From: dtk@all.net
Reply-to: dtk@all.net
Organization: Deception ToolKit Mailing List
Subject: DTK Mailing List 19981212
<pre>---------------------------------------------
Date: Sat, 12 Dec 1998 01:28:31 -0500
From: Thomas H Jones II <ferric@xanthia.com>

dtk@all.net wrote:
>From: sen_ml@eccosys.com

> >  i was wondering whether the following idea was doable/possible using
> > dtk:
> >
> >   -install dtk on a spare host (preferably unused for anything else)

possible

> >   -bind all unused ip addresses to the spare host's nic

rather straight forward, unless youre attempting to bind more IP's than normally allowed by file descriptor
limits. In which case, youll have to tune the kernel to up the limit (and possibly reconsider why you have so
many free IPs).

> >   -have the host 'behave' differently depending on which ip address it
> >    is addressed as -- to simulate the illusion of multiple different hosts.
> >    for differing ip addresses, can the host be made to appear as if it
> >    is running different os-s?  or different versions of particular services?

This is fairly easily done on a host running xinetd. xinetd is a dropin replacement for inetd, and allows you to
bind services to different IPs. In fact, I used this on one system to provide one login environment for users
coming in via one IP and another login environment for users coming in on a different IP. relatively
straightforward to set up.

[...]

-tom
---------------------------------------------
From: "Simson L. Garfinkel" <simsong@vineyard.net>
Date: Fri, 11 Dec 1998 17:17:34 -0500

>[If anybody on the list knows how to do this without handling packets as
> raw - please forward details and I will try to implement this - FC]

It's pretty easy. You use the sockets library to get the IP address of the
destination socket. I have working code. Used it in a network simulation
system to make 1 machine look like 1000.
---------------------------------------------
Date: Fri, 11 Dec 1998 17:29:44 +0000
From: "Bjarni R. Einarsson" <bre@netverjar.is>

> >   -have the host 'behave' differently depending on which ip address it
> >    is addressed as -- to simulate the illusion of multiple different hosts.
> >    for differing ip addresses, can the host be made to appear as if it
> >    is running different os-s?  or different versions of particular services?

Hiding which OS you are using is going to be hard - tools such as queso are
becoming more common all the time (queso recongizes 'quirks' from different
OS's TCP/IP stacks).

OTOH, someone recently posted to the Linux-kernel mailing list a list of
patches to the Linux kernel which defeat queso, various port scanners not
blocked by DTK, and does all sorts of other neat paranoid things - but
you'll never be able to choose many IP stacks for the same machine..

Check:	http://www.progressive-comp.com/~hlein/hap-linux/

> This is an idea I have played with but not yet implemented.  It's fairly
> easy to do in terms of the operation of DTK, but I think you have to do
> something to inetd so that it doesn't assume one IP address.  You also

Check out the inetd alternative at: ftp://ftp.rtc-one.net/j/g2s/ 

	[FC - I have looked at this and it looks reasonably comprehensive, but a
	bit hard to configure properly and somewhat complex.  It is also quite
	Beta in that there may be lots of still unknown vulnerabilities in the
	server.  Previous holes have been found and fixed.  I have not examined
	the code yet.]

IIRC this program combines the capabilities of inetd and tcpd into one, as
well as adding some new features.  I think one of the features was the
ability to offer a different set of services on different IP addresses.

This program has quite a long list of features that could definately come in
handy for people using DTK or other things like it.  It's still in
development - so if DTK needs some specific support for it it should be
possible to influence the author.  Or, since it's GPL'ed it could be fixed..

It's also possible that xinetd has the functionality you are looking for.

> have lots of problems with the IP stack I think, but I'm not yet sure. 

No, Linux at least and probably any other OS which support multiple IP
addresses should handle this very nicely.


( Btw, FC, the @shell.response file in v0.8 still has the working 
  directory hard-coded in.  :-)

	[FC - refixed for the next distribution - the person building in the
	infocon levels was not aware of these changes.]

---------------------------------------------
Date: Fri, 11 Dec 1998 09:37:44 -0700 (MST)
From: Dax Kelson <dkelson@inconnect.com>

On Fri, 11 Dec 1998 dtk@all.net wrote:

...
> [If anybody on the list knows how to do this without handling packets as
>  raw - please forward details and I will try to implement this - FC]

tcpserver by Dan Bernstein is a replacement for inetd+tcpwrappers. It has
support for binding to specific IP addresses.

ftp://koobera.math.uic.edu/www/ucspi-tcp.html

	[FC - This server is limited to TCP only - but seems to operate on a lot
	of different systems]

---------------------------------------------