Date: Wed, 21 Mar 2018 16:30:51 -0700 From: "Ronald F. Guilmette" <rfg@tristatelogic.com> To: FreeBSD Net <freebsd-net@freebsd.org> Subject: Re: Same host or different? How can you tell "over the wire"? Message-ID: <5700.1521675051@segfault.tristatelogic.com> In-Reply-To: <5AB2D11A.6060605@grosbein.net>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <5AB2D11A.6060605@grosbein.net>, Eugene Grosbein <eugen@grosbein.net> wrote: >If they respond truly identically, there are no reasons to treat them like >distinct hosts >despite of different IP addresses. Well, for my purposes, it would be inapporpriate to make any such leap of faith. If address A is somehow established to be under the control of a given Bad Actor, then even if address A' is seen to yield essentially identical results at the level of the application layer, this is most certainly -not- an adequate justification for anyone (e.g. me, or anyone else for that matter) to affirmatively assert that A' is under the control of the exact same Bad Actor. Individual IPv4 addresses may often exhibit an identical set of open ports. And the responses provided when sending data to those ports may be "generic" and thus may be actually or virtually identical. This alone is not nearly enough to assert that A' is under the control of the exact same Bad Actor who is in control of A. >And if you have such reason despite they respond truly identically, >then such a reason steams from matters other than their response on requests >to open ports. >In this case you should differentiate them by other means too, not by open >port's responses. Yes... by other means -also-, e.g. DNS. Assume that this has already been done. Assume that two different (and somehow related) FQDNs point to two different IPv4 addreses, A and A'. As we all know, any fool on the Internet can point any FQDN for which he controls the DNS to any bloody address he wants. But any such "pointing", standing alone and by itself, does not -prove- a damn thing about the pointed-at addresses, or about who is -currently- controlling them. (I wish that I had a dollar for every FQDN I had ever come across that resolved to either 127/8 or 10/8, or that pointed to an address that is not currently routed, and which perhaps never has been.) If other data persuasively indicates that address A is under the control of a Bad Actor, and if there appears to be some connection between A and A' (such as some sort of association indicated by the DNS) then if there were a way to also establish that A and A' are both being routed to a single machine, then it could be reliably and persuasively asserted, without fear of contradiction, that A' is also under the control of the same Bad Actor. I would like to be able to make such logical inferences and assertions, which is what prompted my question.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5700.1521675051>