OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1995: Re: Technical Observations on SATAN: Issue: VMS and TCP/IP

Re: Technical Observations on SATAN: Issue: VMS and TCP/IP

Robert A. Pickering Jr. (pickerinphoenix.sas.muohio.edu)
Fri, 7 Apr 1995 07:26:39 -0400 (EDT) 

We Ran SATAN here against several of our Unix machines, all passed.  I 
then tried it agains one of our AXP/VMS workstations running Multinet.

It crashed.

After the machine came back up we tried it again.

It passed fine.

I did Heavy tests both times.  At first glance it appears that the AXP
just ran out of memory.

-Rob



On Fri, 7 Apr 1995, Tim Scanlon wrote:

> Erik Lindquist wrote:
> |For some reason when I test SATAN against VMS systems running either UCX or
> |Wollongong TCP/IP stacks the systems crash.
> 
> |This seems to be true for the heavy test only.  Other potentially
> |coincidental events include:
> |	1.  First test on a given node; when system reboots and a test
> |	    is again performed a successful test seems to be made.
> |	2.  The first test uses the FQDN and the second test uses the
> |	    IP address.
> 
> |I have no idea where to look? The crash logs do not reveal anything helpful.
> |A message coming from SATAN says:
> |	bin/udp_scan: are we talking to a dead host or network?
> 
> I do some admin stuff at GMU, and while one of the other admin's here
> was running it against our subnet we encountered a crash. We've got
> a Paragon, and on the heavy scan it crashed during the test. We havn't
> isolated why yet, but suspect that it was becasue it was being hammered
> quite fast. This was after the "light & med" tests hasd passed. That
> machine is fairly tight, so it wasn't a matter of there being alot
> of ports open or anything... Anyway it didn't happen again, and we
> really ~obviously~ arn't looking to replicate it, particlularly on
> this machine, but I'd be interested to hear of any similar stuff
> from other folks.
> 
> -tfs
> 
> 
> ________________________________________________________________
> tfsvampire.science.gmu.edu (NeXTmail, MIME)  Tim Scanlon
> George Mason University     (PGP key avail.)  Public Affairs
> I speak for myself, but often claim demonic posession
> 

--
Robert A. Pickering Jr.                           UNIX Software Specialist
Miami Computing and Information Services          pickerinmuohio.edu

"Most people, if they counted how many people swam across the river, would
never think about building bridges."  - Ronald Altman