ramrod.lmt.mn.org> chrisc@ramrod.lmt.mn.org (Chris Cox) writes:
>In article <1992Jul28.202211.14029@shearson.com> pmetzger@snark.shearson.com (Perry E. Metzger) writes:
>
>>I was under the impression that if you filter all the SYN packets from
>>one direction that aren't SYN ACKs, bingo, you can't initiate any
>>incoming TCP connections.  Nice and stateless. The only flaw is that
>>implementations that seperately ACK the initiating SYN and then send
>>their own SYN won't be able to connect, but they are rare. Connections
>
>That would eliminate your users from starting ftp data sessions (wouldn't 
>it?).
>

	If your Firewall stopped all remote TCP packets with SYNs which are
for ports < 1024 except Domainname and SMTP, you could still FTP out and
receive mail and possibly domainname requests. For UDP you might want
to inhibit port 111 (portnampper) and 2049 (nfs) and possibly TFTP. 

	A properly configured Firewall Router can allow access from the
local net onto the Internet and even allow Internet access to specific
services or servers on the local net. For Example: If you want to provide 
anonymous FTP from a single host on your local net, just configure the 
router to pass FTP SYN requests only to the specific host.

- Carl Beame
Beame & Whiteside Software Ltd.

P.S: I don't know of any comercial router which can do all this, but public
domain ones could be modified.

Newsgroups: comp.protocols.tcp-ip
From: hak@alf.cooper.edu (Jeff Hakner)
Subject: Re: ATT 3B2 Hop Counter
Organization: The Cooper Union ( NY, NY )
Date: Thu, 30 Jul 1992 01:46:14 GMT

in article <1992Jul28.154342.17716@eco.twg.com>, reece@eco.twg.com (Reece R. Pollack) says:
> Sender: reece@crash.eco.twg.com (Reece R. Pollack)
> Nntp-Posting-Host: eco.twg.com
> Reply-To: reece@eco.twg.com (Reece R. Pollack)
> Organization: The Wollongong Group (East Coast Operations)
> References:  <1992Jul27.161124.17031@wdl.loral.com>
> Date: Tue, 28 Jul 92 15:43:42 GMT
> Lines: 23
> 
> 
> In article <1992Jul27.161124.17031@wdl.loral.com>, wrl@wdl1.wdl.loral.com (Bill Lewandowski) writes:
> |>We have a user with a ATT 3B2 computer. We think we have a problem
> |>with data packets taking more than 16 hops through the NSFNET
> |>T3 network and the MILNET and the 3B2 is ignoring them because >16.
> |>
> |>Anyone know how I can increase the hops to a normal 32 or so.
> |>
> |>I don't have the computer here so I can't read any manuals so
> |>any help is really appreciated.
> 
> In the system IP configuration file '/etc/master.d/ip' there is a
> definition:
> 
> 	IP_TTL = 0xf
> 
> Change this to whatever hexadecimal value you deem neccesary and
> reboot using '/etc/system' to rebuild the kernel.

You also need to run mkboot.  I suggest this procedure:

1) cp /unix /unix.sav   #or some other meaningful name
2) edit /etc/master.d/ip
3) mkboot /boot/IP
4) shutdown -i5 -g0 -y
5) when you reach firmware mode, enter the firmware password
6) when asked which program to run, type /etc/system
7) hit return for the device number prompt
8) The system will come up.  A new /unix will be generated.
From: timb@ksgbbs.harvard.edu (Tim Buehrer - 625-6829)
Newsgroups: comp.protocols.tcp-ip
Subject: Problems with c-kermit telnet, right place to post?
Summary: c-kermit sends a return-linefeed rather than a line feed, how to fix?
Keywords: c-kermit telnet return
Date: 22 Jul 92 03:23:56 GMT
Organization: Kennedy School of Government, Harvard, Cambridge


I hope that this is a good place to post this question.  If it is not, I would
appreciate suggestions on where it should go.

We are setting up a system to communicate between our SCO XENIX box and a PC
using c-kermit on the PC and the WATTCP telnetd on the PC.  Most parts are
working fine, but there is one fundamental problem.  c-kermit insists on send-
ing a return-linefeed combination when I type a return, even if the terminal
setting for return-linefeed is off.  (When I just use the telnet that came
from SCO, I don't have this problem.)  Is there a way to configure c-kermit to
avoid this problem?  I've tried using set key but that doesn't seem to help.

