New User? Need help? Click here to register for free! Registering removes the advertisements.

Computer Cops
image image image image image image image image
Donations
If you found this site helpful, please donate to help keep it online
Don't want to use PayPal? Try our physical address
image
Prime Choice
· Head Lines
· Advisories (All)
· Dnld of the Week!
· CCSP News Ltrs
· Find a Cure!

· Ian T's (AR 24)
· Marcia's (CO8)
· Bill G's (CO12)
· Paul's (AR 5)
· Robin's (AR 2)

· Ian T's Archive
· Marcia's Archive
· Bill G's Archive
· Paul's Archive
· Robin's Archive
image
Security Central
· Home
· Wireless
· Bookmarks
· CLSID
· Columbia
· Community
· Downloads
· Encyclopedia
· Feedback (send)
· Forums
· Gallery
· Giveaways
· HijackThis
· Journal
· Members List
· My Downloads
· PremChat
· Premium
· Private Messages
· Proxomitron
· Quizz
· RegChat
· Reviews
· Google Search
· Sections
· Software
· Statistics
· Stories Archive
· Submit News
· Surveys
· Top
· Topics
· Web Links
· Your Account
image
CCSP Toolkit
· Email Virus Scan
· UDP Port Scanner
· TCP Port Scanner
· Trojan TCP Scan
· Reveal Your IP
· Algorithms
· Whois
· nmap port scanner
· IPs Banned [?]
image
Survey
How much can you give to keep Computer Cops online?

$10 up to $25 per year?
$25 up to $50 per year?
$10 up to $25 per month?
$25 up to $50 per month?
More than $50 per year?
More than $50 per month?
One time only?
Other (please comment)



Results
Polls

Votes: 1170
Comments: 21
image
Translate
English German French
Italian Portuguese Spanish
Chinese Greek Russian
image
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Login to check your private messagesLogin to check your private messages   LoginLogin   Your Favorite ForumsFavForums 

B9 host file entries

 
Post new topic   Reply to topic       Computer Cops Forum Index -> Benign - Troubleshooting
View previous topic :: View next topic  
Author Message
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Fri Dec 26, 2003 5:02 am    Post subject: B9 host file entries
Reply with quote

The FAQ isn't clear on this point but what exactly are the B9 entries in the host file doing? For example:
Code:
# Begin B9
127.98.9.1                        pop.server1.b9 
127.98.9.2                        pop.server2.b9 
127.98.9.3                        pop.server3.b9 
# End B9

I entered the last two mappings manually myself and they work but I have no idea WHY they work. Why is the IP address 127.98.9.* ? Does B9 somehow assume those addresses? I can't find anything in B9 Options that makes such an association.

_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
hamster

Firetrust Host
Firetrust Host



Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand

PostPosted: Sat Dec 27, 2003 9:04 pm    Post subject:
Reply with quote

Hi Ikeb
Benign needs to alter the Windows HOSTS file so that the system is able to resolve the "mail.server.name.b9" into a specific IP address for 'localhost' so Benign can determine which account to scan the mail from.

Without an appropriate entry in the HOSTS file, the computer would not be able to resolve the "mail.server.name.b9" entry and mail could not be retrieved by the mail client.

The above is the bit in our faq
http://www.firetrust.com/support/benign/faq/#hosts_file

This explains it for me. Is this what you mean?

Cheers
Hamish
Firetrust
Back to top
View users profile Send private message Send email Visit posters website
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Sat Dec 27, 2003 11:09 pm    Post subject:
Reply with quote

hamster wrote:
The above is the bit in our faq
http://www.firetrust.com/support/benign/faq/#hosts_file

This explains it for me. Is this what you mean?

No. I read the FAQ and couldn't find the info I'm looking for. As I stated in my post, I'd like to know why the particular IP addresses listed in the host file (127.98.9.n) are used by B9. Specifically:

  • How does B9 determine which addresses to use?
  • Can this address be changed by the user?
  • Would a user be able to figure it out if the installation program failed to modify the host file?
  • What happens if those addresses are used by some other networking device?
  • Why not just use the "customary" loopback address (127.0.0.1) and change the port # to prevent clashing proxies?

