Overview

InternetPeriscope is a tool for System Administrators, CTO's, Network Engineers, and anyone else who is responsible for maintaining, monitoring, and securing machines on the Internet.

InternetPeriscope enables you to:

  • Monitor your Web Servers, SMTP Servers, POP Servers, DNS Servers, and other machines on the Internet, letting you know when a machine or service is not functioning correctly, and keeping a History of a machine's problems.
  • Detect Intrusion Attempts by Hackers, in real-time, and find out the name, address, phone number, and email address of the Hacker's ISP, so you can report the incident.
  • Remotely check your servers for potential vulnerabilities and installed hacker software.
  • Remotely analyze your Internet hosts, to determine the following:
    • What Internet (TCP/IP) Services are running on your machines.
    • What RPC Services (Unix ONC and Windows DCE) are running on your machines.
    • The names of Users, Groups, Shares, and Sessions on your Windows machines.
    • The type and versions of your Web and Mail Servers.

  • Think all the domain names you want have already been registered? Try our wildcard search, or get contact info for the current owner of a domain name or IP Address.
  • Use the DNS Tool to debug your DNS problems, looking up Mail (MX), Address (A), PTR, Nameserver (NS), and Source of Authority (SOA) records from the DNS server of your choice.
  • Calculate subnet masks and IP address ranges with our handy Subnet Calculator,


Licence Agreement

SOFTWARE LICENSE

ATTENTION: PLEASE READ THIS DOCUMENT CAREFULLY BEFORE INSTALLING THIS PACKAGE. THE INDIVIDUAL OR ENTITY INSTALLING THIS PACKAGE (THE "END USER") AGREES TO BE BOUND BY THE TERMS OF THIS LICENSE. IF YOU INSTALLING THIS PACKAGE AND DO NOT AGREE TO THE TERMS OF THIS LICENSE, DO NOT USE THE SOFTWARE AND PROMPTLY DESTROY THE SOFTWARE AND ALL COPIES THEREOF.

The enclosed computer program(s) and the accompanying documentation are provided to the End-User by LokBox Software ("Licensor") for use only under the following terms. Licensor reserves any right not expressly granted to the End-user. The End-User owns the disk on which the Software is recorded, but Licensor retains ownership of all copies of the Software itself. The End-User assumes sole responsibility for the installation, use and results obtained from use of the Software.

1. License.
End-User is granted a limited, non-exclusive license to do only the following: A. Install and maintain the Software on one computer at any time for use only in the End-User's own business.

B. Make one copy in machine-readable form solely for backup or archival purposes for the computer which the Software is installed. The Software is protected by copyright law. As an express condition of this License, the End-User must reproduce on the copy Licensor's copyright notice and any other proprietary legends on the original copy supplied by Licensor.

C. Transfer the Software and all rights under this License to another party together with a copy of this License and all written materials accompanying the Software, provided (i) the End-User gives Licensor written notice of the transfer (including in such notice the identity of the transferee), and (ii) the other party reads and agrees to accept the terms and conditions of this License.

2. Restrictions.
The End-User may NOT sublicense, assign, or distribute copies of the Software to others. The Software contains trade secrets. The End-User may NOT decompile, reverse engineer, disassemble, or otherwise reduce the Software to a human readable form. THE END-USER MAY NOT MODIFY, ADAPT, TRANSLATE, RENT, LEASE, LOAN, RESELL FOR PROFIT, DISTRIBUTE, OR OTHERWISE ASSIGN OR TRANSFER THE SOFTWARE, OR CREATE DERIVATIVE WORKS BASED UPON THE SOFTWARE OR ANY PART THEREOF, EXCEPT AS EXPRESSLY PROVIDED IN SECTION 1.C. ABOVE.

3. Protection and Security.
The End-User agrees to use its best efforts and to take all reasonable steps to safeguard the Software to ensure that no unauthorized person shall have access thereto and that no unauthorized copy, publication, disclosure or distribution in whole or in part, in any form, shall be made. The End-User acknowledges that the Software contains valuable confidential information and trade secrets and that unauthorized use and/or copying are harmful to Licensor.

4. Termination.
This License is effective until terminated. This License will terminate immediately without notice from Licensor if the End User fails to comply with any of its provisions. Upon termination the End User must destroy the Software and all copies thereof, and the End-User may terminate this License at any time by doing so.

