Comments on: Apple’s Patched OpenSSH doing SRV lookups? http://www.sherman.ca/archives/2005/06/23/apples-patched-openssh-doing-srv-lookups/ Mostly random thoughts on software, gear and the great outdoors. Tue, 27 Sep 2011 13:33:05 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Jon Rail http://www.sherman.ca/archives/2005/06/23/apples-patched-openssh-doing-srv-lookups/comment-page-1/#comment-283 Jon Rail Fri, 09 Dec 2005 16:01:04 +0000 http://www.sherman.ca/2005/06/23/apples-patched-openssh-doing-srv-lookups/#comment-283 <p>NB in my last comment several underscores have been removed from my command line examples (the comments system interpreted them as formating instructions).</p> NB in my last comment several underscores have been removed from my command line examples (the comments system interpreted them as formating instructions).

]]> By: Jon Rail http://www.sherman.ca/archives/2005/06/23/apples-patched-openssh-doing-srv-lookups/comment-page-1/#comment-282 Jon Rail Fri, 09 Dec 2005 15:59:37 +0000 http://www.sherman.ca/2005/06/23/apples-patched-openssh-doing-srv-lookups/#comment-282 <p>I've just been researching the same thing, and it seems that it's the mDNS service which I think is the actual implementation of Bonjour (aka Rendezvous).</p> <p>man mDNS shows examples of advertising services using the syntax:</p> <p>mDNS -R "My Test" _http._tcp . 80 (and some other stuff)</p> <p>And to search for a resource:</p> <p>mDNS -B _http._tcp</p> <p>I've ran a packet capture on an ibook as it bound to Active Directory (just to make sure it was doing it sensibly before we let it near the live systems) and noticed a lot of these DNS requests milliseconds after it bound.</p> I’ve just been researching the same thing, and it seems that it’s the mDNS service which I think is the actual implementation of Bonjour (aka Rendezvous).

man mDNS shows examples of advertising services using the syntax:

mDNS -R “My Test” _http._tcp . 80 (and some other stuff)

And to search for a resource:

mDNS -B _http._tcp

I’ve ran a packet capture on an ibook as it bound to Active Directory (just to make sure it was doing it sensibly before we let it near the live systems) and noticed a lot of these DNS requests milliseconds after it bound.

]]> By: DouglasDD http://www.sherman.ca/archives/2005/06/23/apples-patched-openssh-doing-srv-lookups/comment-page-1/#comment-281 DouglasDD Thu, 01 Sep 2005 02:05:31 +0000 http://www.sherman.ca/2005/06/23/apples-patched-openssh-doing-srv-lookups/#comment-281 <p>The DNS behavior that you describe is about to get me banned / disconnected by my ISP, who say that my box is abusing their DNS to the tune of dozens of queries per second!</p> <p>At the time the notification was generated my box was running 10.4.2. I've just now updated to Security Update 2005-007 (v1.1).</p> <p>Since Rogers.com's tech support is so useless for non-windows, and the "abuse" team doesn't return emails, I guess I won't find out if the latest update fixed the issue or not until after I'm banned :-P</p> <p>I'm not yet clear whether the offending software is ssh (or client app) or sshd (the server app).</p> <p>Their auto-generated nasty-gram included the following log snippet:</p> <p>Date Time, Src, Query, Query type 2005-08-24 10:03:02.87574, 24.157.68.55, _telnet._tcp.quickbeam.rogers.com., Internet Unknow 2005-08-24 10:03:02.89364, 24.157.68.55, quickbeam.slnt.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.91165, 24.157.68.55, quickbeam.slnt.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.92965, 24.157.68.55, quickbeam.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.94782, 24.157.68.55, quickbeam.phub.net.cable.rogers.com., Internet Addr ?</p> <p>Date Time,Dst,Query,Response 2005-08-24 10:03:2.87637,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.89392,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.91205,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.93289,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.94814,24.157.68.55,Error:,3(Name Error)</p> <p>All the best, ./ddd</p> The DNS behavior that you describe is about to get me banned / disconnected by my ISP, who say that my box is abusing their DNS to the tune of dozens of queries per second!

At the time the notification was generated my box was running 10.4.2. I’ve just now updated to Security Update 2005-007 (v1.1).

Since Rogers.com’s tech support is so useless for non-windows, and the “abuse” team doesn’t return emails, I guess I won’t find out if the latest update fixed the issue or not until after I’m banned :-P

I’m not yet clear whether the offending software is ssh (or client app) or sshd (the server app).

Their auto-generated nasty-gram included the following log snippet:

Date Time, Src, Query, Query type 2005-08-24 10:03:02.87574, 24.157.68.55, _telnet._tcp.quickbeam.rogers.com., Internet Unknow 2005-08-24 10:03:02.89364, 24.157.68.55, quickbeam.slnt.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.91165, 24.157.68.55, quickbeam.slnt.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.92965, 24.157.68.55, quickbeam.phub.net.cable.rogers.com., Internet Addr ? 2005-08-24 10:03:02.94782, 24.157.68.55, quickbeam.phub.net.cable.rogers.com., Internet Addr ?

Date Time,Dst,Query,Response 2005-08-24 10:03:2.87637,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.89392,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.91205,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.93289,24.157.68.55,Error:,3(Name Error) 2005-08-24 10:03:2.94814,24.157.68.55,Error:,3(Name Error)

All the best, ./ddd

]]> By: theconsultant.net &#187; Blog Archive &#187; Tiger: OpenSSH and SRV resolution http://www.sherman.ca/archives/2005/06/23/apples-patched-openssh-doing-srv-lookups/comment-page-1/#comment-279 theconsultant.net &#187; Blog Archive &#187; Tiger: OpenSSH and SRV resolution Sun, 26 Jun 2005 07:16:27 +0000 http://www.sherman.ca/2005/06/23/apples-patched-openssh-doing-srv-lookups/#comment-279 <p>[...] irmware for Pioneer DVD drives Tiger: OpenSSH and SRV resolution Adam asked me to look if my OpenSSH install also does SRV loo [...]</p> [...] irmware for Pioneer DVD drives Tiger: OpenSSH and SRV resolution Adam asked me to look if my OpenSSH install also does SRV loo [...]

]]>