_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Mon Jan 05, 2004 1:45 am    Post subject:
Reply with quote

Hello! Any answers for me Hamish?
_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
hamster

Firetrust Host
Firetrust Host



Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand

PostPosted: Mon Jan 05, 2004 7:43 pm    Post subject:
Reply with quote

Hi Ikester

Apologies for delay. I am getting the developers to give me the good oil on your questions.
I will update as soon as I hear from them.

Thanks
Hamish
Back to top
View users profile Send private message Send email Visit posters website
hamster

Firetrust Host
Firetrust Host



Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand

PostPosted: Tue Jan 06, 2004 3:57 pm    Post subject:
Reply with quote

Hi Ikester
Here is the good oil from our developers. Many thanks to them.
Cheers
Hamish
Firetrust

How does B9 determine which addresses to use?

The IP address and hostname in the hosts file let Benign know which actual server to connect to. Benign compares the destination hostname (<hostname>.b9) with the server name in the account settings (<hostname>); if they match (excluding the .b9 suffix), it will connect to the matching server specified in the settings. If the HOSTS file hostname doesn't match any server name in the B9 settings, Benign returns the following:

-ERR Can't find the account for '<hostname>' - please check your account settings in the Options dialog

This error may be presented as a cryptic error code depending on your mail client.

Can this address be changed by the user?

Benign only accepts connections to the range 127.98.9.(1-255) , you can change the last number to an arbitrary value within the (1-255) range so long as you don't modify the hostname part of the HOSTS file.

Would a user be able to figure it out if the installation program failed to modify the host file?

When Benign modifies the HOSTS file it adds the '# Begin B9' and '# End B9' comments to the file. So long as you made sure the host name was correct: <servername.b9> and the IP address falls in the correct range and is unique, and the account details are present in the Benign settings, then the HOSTS file will be editable manually. Hopefully it won't be necessary though.

What happens if those addresses are used by some other networking device?

If another program is listening on the same localhost listening port as Benign (default 110) there will be problems, regardless of the actual IP address in the 127.x.x.x range. You will need to change the port number that Benign listens for incoming connections on in the 'Options' >> 'General' tab to avoid any such conflicts.

Why not just use the "customary" loopback address (127.0.0.1) and change the port # to prevent clashing proxies?

Using different addresses in the range 127.x.x.x allows Benign to use the IP address to distinguish between accounts, and it is less complicated for the user than having different port numbers for each account. Proxies will only clash if the port number is the same, not just the IP address. Using many IP addresses and one port number reduces the likelihood of clashes. Incidentally, the 127.98.9.x range was chosen arbitrarily because 98 is the ASCII value for the character 'b' , so 98.9 is: b9 As far as we are aware no other application uses this range for anything.
Back to top
View users profile Send private message Send email Visit posters website
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Wed Jan 07, 2004 12:34 am    Post subject:
Reply with quote

hamster wrote:
Hi Ikester
Here is the good oil from our developers. Many thanks to them.
Cheers
Hamish
Firetrust

Thanks Hamish. This info helps to fill in the gaps.


There seems to be some bad oil mixed in though:

Quote:
What happens if those addresses are used by some other networking device?

If another program is listening on the same localhost listening port as Benign (default 110) there will be problems, regardless of the actual IP address in the 127.x.x.x range. You will need to change the port number that Benign listens for incoming connections on in the 'Options' >> 'General' tab to avoid any such conflicts.

Sorry but this is plain wrong. A conflict occurs only if BOTH the IP address and port number match. I have five proxies using port 110 (three for B9, one for POPFile, and one for Hotmail Popper) but none clash because they use different IP addresses (172.98.9.x, 172.0.0.1, and 172.0.0.2 respectively).

I also have some followup to the answer for my next question. Not bad oil persay but perhaps 10W20 instead of the real good 5W40 stuff:

Quote:
Why not just use the "customary" loopback address (127.0.0.1) and change the port # to prevent clashing proxies?

Using different addresses in the range 127.x.x.x allows Benign to use the IP address to distinguish between accounts, and it is less complicated for the user than having different port numbers for each account.

A lot of proxies obtain the account specifics during the uname and password handshake. The approach used by B9 does avoid that config complication at the cost of having to modify the host file (and we know there have been issues because of that since some other programs arrogantly assume that the host file is just for their exclusive use.).

Quote:
Proxies will only clash if the port number is the same, not just the IP address.