Tim Buehrer
timb@ksgbbs.harvard.edu
From: ckd@eff.org (Christopher Davis)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: SMTP mail
Date: 29 Jul 92 17:32:35 GMT
Organization: Electronic Frontier Foundation Tech Central

Karl> == Karl Keyte <KKEYTE@ESOC.BITNET>

 Karl> The SMTP has recently been removed at our site because of its
 Karl> well-known security hole.

 Karl> Does anyone have a mail protocol (IP based) which allows you to
 Karl> integrate many different systems?  We have Suns, PCs, VAXes, IBM
 Karl> mainframes, all running TCP/IP.

This is rather silly, since you have single-user machines; IP isn't
going to be secure anyway, unless you have something fairly strong for
authentication/encryption (Kerberos or the like).  SMTP mail can be
forged; there are some measures to detect (not prevent) forgeries, and
(eventually) there will be PEM.  Until then, teach people to be wary,
and take sociopolitical sanctions against people you catch forging
email.

Technical solutions to political problems are generally not solutions...
--
Christopher Davis * ckd@eff.org * System Administrator, EFF * +1 617 864 0665
   ``The First Amendment is often inconvenient.  But that is besides the
  point.  Inconvenience does not absolve the government of its obligation
         to tolerate speech.'' --Justice Anthony Kennedy, in 91-155
From: leonard@telcom.arizona.edu (Aaron Leonard)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: Decnet Packets over Sun Router ??
Date: 23 Jul 92 03:01:22 GMT
Reply-To: Leonard@Arizona.EDU
Distribution: world,local
Organization: University of Arizona Telecommunications

In article <1992Jul22.203200.28669@tridom.com>, mwr@tridom.uucp (Mark Reardon) writes:
| In article <1992Jul20.151114.9155@ee.eng.ohio-state.edu>, redmill@ee.eng.ohio-state.edu (Keith A.
| Redmill) writes:
| |> I have a Sun 4 (IPC) with two ethernet cards running as a router for
| |> a small subnet.  I would like to install some vax stations under this
| |> subnet but Decnet packets don't seem to make it through the sun routed
| |> software.  
| |> 
| |> Can this be done??
| 
| The vaxes are running either Decnet IV or the new OSI based Decnet.
| in either case, the Suns won't handle it without some new software.
| The Sun handles IP and that is it.  The four solutions are :
| 
| 1. Upgrade the vaxes to use tcp/ip.
| 2. Upgrade the Sun to route the correct Decnet.
| 3. Replace the Sun with either a bridge or router to handle all 
|    protocols.
| 4. Place a bridge or router in parallel with the sun and have it
|    handle all non IP traffic.

There's one more solution which we use here in similar situations:
if the VAXen are running MultiNet, then just set up MultiNet to 
encapsulate DECnet IV in TCP/IP.  (You also need a friendly 
VAX on the backboneward side of the Sun to pull the DECnet
out of the TCP/IP packets and route them onward to the
rest of your DECnet.)  A fast, reliable, cheap solution (assuming
you've already got MultiNet!)

Aaron

Aaron Leonard (AL104), <Leonard@Arizona.EDU>
University of Arizona Network Operations, Tucson AZ 85721
|>   If it ain't broke, break it.
From: nelson@crynwr.com (Russell Nelson)
Newsgroups: comp.protocols.tcp-ip
Subject: Clemson University Packet Driver: I have one problem B-(. 
Distribution: world
Date: Tue, 28 Jul 92 03:32:16 GMT
Organization: Crynwr Software

In article <AJOhJRg8RQ@ntc.togliatti.su> saty@ntc.togliatti.su writes:

SATY, mail to your return address above bounces.  I suspect that your
site is lacking a MX record for the Internet at large.  I have seen
this before for .su sites.

   I write some application ( TSR type ) based on Packet Driver
   ( Clemson University Engineering Comp Ops Version 9) and I have

You probably mean "Clarkson University", but even that is wrong
because Crynwr Software has purchased the copyright on the packet
driver skeleton.  The code remains freely copyable.

   one tragic problem. I can not send ethernet packets while
   my receive handle works. How can I do it correctly?

Please rephrase this and email it to me (I will summarize if anyone asks).
Your question is ambiguous that I can't tell what problem you're having.

   My ethernet card is 3C505.

Hmmm...  Be advised that the packet driver for that card is rather slow.

