Question about "daytime"

[mto]

"Jay T. Blocksom" <usenet01+SPAMBLOCK@appropriate-tech.net> wrote in message
news:mk2rjvoljvig4nql4sfanc5f1t4vuukeso@news.rcn.c om...
> On Fri, 15 Aug 2003 08:04:01 -0400, in <alt.privacy.spyware>, "mto"
> <nobody@dontsendmeanyspam.thanks> wrote:
> >
> [snip]
> >
> > Don't know about NT 2000 but XP checks the time of the system clock
about
> > weekly. Gives two choices - microsoft and the national clock.
> [snip]
>
> But surely, it doesn't use the stone-age "Daytime" service for this.
>
> --

No clue what service it uses. Mine is set to time.nist.gov. Just giving
Capps an explanation as to why his machine is constantly trying to fetch the
time from MS.

[Capps]

Win2k, Daytime queries have stopped.

My Win2k box was generating TCP port 13 (Daytime) requests to
Microsoft.net. I blocked all inbound and outbound traffic on port
13, at the firewall. (With Reject) That caused the Win2k box to
begin retrying the Daytime requests very rapidly, and rotating
across multiple servers. So... I updated the firewall rules to just
DROP all port 13 traffic. That slowed the queries from the Win2k
box. But, lo and behold, several days have passed and guess what,
the Win2k box is no longer generating any daytime queries at all.
Hmmm..... something magical ? or some spyware that just got
tired of retrying ? Can't say for sure, but at least the annoying
traffic has stopped.

Enjoy,
Don Capps

"mto" <nobody@dontsendmeanyspam.thanks> wrote in message
news:X_6cnUuMSLfhPt2iXTWJhA@seg.net...
>
> "Jay T. Blocksom" <usenet01+SPAMBLOCK@appropriate-tech.net> wrote in
message
> news:mk2rjvoljvig4nql4sfanc5f1t4vuukeso@news.rcn.c om...
> > On Fri, 15 Aug 2003 08:04:01 -0400, in <alt.privacy.spyware>, "mto"
> > <nobody@dontsendmeanyspam.thanks> wrote:
> > >
> > [snip]
> > >
> > > Don't know about NT 2000 but XP checks the time of the system clock
> about
> > > weekly. Gives two choices - microsoft and the national clock.
> > [snip]
> >
> > But surely, it doesn't use the stone-age "Daytime" service for this.
> >
> > --
>
> No clue what service it uses. Mine is set to time.nist.gov. Just giving
> Capps an explanation as to why his machine is constantly trying to fetch
the
> time from MS.
>
>

[Jay T. Blocksom]

On Mon, 18 Aug 2003 20:17:44 GMT, in <alt.privacy.spyware>, "Capps"
<capps@iozone.org> wrote:
>
> Win2k, Daytime queries have stopped.
>
[snip]

> But, lo and behold, several days have passed and guess what,
> the Win2k box is no longer generating any daytime queries at all.
> Hmmm..... something magical ? or some spyware that just got
> tired of retrying ? Can't say for sure, but at least the annoying
> traffic has stopped.
>
[snip]

Weird.

Have you rebooted since this crap started? Made any other changes to the
system setup?

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[CA was in NJ]

Capps wrote:

> I don't know if Linksys would have any reason to create a DOS
> attack on Microsoft but that is exactly how their software is behaving.
> If enough of the Linksys cards are deployed, the servers at
> Microsoft will be very busy rejecting Daytime requests, and have
> little time to do anything else.

Any reason they can't just drop the incoming traffic on the daytime port at
the border router?

[CA was in NJ]

Capps wrote:

> Yes, one could block at the border router. The trick here
>is that this beast is rotating across thousands of IP addresses,
>all around the world. Many of these systems are associated
>with Microsoft.

I believe the question was about Microsoft protecting its own servers. I
don't think Akamaized (ptui!) servers will be doing daytime checks back to
homebased, so blocking everything from everywhere on the daytime port should
be trivial. That is, unless I'm missing something.

Of course none of this should be happening in the first place, since some
brain-dead programmer something apparently did something stooopid.

[Jay T. Blocksom]

On 22 Aug 2003 20:17:10 GMT, in <alt.privacy.spyware>, Data64
<me@privacy.net> wrote:
>
[snip]
>
> See a related thread on Slashdot about a similar issue with NetGear
> routers hammering U Wisconsin's network
>
[snip]

Definitely a monumental cluster fsck, but probably not all that "related" to
Capps' theory, at least based on current evidence.

I've read that theory, and parts of it just don't make a lot of sense. But
without having one of the LinkSys cards in question to test myself, I cannot
be much more specific.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -