OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Christian, Chris (chris.christianintel.com)
Date: Mon Jan 28 2002 - 17:55:03 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Steve,

    The strace looks like:

    10607 recv(0, 0x806c284, 65468, 0) = ? ERESTARTSYS (To be restarted)
    10607 --- SIGALRM (Alarm clock) ---
    10607 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
    10607 rt_sigaction(SIGALRM, {0x8049de4, [ALRM], SA_RESTART|0x4000000},
    {0x8049de
    4, [ALRM], SA_RESTART|0x4000000}, 8) = 0
    10607 send(0, "\0\4\0\1", 4, 0) = 4
    10607 rt_sigaction(SIGALRM, {0x8049de4, [ALRM], SA_RESTART|0x4000000},
    {0x8049de
    4, [ALRM], SA_RESTART|0x4000000}, 8) = 0
    10607 alarm(5) = 0
    10607 recv(0, "\0\2/tftpboot/foo\0netascii\0", 65468, 0) = 25
    10607 alarm(0) = 1
    10607 rt_sigaction(SIGALRM, {0x8049de4, [ALRM], SA_RESTART|0x4000000},
    {0x8049de
    4, [ALRM], SA_RESTART|0x4000000}, 8) = 0
    10607 alarm(5) = 0
    10607 recv(0, 0x806c284, 65468, 0) = ? ERESTARTSYS (To be restarted)

    This output doesn't mean much to me.

    The tcpdump looks like: (tcpdump -I eth0 -n | grep 10.241.60.243)

    23:50:36.019933 < 10.241.60.243.2801 > 10.9.138.243.tftp: 25 WRQ
    "/tftpboot/foo"
    23:50:36.023550 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:50:37.185122 > 10.9.138.243.1039 > 10.241.60.243.2801: udp 4
    23:50:41.015495 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:50:42.185594 > 10.9.138.243.1039 > 10.241.60.243.2801: udp 4
    23:50:46.015969 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:50:47.186067 > 10.9.138.243.1039 > 10.241.60.243.2801: udp 4
    23:50:51.016434 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:50:52.186543 > 10.9.138.243.1039 > 10.241.60.243.2801: udp 4
    23:50:56.016909 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:50:57.187024 > 10.9.138.243.1039 > 10.241.60.243.2801: udp 4
    23:51:01.017383 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:51:06.008939 < 10.241.60.243.2801 > 10.9.138.243.1040: udp 25
    23:51:11.008342 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:51:11.008971 < 10.241.60.243.2801 > 10.9.138.243.1040: udp 25
    23:51:16.008819 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:51:16.008920 < 10.241.60.243.2801 > 10.9.138.243.1040: udp 25
    23:51:21.008946 < 10.241.60.243.2801 > 10.9.138.243.1040: udp 25
    23:51:25.999768 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4
    23:51:31.000245 > 10.9.138.243.1040 > 10.241.60.243.2801: udp 4

    Small UDP packets are going back and forth on ephemeral high ports, but
    The connect eventually times out.

    I try and fail from both RedHat 6.0 and Cisco 6509 series routers.
    The ultimate goal is to build a tftp server for configs and binaries
    For Cisco Series 6500 and 2900 Routers and Switches.

    Chris Christian
    SMG-IT - Network Security Engineer
    ftp.intel.com

    -----Original Message-----
    From: Steve Beattie [mailto:stevewirex.net]
    Sent: Monday, January 28, 2002 3:35 PM
    To: Christian, Chris
    Cc: 'immunix-usersmail.wirex.com'
    Subject: Re: TFTP on Immunix 7.0 (How To)

    Hmm, odd, I'm able to get it working here in the lab, with exactly the
    same xinetd configuration that you have. Note that tftpd wants the
    client to give it the full path name in its request (but doing that
    incorrectly gives an access violation error instead of timing out).
    I'm able to successfully transfer a 2MB file.

    Something to look at would be to get a tcpdump (or ethereal)
    of the request as it goes over the wire. Also, running:

      strace -p `pidof xinetd` -f -o /tmp/xinetd.deleteme

    during a request and then examining /tmp/xinetd.deleteme might be
    informative as well.

    What client are you attempting from?

    -- 
    Steve Beattie                               Don't trust programmers? 
    <stevewirex.net>                         Complete StackGuard distro at
    http://NxNW.org/~steve/                            immunix.org
              "Fight for freedom by giving up civil liberties!"
    _______________________________________________
    Immunix-users mailing list
    Immunix-usersmail.wirex.com
    http://mail.wirex.com/mailman/listinfo/immunix-users