Subject: broadcast packets

From: "[email-masked]" <[email-masked]>
Date: Wed, 25 Sep 2002 10:33:52 +0200

Hi, 
     I'm Marco from Italy and I'm working on a security LAN project. 
I have to analyze all the hosts on my ethernet relying on their
broadcast packets.
Already exists a tool that accomplishes this task??
Where can I find a list of broadcast packets sent by all Operating
Sysyems??
Thanks,
                               Marco Antonioli

---

From: [email-masked]
Date: Wed, 25 Sep 2002 10:41:18 -0400

> I have to analyze all the hosts on my ethernet relying on their

If a tree doesn't fall in the forest, what sound doesn't it make?

(Think about it - if a machine doesn't drop a broadcast packet, or not
enough to analyze, what do you do?)

> Where can I find a list of broadcast packets sent by all Operating

A better approach would be to ask "What services use broadcast packets"
and then ask what systems implement that service.  Also, you may want to
think about the following question:

How do you distinguish between a Microsoft Windows system issuing a broadcast
packet on port 139, and a Linux system running Samba issuing the same packet
on port 139?

You might want to ask yourself exactly what you're trying to accomplish by
trying to fingerprint systems based only on broadcast packets?  What problem
will you solve by doing this? Is this just a "see if it can be done" project,
or are you really expecting to get a major gain from it? If so, what gain
are you expecting?
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: John Stracke <[email-masked]>
Date: Wed, 25 Sep 2002 11:27:51 -0400

[email-masked] wrote:

>trying to fingerprint systems based only on broadcast packets?
>  
>
Maybe he meant "broadcast" at the physical layer? I.e., he's on a hub, 
and he's sniffing the traffic.  Marco, is that what you intend?

-- 
/===============================================================\
|John Stracke      [email-masked]                      |
|Principal Engineer|http://www.centivinc.com                    |
|Centiv            |My opinions are my own.                     |
|===============================================================|
|Ea est fabula nostra, et non mutabimus eam! --House Falconguard|
|and Affiliated Scum                                            |
\===============================================================/