Right, both the port # and IP address must match for a clash to occur.

Quote:
Using many IP addresses and one port number reduces the likelihood of clashes.

This statement is misleading. There is zero likelihood of a clash if either the IP address OR port # differ. Dunno where "reduced likelihood" comes from unless a reduction from "100% certain" to "0% possible" is what is being alluded to.

_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
hamster

Firetrust Host
Firetrust Host



Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand

PostPosted: Wed Jan 07, 2004 9:10 pm    Post subject:
Reply with quote

Hi Ikester
Got to ask the developers for an oil change. So I will get back as soon as i can.

Cheers
Hamish
Firetrust
Back to top
View users profile Send private message Send email Visit posters website
hamster

Firetrust Host
Firetrust Host



Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand

PostPosted: Sun Jan 11, 2004 3:37 pm    Post subject:
Reply with quote

Hi Ikester
Got feedback from the developers for you.
Cheers
Hamish
Firetrust

Quote:

What happens if those addresses are used by some other networking device?

If another program is listening on the same localhost listening port as Benign (default 110) there will be problems, regardless of the actual IP address in the 127.x.x.x range. You will need to change the port number that Benign listens for incoming connections on in the 'Options' >> 'General' tab to avoid any such conflicts.


Sorry but this is plain wrong. A conflict occurs only if BOTH the IP address and port number match. I have five proxies using port 110 (three for B9, one for POPFile, and one for Hotmail Popper) but none clash because they use different IP addresses (172.98.9.x, 172.0.0.1, and 172.0.0.2 respectively).



I have tested it out though and discovered that Ike is indeed correct that is actaully possible (at least for some versions of Windows) to have multiple applications listening on various loopback IP addresses that should conflict on the same port.

It shouldn't be possible though -- Benign is listening to the * (wildcard) loopback address, which means that any connection to any address in the 127.x.x.x range will be acted upon by Benign. You can confirm this by telneting to any such address in the 127.x.x.x range and you should get the Benign 'false' connection refused message:

-ERR Connections are allowed only from the local host (127.0.0.1 is not a local address)

Listening on the wildcard address should block all other applications from listening (on the same port) on a specific IP addresses in the range, as they are covered by the wildcard. Some versions of Windows do block this, which is why we had to add the ability to change Benign's listening port. I tried a similar experiment in a linux environment (not with Benign, but with the netcat tool), and the conflicts were indeed blocked as I expected. Only one socket could be open for listening on the wildcard loopback address.

Any other application listening on the same port as Benign _should_ cause a conflict, but the behaviour seems inconsitent between versions of Windows. It is a problem with Windows' behaviour, and I'm not yet sure if there are any potential sideeffects from it.

I am not sure how Windows determines which socket should be connected to when there are three or more bindings to the wildcard loopback address as I have been able to create. It could lead to confusion.

If the the 127.0.0.1 and 127.0.0.2 addresses are indeed specific and not the wildcard loopback address like Benign, I would assume that in practice there wouldn't be a conflict.

To check, open a DOS prompt and use the netstat command:

netstat -an

a wildcard loopback address (Benign's) will look like:

TCP 0.0.0.0:110 0.0.0.0:0 LISTENING

while a specific one should look like:

TCP 127.0.0.1 0.0.0.0:0 LISTENING

We are thinking of possibly changing Benign to only listen to the 127.98.9.x range, which may help clear up some of this up. I may not have been clear previously that Benign listens for _all_ connections in the 127.x.x.x range, but will reject anything that falls outside of the 127.98.9.x range.
Back to top
View users profile Send private message Send email Visit posters website
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Sun Jan 11, 2004 11:47 pm    Post subject:
Reply with quote

hamster wrote:
Hi Ikester
Got feedback from the developers for you.
Cheers
Hamish
Firetrust

Thanks Hamish. I must say that the plot thickens....

Quote:

I have tested it out though and discovered that Ike is indeed correct that is actaully possible (at least for some versions of Windows) to have multiple applications listening on various loopback IP addresses that should conflict on the same port.

It shouldn't be possible though -- Benign is listening to the * (wildcard) loopback address, which means that any connection to any address in the 127.x.x.x range will be acted upon by Benign. You can confirm this by telneting to any such address in the 127.x.x.x range and you should get the Benign 'false' connection refused message:

-ERR Connections are allowed only from the local host (127.0.0.1 is not a local address)

Let me get this straight ... some proxies are arrogant enough to take over the host file. B9 is actually arrogant enough to take over the whole 127.x.x.x address space?