5. Export Law Assurances.
The End-User agrees that the Software is to be used only in the United States and the Software will not be transferred or exported, directly or indirectly, outside the U.S..

6. Limited Warranty.
Licensor warrants that, for 30 days from the date of initial use by the original End User, the Software shall operate substantially in accordance with the published functional specifications current at the time of shipment. If, during the warranty period, a defect appears, End User shall return the Software to Licensor and Licensor's only obligation shall be, at Licensor's election, to replace the defective Software or refund the purchase price. The End-User agrees that the foregoing constitutes the End-User's sole and exclusive remedy for breach by Licensor under any warranties made under this Agreement. This warranty does not cover any Software that has been altered or changed in any way by anyone other than Licensor. Licensor is not responsible for problems associated with or caused by incompatible operating systems or equipment, or for problems in the interaction of the Software with software not furnished by Licensor.

No oral or written information or advice given by Licensor or its dealers, distributors, employees or agents shall in any way extend, modify or add to the foregoing warranty.

THE WARRANTY AND REMEDY PROVIDED ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE END-USER ASSUMES ALL RISK AS TO THE SUITABILITY, QUALITY, AND PERFORMANCE OF THE SOFTWARE. IN NO EVENT WILL LICENSOR, OR ITS DIRECTORS, OFFICERS, EMPLOYEES OR AFFILIATES, BE LIABLE TO THE END-USER FOR ANY CONSEQUENTIAL INCIDENTAL, INDIRECT, SPECIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF DATA OR BUSINESS INFORMATION, AND THE LIKE) ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE OR ACCOMPANYING WRITTEN MATERIALS, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

LICENSOR'S LIABILITY TO THE END-USER (IF ANY) FOR ACTUAL DIRECT DAMAGES FOR ANY CAUSE WHATSOEVER, AND REGARDLESS OF THE FORM OF THE ACTION, WILL BE LIMITED TO, AND IN NO EVENT SHALL EXCEED, THE AMOUNT ORIGINALLY PAID TO LICENSOR FOR THE LICENSE OF THE SOFTWARE.

7. Enhancements.
From time to time Licensor may, in its sole discretion, advise the End-User of updates, upgrades, enhancements or improvements to the Software and/or new releases of the Software (collectively, "Enhancements"), and may license the End-User to use such Enhancements upon payment of prices as may be established by Licensor from time to time. All such Enhancements to the Software provided to the End-User shall also be governed by the terms of this License. IN ORDER FOR THE END-USER TO BE ASSURED THAT IT WILL BE ADVISED OF AND LICENSED TO USE ANY ENHANCEMENTS TO THE SOFTWARE, THE END-USER MUST COMPLETE, SIGN AND RETURN TO LICENSOR THE ATTACHED END-USER REGISTRATION CARD.

8. General.
This License will be governed by and construed in accordance with the laws of the state of California, and shall inure to the benefit of Licensor and End-User and their successors, assigns and legal representatives. If any provision of this License is held by a court of competent jurisdiction to be invalid or unenforceable to any extent under applicable law, that provision will be enforced to the maximum extent permissible, and the remaining provisions of this License will remain in full force and effect. Any notices or other communications to be sent to Licensor must be mailed first class, postage prepaid, to the following address: LokBox Software, 1557 Sloat Blvd. Suite #158, San Francisco, CA 94132 .

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof, and all prior proposals, agreements, representations, statements and undertakings are hereby expressly cancelled and superseded. This Agreement may not be changed or amended except by a written instrument executed by a duly authorized officer of Licensor.

9. Acknowledgment.
BY INSTALLING THIS PACKAGE, THE END-USER ACKNOWLEDGES THAT IT HAS READ THIS LICENSE, UNDERSTANDS IT, AND AGREES TO BE BOUND BY ITS TERMS AND CONDITIONS. Should you have any questions concerning this License, contact Licensor at the address set forth above.


System Requirements

InternetPeriscope works best with:

  • Windows NT, Windows 2000, or later
  • A Dedicated (DSL or better) Internet Connection
  • 800x600 or greater Screen Resolution

InternetPeriscope will not run on a Unix machine, but it can be used to remotely check a Unix machine's services (RPC, UDP, and TCP).

InternetPeriscope does not require a dedicated Internet connection, but it does require that you be connected to the Internet when using InternetPeriscope.


