Re: Non compliant hosts with invalid reversed IP

If the Query Hit messages have an EQHD block, the vendor code field may
reveal which vendor has their byte order mixed up.

On 2/1/07, Philippe Verdy <[email protected]> wrote:
>
> I can see now a lot of hosts returning QueryHits with nont compliant IP
> addresses.
> This is really visible because they indicate results with IPs like:
>     *.0.0.10 instead of 10.0.0.*
>     *.*.168.192 instead of 192.168.*.*
> (these are addresses for hosts behind a router)
>
> Really, the byte order of IP addresses is reversed!
> Which servent is doing that? (I have lots of results with such addresses,
> and for this reason, I had to include these two sets of addresses in my
> hosts filter, however, it means that these servents will also reverse any IP
> address even if they are not firewalled, so there's no way to identify them
> clearly).
>
> Is there a signature that can be checked in QueryHits? Can this servent be
> corrected using a different vendor signature?
>
>
>
>
> Yahoo! Groups Links
>
>
>
>


-- 
Daniel Stutzbach, Ph.D.             President, Stutzbach Enterprises LLC


[Non-text portions of this message have been removed]