Quote:
Listening on the wildcard address should block all other applications from listening (on the same port) on a specific IP addresses in the range, as they are covered by the wildcard. Some versions of Windows do block this, which is why we had to add the ability to change Benign's listening port. I tried a similar experiment in a linux environment (not with Benign, but with the netcat tool), and the conflicts were indeed blocked as I expected. Only one socket could be open for listening on the wildcard loopback address.

I'm shocked ... and surprised that there haven't been folks reporting problems when attempting to run their proxies.


Quote:
Any other application listening on the same port as Benign _should_ cause a conflict, but the behaviour seems inconsitent between versions of Windows. It is a problem with Windows' behaviour, and I'm not yet sure if there are any potential sideeffects from it.

In my case I didn't think I had to change loopback port # (127.0.0.1) to run POPFile. It ran just fine. The POPFile (wiki) FAQ advised me to set Hotmail Popper to 127.0.0.2 so that's what I did, never expecting that B9 had claimed the whole address space.

Quote:
If the the 127.0.0.1 and 127.0.0.2 addresses are indeed specific and not the wildcard loopback address like Benign, I would assume that in practice there wouldn't be a conflict.

To check, open a DOS prompt and use the netstat command:

netstat -an

a wildcard loopback address (Benign's) will look like:

TCP 0.0.0.0:110 0.0.0.0:0 LISTENING

while a specific one should look like:

TCP 127.0.0.1 0.0.0.0:0 LISTENING

I get back the following (plus more which I didn't list):
Code:
  TCP    0.0.0.0:110            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING
  TCP    127.0.0.1:110          0.0.0.0:0              LISTENING
  TCP    127.0.0.1:110          127.0.0.1:3786         TIME_WAIT
  TCP    127.0.0.1:110          127.0.0.1:3787         TIME_WAIT
  TCP    127.0.0.1:110          127.0.0.1:3788         TIME_WAIT
  TCP    127.0.0.1:8080         0.0.0.0:0              LISTENING
  TCP    127.0.0.1:8080         127.0.0.1:3780         TIME_WAIT
  TCP    127.0.0.1:8080         127.0.0.1:3785         TIME_WAIT
  TCP    127.0.0.2:25           0.0.0.0:0              LISTENING
  TCP    127.0.0.2:110          0.0.0.0:0              LISTENING
  TCP    127.0.0.2:3796         127.0.0.2:110          TIME_WAIT


Quote:
We are thinking of possibly changing Benign to only listen to the 127.98.9.x range, which may help clear up some of this up.

That certainly would reduce the confusion factor. It might help some folks with their proxies ... those who who have a problem changing the port #. Out of curiousity, why didn't you guys do what most (every?) other proxy vendor does ... relay the addressing via the uname/password handshake?

Quote:
I may not have been clear previously that Benign listens for _all_ connections in the 127.x.x.x range, but will reject anything that falls outside of the 127.98.9.x range.

OK that explains why the 127.98.9.n entries must be in the host file .... but you've also left me scratching my head on this last point. If B9 rejects everything outside 127.98.9.x, what's the problem?

_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
Ikeb

General
General
Premium Member
Premium Member


Joined: Apr 20, 2003
Posts: 3555
Location: Canada

PostPosted: Mon Jan 12, 2004 12:05 pm    Post subject:
Reply with quote

hamster wrote:
Hi Ikester
Got feedback from the developers for you.
Cheers
Hamish
Firetrust

Thanks Hamish. I must say that the plot thickens....

Quote:

I have tested it out though and discovered that Ike is indeed correct that is actaully possible (at least for some versions of Windows) to have multiple applications listening on various loopback IP addresses that should conflict on the same port.

It shouldn't be possible though -- Benign is listening to the * (wildcard) loopback address, which means that any connection to any address in the 127.x.x.x range will be acted upon by Benign. You can confirm this by telneting to any such address in the 127.x.x.x range and you should get the Benign 'false' connection refused message:

-ERR Connections are allowed only from the local host (127.0.0.1 is not a local address)

Let me get this straight ... some proxies are arrogant enough to take over the host file. B9 is actually arrogant enough to take over the whole 127.x.x.x address space?

