default -r in tcpclient
Frank Tegtmeyer <[email protected]> 01 Sep 2002 13:33:00 +0200
| Newsgroups | gmane.org.djb.miscellaneous |
|---|---|
| Message-ID | <[email protected]> |
Hi Dan, what is the purpose of the default -r in tcpclient? I see the following reasons to make -R the default: 1. The queries will return either the owner of the daemon process or some useless information or nothing. Neither of the cases gives me or the administrator of the queried server any advantage. 2. Reverse ident queries may trigger the alarm bells at some IDS or at the administrator itself because this technique is used in fingerprinting when preparing attacks (nmap -sT -I ...) 3. It takes time to perform the query. In the case of servers dropping queries to port 113 - a common misconfiguration - it will take even more time. What do you think? Regards, Frank