Vulnerability Development mailing list archives

Re: getcat.com-- IE CueCat Spy on you.


From: Phil Dyer <pdyer () MILLEROILCO COM>
Date: Fri, 8 Sep 2000 12:53:39 -0400

Richard,
Take a closer look at the logs. getcat.com's IP address is 216.34.143.198,
but you are getting the netbios packets from 209.81.216.169. That is someone
else on the corecomm.net network. I assume you are on a cable modem/DSL.
Someone has file and print sharing on in your neighborhood. (probably)

<snip>

10:33:51.938023 > 209.81.164.237.3991 > 216.34.143.198.www: S
[ECN-Echo,CWR] 1634597875:1634597875(0) win 4452 <mss
1484,sackOK,timestamp 34033191 0,nop,wscale


10:34:27.376342 < 209.81.216.169.1957 > 209.81.164.237.netbios-ssn: S
35808593:35808593(0) win 8192 <mss 536,nop,nop,sackOK> (DF)
</snip>

Phil Dyer
pdyer () milleroilco com


Current thread: