Something interesting

[Lucas Peet]

If there's anyone who's paying for a 'Business' account...I'd like to see
what their's say.

I wonder if a sniffer would decode that better - like Ethereal or somesuch.
And I'm curious as to what 'service' that is running on port 55555, and what
all this information means.  Logging of some such, probably sent out to RR,
and stuck in a log file somewhere...which is then parsed, and anything
flagged that seems out of whack - uncappers, etc...

-Lucas

----- Original Message -----
From: "Duane Attaway" <dattaway at attaway.yi.org>
To: "Lucas Peet" <lpeet at eccod.com>
Cc: <kclug at kclug.org>
Sent: Tuesday, May 07, 2002 3:19 PM
Subject: Re: Something interesting

> On Tue, 7 May 2002, Lucas Peet wrote:
>
> > I did a full portscan on my cablemodem, and port 55555 is open.  I tried
to
> > telnet to it, and this is what I got:
> >
> > 1$9$747000000$2$6$64 QAM$3$29$US Standard Cable
> >
Frequencies$4$11$4#5#6#1#2#3$5$1$4$6$4$QPSK$7$14$2559999.000000$8$9$40.90000
> > 2$9$12$DHCP SUCCESS$10$12$TFTP SUCCESS$11$11$REG SUCCESS$12$11$BPI
> > SUCCESS$13$38$CM is ALLOWED for CPE Internet
> > Traffic$14$8$49710084$15$10$1690800304$16$1$0$17$1$1$18$17$Downstream
> > Locked$19$7$32,4,32$20$8$3.008751$21$15$Ranging
> >
Success$22$5$Green$23$5$Green$24$5$Green$25$5$Green$26$5$Green$27$5$Green$28
> > $9$747000000$29$8$91000000$30$9$857000000$
> >
> > Any ideas on what this is or how I can parse the $ stuff to see what all
> > this means??
>
> hmmm... interesting... here's what I got on mine:
>
> Escape character is '^]'.
>
> 1$9$747000000$2$6$64 QAM$3$29$US Standard Cable
>
Frequencies$4$11$2#6#1#3#4#5$5$1$2$6$4$QPSK$7$14$2559999.000000$8$9$34.00000
0$9$12$DHCP
> SUCCESS$10$12$TFTP SUCCESS$11$11$REG SUCCESS$12$11$BPI SUCCESS$13$38$CM is
> ALLOWED for CPE Internet
> Traffic$14$9$274105377$15$9$762769009$16$3$170$17$2$22$18$17$Downstream
> Locked$19$7$32,4,32$20$9$-5.044711$21$15$Ranging
>
Success$22$5$Green$23$5$Green$24$5$Green$25$5$Green$26$5$Green$27$5$Green$28
$9$747000000$29$8$91000000$30$9$857000000$
>
> [root at attaway var]# nmap 192.168.100.1
>
> Starting nmap V. 2.54BETA22 ( www.insecure.org/nmap/ )
> Interesting ports on  (192.168.100.1):
> (The 1539 ports scanned but not shown below are in state: closed)
> Port       State       Service
> 67/tcp     filtered    bootps
> 68/tcp     filtered    bootpc
> 80/tcp     open        http
>
> Remote operating system guess: Alteon AceSwitch 110 (software 4.0.37)
>
> I guess its what version of software they upload to it at the time.  I
> have noticed rr changes things a lot.
>
>
> --
> Why drive a car when you can ride a bike?
> http://attaway.yi.org                   http://counter.li.org   user
#142150
>
>