News Group Posts

SNMP

From: Jeff Liebermann <jeffl@comix.santa-cruz.ca.us>
Newsgroups: comp.unix.sco.misc
Subject: Re: Routing Problem
Date: Mon, 17 Jan 2000 12:50:40 -0800
Message-ID: <2ct68s4mmaf8skdlrcifvhdqo9ia8vnvpq@4ax.com> 
References: <t3Hg4.8061$pb2.805627@tw11.nn.bcandid.com>
<JRHg4.8216$pb2.813863@tw11.nn.bcandid.com> 

On Mon, 17 Jan 2000 16:57:14 GMT, Rich Walker <rich@spam.not> wrote:

>A bit more info:
>
># ifconfig net0
>net0: flags=4043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>        inet 209.61.22.94 netmask ffffff00 broadcast 209.61.22.255
>        perf. params: recv size: 24576; send size: 24576; full-size
>frames: 1
>        ether 00:60:08:cd:c7:eb

Cool.  This is almost as good as a detective story.
It tells me that 00:60:08 is 3com 3C905TX card.  See:
        http://cs.okidata.com/mantr320.nsf/Contents?OpenView
for how I did that trick.

NS lookup tells me that 209.61.22.94 is pingable and sitting on tiac.net.
Reverse DNS says nobody listed.  Traceroute shows that it's in Hartford
Connecticut.  I can ping it so I guess it's working.  Oh, you already said
that in your original posting.  You really should not post customers IP's
and system names.

whois at ARIN for the net block shows:
Financial Datacorp (NETBLK-TIAC-FDATA) TIAC-FDATA
    209.61.22.64 - 209.61.22.95
I don't think they'll be too happy with either of us if I try to break in.
However, I'm bored and need some entertainment.

Firing up SNMP shows that your system name is scosysv.UUCP.com which is
rediculous and should be fixed.  See:
        http://www.cruzio.com/~jeffl/sco/new_name.txt
Ummm... No firewall?.  You really should get a firewall instead of just a
router.  I'm partial to Sonicwall/10 this week:
        http://www.sonicsys.com

It also shows that you're running:
        SCO TCP/IP Runtime Release 2.0.0
which means that this is 3.2v5.0.x.

Your system has been up for 3 days 40 hrs and 10 minutes.

Your 3c9905TX ethernet card is running at 10mbits/sec.  This if this is NOT
correct, you may want to hack the space.c file for your ethernet card to
disarm the possibly broken autodetect feature and force the correct speed
and mode.

You've moved 4.2GBytes of data in the last 3 days on this machine so I can
fairly well presume that it's working.

Since your broadcast address is currently 209.61.22.255, the router might
not see the broadcasts.  Judging by your number assignments, the correct
broadcast address should be 209.61.22.95 although I think .255 might work.
Whatever is at at 209.61.22.95 returns a MAC address of 0000A5E09700 which
is owned by Compatible Systems Corporation.  So, what did PSI.net say to
use for a broadcast address and why is there a router sitting where I would
expect the broadcast address to be?  Normally (if there is such a thing,
the router address is the lowest number of the IP block, while the
broadcast address is the highest.

Your ISP's gateway is at 209.61.22.65 with only a little traffic.  Is this
the "router"?  I don't see anything that even looks like a router exept for
the one at your ISP's at .65.  Let me guess... Someone added a router or
machine and used the broadcast address for the IP.  That won't work.

SNMP shows that your OSR5 box is receiving route metric values from
somewhere, probably the router.  Please disarm, kill, and never resurrect
RIP from the OSR5 box.  Edit /etc/tcp, find the lines that start "routed"
and put a comment symbol # in front of the routed line.  Similarly, kill
the routed daemon if it's running.

The connection table shows that your OSR5 box is listening on a
considerable number of IP ports.  You *REALLY* should get a firewall or at
least a packet filter.  TCP Wrappers?  Anything?

OK, enough entertainment value for one day.  Back to work...



-- 
Jeff Liebermann  150 Felker St #D  Santa Cruz CA 95060
(831)421-6491 pgr (831)426-1240 fax (831)336-2558 home
http://www.cruzio.com/~jeffl   WB6SSY
jeffl@comix.santa-cruz.ca.us   jeffl@cruzio.com

Comments?

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.