default -r in tcpclient

Frank Tegtmeyer <[email protected]> 01 Sep 2002 13:33:00 +0200
Newsgroups gmane.org.djb.miscellaneous
Message-ID <[email protected]>
Hi Dan,

what is the purpose of the default -r in tcpclient?

I see the following reasons to make -R the default:

1. The queries will return either the owner of the daemon process or
   some useless information or nothing. Neither of the cases gives me
   or the administrator of the queried server any advantage.
2. Reverse ident queries may trigger the alarm bells at some IDS or at
   the administrator itself because this technique is used in
   fingerprinting when preparing attacks (nmap -sT -I ...)
3. It takes time to perform the query. In the case of servers dropping
   queries to port 113 - a common misconfiguration - it will take even
   more time.

What do you think?

Regards, Frank