OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: TAL-IPC protocol with pf

From: Brandon Mercer (b.mercertrustetc.com)
Date: Wed Sep 01 2004 - 12:52:24 CDT

Daniel Polak wrote:

> Brandon,
>
> The fact that ports are mentioned at all is a STRONG pointer that the
> protocol being used is TCP or UDP. Also telnet (see your link at
> http://www.mastertrader.com/education/firewalls.asp) is for TCP
> connections.
> So don't worry the protocol is TCP indeed.
>
> Like Jason says check what traffic is coming in to your firewall,
> check what is going out and check what is being blocked (and hopefully
> logged).
>
> Good luck!
>
> Daniel
>
> ==== Original message from Brandon Mercer at 1-9-2004 17:11
>
>> jasondixongroup.net wrote:
>>
>>>> Hello Group,
>>>> Boy have I got one for you! So my broker dealer upgrades his software
>>>> that he uses to get pricing and he can't get any information. I'm on
>>>> the phone with their tech support and she says that I need to allow
>>>> port
>>>> 1838 outbound on my firewall. Fair enough, I try that and things
>>>> still
>>>> don't work. So I verify with the tech support rep that it runs over
>>>> tcp... **BIG PAUSE** she replies, well actually it works over TAL-IPC
>>>> which is a proprietary protocol that we've developed. Oh... ok... so
>>>> tcp wasn't good enough for you? Anyway, the problem as it stands is
>>>> that I still need to make this work. I'm running OpenBSD 3.5 and here
>>>> is a snippet of my ruleset.
>>>>
>>>
>>>
>>>
>>> I seriously doubt that they've rewritten their own transport-layer
>>> protocol. I imagine it's just another application-layer protocol on
>>> top
>>> of TCP. What type of traffic capture have you performed? What
>>> _really_
>>> leads you to believe that a broken application upgrade has anything
>>> to do
>>> with the firewall.
>>>
>>>
>> That was my first impression too.... but in all seriousness it checks
>> out. :-( Here's a link to provide some humor
>> http://www.mastertrader.com/education/firewalls.asp. Brandon
>
>
Well, I've been able to watch the traffic pass to and fro between this
workstation and the internet and vice versa. So we know it's *probably*
not on the Firewall anymore. I'm hoping that I can get it figured out.
Thanks all for the input you've helped me put together a very solid
picture of what's going on.
Brandon