-russ <nelson@crynwr.com>  I'm proud to be a humble Quaker!
Crynwr Software            Crynwr Software sells packet driver support.
11 Grant St.               315-268-1925 Voice   [ if mail bounces, forward it ]
Potsdam, NY 13676          315-268-9201 FAX     [ to uuadmin@uu.psi.com.      ]
From: donp@novell.com (don provan)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: Firewall usage (was: Re: ping works, but ftp/telnet get "no route)
Date: 25 Jul 92 08:34:28 GMT
Organization: Novell, Inc., San Jose, California

In article <1992Jul24.203544.28491@watson.ibm.com> nrt@watson.ibm.com (Nicholas R. Trio) writes:
>The problems are (1) the "front doors" to the computers just aren't strong
>enough and (2) even if they were, it's possible to get copies of the
>"keys" (passwords, etc.) by sniffing the network.

Call me a Capitalist Pig, but no matter how strong my front door is
and no matter how well protected i keep my keys, i still consider my
front yard private property and i might put up a fence to keep people
away from my house.
						don provan
						donp@novell.com
Newsgroups: comp.protocols.tcp-ip
From: rickert@mp.cs.niu.edu (Neil Rickert)
Subject: Re: SMTP mail
Organization: Northern Illinois University
Date: Wed, 29 Jul 1992 02:15:34 GMT

In article <92209.190519KKEYTE@ESOC.BITNET> Karl Keyte <KKEYTE@ESOC.BITNET> writes:
>
>The SMTP has recently been removed at our site because of its well-known
>security hole.

  Would you like to enlighten us as to the nature of this "well known
security hole".

  It is well known that email can be forged.  Most people don't consider
this a security problem, although it may present an identification
problem.  If you consider email forgery a security hole, then I presume
you have also shut off all paper mail, which can just as easily be
forged.

Newsgroups: comp.protocols.tcp-ip
From: jeff@is.s.u-tokyo.ac.jp (Jeff McAffer)
Subject: Help?
Reply-To: jeff@is.s.u-tokyo.ac.jp
Organization: Dept. of Infomation Science, University of Tokyo.
Distribution: comp
Date: Tue, 21 Jul 1992 11:27:12 GMT


I am trying to write what amounts to a really simple telnet (in C) and
cannot seem to get it working.  I have some old rlogin code I found
and some code in another language that does exactly what I want.
Unfortunately I have to do it in C.  I know it is really easy and that
is why I am frustrated.

Here's what I have: Following the Sun doc (net programming guide page
265) 

- get a socket, 
{- bind the socket using INADDR_ANY and port 0}
- setup an address structure with port 23 and the host's info from
	gethostbyname.
- call connect using the above mentioned address structure.

So far so good.  Note that as per the example I did not bind since
that will be done for me by the local machine?  I put the {} there
because I tried this with that step in and it made no difference.

So now that I have a connection?  (it didn't complain), I fork a
reader and writer task.  The writer repsonds to my key presses and
claims to have written successfully.  The reader ALWAYS immediately
reports 3 characters whose values when printed at integers are -1, -3
and 24.  That is all I ever hear from the reader.  I would have
expected that the getty on the receiving end would say something.  Are
these chars some sort of handshake that I have to respond to?  What is
the response?

All I want to do is pass, *completely* unprocessed characters from
standard in to the socket stream and from the socket stream to stdout.
I would really appreciate any help or code :-) you can give me.

Thanks for reading this.

--
ja mata, |m       -- Silence and stillness were everywhere except his head.
                     Sweat dripped and "I'd rather be drinking a beer",
                     roared as he contemplated the remaining threads.      #2
From: tmd@s1.gov (Tina M. Darmohray)
Newsgroups: comp.protocols.tcp-ip
Subject: traceroute
Date: 27 Jul 92 16:21:34 GMT
Organization: Lawrence Livermore National Lab
Originator: tmd@s1.gov


Where can I get the latest version of traceroute?  Will it involve kernel
mods?  (I'm interested in suns, sgis, Dec Ultrix).  Thanks in advance,

	Tina
	tmd@s1.gov
From: G.Pavlou@cs.ucl.ac.uk (George Pavlou)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: The Protocol
Date: 29 Jul 92 15:10:14 GMT


> Evolution dictates:
> SGMP (simple gateway management protocol)
> SNMP (simple network management protocol)
> SMP (simple management protocol)
> SP (simple protocol)
> P (protocol)
>
> but then what?

Then you realise all these evolutions were only simple with regard to their
name: complexity was added in each evolution cycle as is definitely the case
with the SGMP -> SNMP -> SMP transition.

So you start from CMIP which is where you are aiming at even if you don't want
to admit and add complexity accordingly:

CMIP (complex management information protocol)
(O)CMIP ((overly) complex management information protocol)
...


George
Newsgroups: comp.protocols.tcp-ip