Re: Nobo and Netbuster Dos

[flaviovs () CENTROIN COM BR (Flavio Veloso)]

On Wed, 20 Jan 1999, Wolfgang Gassner wrote:

Important notice: I will talk only about NOBO since it is my
project.

> Simply send Big Udp Packets to eg. Port 31337 and Mr. Nobo will see
> a Big error message at each Packet!!!

I could not reproduce the error here. I tried to send UDP packets
ranging from 1 byte to the biggest allowable size on my BSD system,
and in all cases NOBO gave no "Big" error message, but only a warning
telling me that an unknown packet was received.

What is a "Big Udp Packet" for you? What program did you use to send
such packet? What OS?

> As Default Nobo only Logs on screen and not into file that means
> you can erase your Ping!!

The program will never log to a file unless the user configures it to
do so. This is to prevent a real DoS attack (user's HD filling up when
being flooded).

Also, "erase your Ping" is nonsense. NOBO will show (and log to file,
if configured) the IP address of any received packet.

Of course, you can always spoof the source address. But this is not
relevant since you can spoof a legitimate BO packet too. NOBO can't do
anything to spoofed packet but act on it, since there's no easy way to
detect the forgery.

> I tested this on NT and W95 and after some time it will kill with
> a Overflow.

Can you give me more details about the crash? (Please, do not bother
the nice bugtraq folks with this stuff -- mail me directly.)

--
Flavio