lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <200403090842.13605.troy.coulombe@pwi.com> From: troy.coulombe at pwi.com (TroyC) Subject: Comcast using IPS to protect the Internet from their home user clients? Yep noticed very similar things as well during scanning. At the time I thought it might be due to the time of day or such. I also noticed another behavior::: Different IP blocks based [seemingly] upon OS. My netgear rtr/ap gets a 24.x.x.x, however, my debian fw gets a 64.x.x.x adder... I spun up a different linux box and rcvd 64.x.x.x while a win2k vmware session on that same linux box rcvd a 24.x.x.x ::: seems to be picking something up on the dhcp requests... ps::: I may have the adders ass-backwards the linux boxes might have gotten 64.x.x.x TroyC On Monday 08 March 2004 18:28, Frank Knobbe wrote: > This post should probably have gone to SF-PenTests, but since it is more > of a discussion item, I thought about Full Disclosure, the list for vuln > info and everything else :) > > > Anyhow, I noticed that certain vulnerability scans, for example scans > using Nikto and similar tools, when run from a Comcast address show a > different behavior than when they are run from a clear, uncontrolled > Internet connection (i.e. corporate T-3). In fact, it appears like > Comcast has an Inline-IDS (some call it an IPS ;) sitting on its wires, > filtering out certain signatures and blocking subsequent access for a > short period of time. For example, scan progresses, then hangs > inexplicably, then resumes, trips a sig, and hangs again. At the same > time, the same scan from a non-Comcast address continues without any > hick-ups. Targets have been ruled out (up and running, verified at the > same time from different addresses), and connectivity to the rest of the > net remains. It's looks like just the src-dst address pair is used so > that all connections from a Comcast src to that particular dst are > blocked for a short moment (1-5 minutes). > > Has anyone else noticed that? Is Comcast actually attempting to keep all > those worms'n'viruses of their clients away from the Internet? > > How many other ISP's are known to use IPS's inline to protect themselves > from the 'Net, or protect the 'Net from themselves? > > Regards, > Frank (routing all scans via VPN through corporate hosts ;)
Powered by blists - more mailing lists