Quote:
Listening on the wildcard address should block all other applications from listening (on the same port) on a specific IP addresses in the range, as they are covered by the wildcard. Some versions of Windows do block this, which is why we had to add the ability to change Benign's listening port. I tried a similar experiment in a linux environment (not with Benign, but with the netcat tool), and the conflicts were indeed blocked as I expected. Only one socket could be open for listening on the wildcard loopback address.

I'm shocked ... and surprised that there haven't been folks reporting problems when attempting to run their proxies.


Quote:
Any other application listening on the same port as Benign _should_ cause a conflict, but the behaviour seems inconsitent between versions of Windows. It is a problem with Windows' behaviour, and I'm not yet sure if there are any potential sideeffects from it.

In my case I didn't think I had to change loopback port # (127.0.0.1) to run POPFile. It ran just fine. The POPFile (wiki) FAQ advised me to set Hotmail Popper to 127.0.0.2 so that's what I did, never expecting that B9 had claimed the whole address space.

Quote:
If the the 127.0.0.1 and 127.0.0.2 addresses are indeed specific and not the wildcard loopback address like Benign, I would assume that in practice there wouldn't be a conflict.

To check, open a DOS prompt and use the netstat command:

netstat -an

a wildcard loopback address (Benign's) will look like:

TCP 0.0.0.0:110 0.0.0.0:0 LISTENING

while a specific one should look like:

TCP 127.0.0.1 0.0.0.0:0 LISTENING

I get back the following (plus more which I didn't list):
Code:
  TCP    0.0.0.0:110            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING
  TCP    127.0.0.1:110          0.0.0.0:0              LISTENING
  TCP    127.0.0.1:110          127.0.0.1:3786         TIME_WAIT
  TCP    127.0.0.1:110          127.0.0.1:3787         TIME_WAIT
  TCP    127.0.0.1:110          127.0.0.1:3788         TIME_WAIT
  TCP    127.0.0.1:8080         0.0.0.0:0              LISTENING
  TCP    127.0.0.1:8080         127.0.0.1:3780         TIME_WAIT
  TCP    127.0.0.1:8080         127.0.0.1:3785         TIME_WAIT
  TCP    127.0.0.2:25           0.0.0.0:0              LISTENING
  TCP    127.0.0.2:110          0.0.0.0:0              LISTENING
  TCP    127.0.0.2:3796         127.0.0.2:110          TIME_WAIT


Quote:
We are thinking of possibly changing Benign to only listen to the 127.98.9.x range, which may help clear up some of this up.

That certainly would reduce the confusion factor. It might help some folks with their proxies ... those who who have a problem changing the port #. Out of curiousity, why didn't you guys do what most (every?) other proxy vendor does ... relay the addressing via the uname/password handshake?

Quote:
I may not have been clear previously that Benign listens for _all_ connections in the 127.x.x.x range, but will reject anything that falls outside of the 127.98.9.x range.

OK that explains why the 127.98.9.n entries must be in the host file .... but you've also left me scratching my head on this last point. If B9 rejects everything outside 127.98.9.x, what's the problem?

_________________
I like SPAM ... on my sandwich!
Back to top
View users profile Send private message Send email
tosbsas

Trooper
Trooper



Joined: Feb 27, 2003
Posts: 15
Location: Argentina

PostPosted: Mon Feb 02, 2004 5:39 pm    Post subject:
Reply with quote

Maybe thats the page I can get help:

I am using Becky Email and Nod32 and Spampal.

Works fine, but Nod listenes to 110 and Spampal listens to 9110. I can use benign together with these two just fine, setting it to listen to 9110.

But: Looks like that way nod is checking twice the mails (get twice the information - checked by nod) I got rid of that when using spampal und chaning spampla to listen to 9110 as well as Becky.

No with the 4 proggies together any ideas??

Ruben
Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic       Computer Cops Forum Index -> Benign - Troubleshooting All times are GMT - 5 Hours
Page 1 of 1

 
 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB 2.0.8a © 2001 phpBB Group

Version 2.0.6 of PHP-Nuke Port by Tom Nitzschner © 2002 www.toms-home.com
Version 2.2 by Paul Laudanski © 2003-2004 Computer Cops