OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1995: Re: Technical Observations on SATAN: Issue: VMS and TCP/IP

Re: Technical Observations on SATAN: Issue: VMS and TCP/IP

Carl R. Forsythe (forsythefiji.oc.nps.navy.mil)
Fri, 7 Apr 1995 10:23:58 -0700 (PDT) 

According to Software Test Account:
> 
> On Thu, 6 Apr 1995, Wietse Venema wrote:
> 
> >
> For some reason when I test SATAN against VMS systems running either UCX or 
> Wollongong TCP/IP stacks the systems crash. 
> 
> This seems to be true for the heavy test only.  Other potentially 
> coincidental events include:
> 	1.  First test on a given node; when system reboots and a test
> 	    is again performed a successful test seems to be made.
> 	2.  The first test uses the FQDN and the second test uses the
> 	    IP address.
> 
> I have no idea where to look? The crash logs do not reveal anything helpful.
> A message coming from SATAN says:
> 	bin/udp_scan: are we talking to a dead host or network?
> 
> NOTE: The hosts were most certainly alive prior to the test.
> 


We noticed the same thing with one of our VMS nodes that happened to 
have SATAN hit it in heavy mode. Since I am not the VMS admin I am not
sure of all the details other than the fact that the machine rebooted when
it was scanned with a heavy scan....I will forward for info as I find
it.....

-Carl

-- 
=================================================================
 Carl R. Forsythe  System Administrator, Oceanography Department 
      NPGS Monterey, CA. E-Mail: forsytheoc.nps.navy.mil           
          PGP Version 2.6.2 key available on request
=================================================================