How to use the program

How to use Internet Periscope

The easiest way to use InternetPeriscope is to add a machine to Internet Periscope's console, and then right click on that machine's icon to perform actions on that machine.

The figure below shows a screenshot of InternetPeriscope with six machines in its console window. The user has right-clicked with her mouse on the machine named "anita.roamie.com" to see a list of tasks that she can choose from to perform various monitoring and analysis activities on anita.roamie.com.

In addition to right clicking on a host's icon, you may also use the Host menu to view tasks that can be performed on a host. Before invoking this menu, you can use the right and left arrow keys to change the selected host.

The Tools menu allows you to quickly perform a number of activities without the overhead of adding a host to InternetPeriscope's console. Use the Tools menu when you need to quickly get information on a host. The Tools menu also includes a number of stand-alone tools for tasks that are not host specific.


Adding a machine to InternetPeriscope's console

Adding a machine to the console

Adding a machine to InternetPeriscope's console enables you to monitor a machine for problems, and also analyze the software and services that are running on that machine.

To add a machine to InternetPeriscope's console, Click on the "Hosts" menu, and choose the "Add Host..." submenu.

A dialog box will appear prompting you to enter the Host's name or IP address.

Enter the domain name (e.g. www.internetperiscope.com), IP address (e.g. 207.104.128.41), or NetBios name into the dialog box, and click on the "OK" button.

The new host will be added to the center of InternetPeriscope's console. Click on the host's icon and drag it to a location of your choice.


Viewing a machine's properties

After you have added a machine to the console, you can view that machine's properties.

To view a host's properties, right click on the host's icon to show the menu for that host, and click on the "Properties..." menu item.

The Properties window displays information about the host, and also allows you to gather information about this host.

This dialog box shows the following:

  • The host name you entered when you added this host
  • The hosts Fully Qualified Domain Name (FQDN See "What is DNS?") for more information.
  • The hosts IP Address.
  • The reverse lookup (PTR Record) of the hosts IP address.
  • Any aliases (CNAME Records) of the host's name.
  • The Fingerprint Web Server button enables you to determine what type of web server is running on the host.
  • The Fingerprint Mail Server button enables you to determine what type of mail server is running on the host.
  • The Scan button lets you perform a port scan on the host to determine what Internet (TCP and UDP) Services are running on the host.
  • The Scan History button lets you see a history of the scans you have performed on this host. Use the Scan History to determine if unauthorized software has been installed on your machine.
  • The DNS button lets you lookup up Domain Name information about the host, including the hosts that receive email for this host's domain, and the email address of the person responsible for this domain's DNS configuration.
  • The Whois (Domain Name) button lets you lookup the name and address of the parties who registered this domain name, and also the nameservers that host this domain.
  • The Whois (IP Address) button lets you find out information on the ISP (Internet Service Provider) that is hosting this machine.


Removing a machine from InternetPeriscope's console

Removing a machine from the console

If you no longer need to monitor or analyze one of the machines that is displayed in the console, do the following:

Right click on the machine to reveal its menu.

Click on the "Delete" menu item to delete the host.

When asked to confirm the deletion, click on the "Yes" button.


How to monitor a remote machine for problems

InternetPeriscope enables you to monitor a remote machine's Web Server, SMTP Server, and/or DNS Server for problems. It also allows you to monitor a machine by "pinging" it to make sure it is working. It checks the services you designate every five minutes, to ensure that the machine is functioning correctly.

If a machine is having problems, its icon will first blink yellow, and then red, as shown in the figure.

This image shows two machines having problems. anita.roamie.com has been having problems for some time, and is blinking red. miso.roamie.com just started having problems, and is blinking yellow.

To enable host monitoring, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "Monitor" menu, and then click on the "Setup Host Monitoring..." menu item, as shown in the Figure.

The host monitoring dialog appears.

  • If this host is running a Web Server, click on the "Web Server" check box to monitor the Web Server.
  • If this host is used for sending email, click on the "Mail (SMTP) Server" checkbox to monitor the Mail Server.

    If you are unsure which hosts receive email for your domain, see Finding out which hosts receive email for a domain name (MX Records).
  • If this host is used for checking email, click on the "Pop Server" check box to monitor the POP server.
  • If this host is running a Domain Name (DNS) Service, click on the "DNS Server" check box to monitor the DNS Server.

    If you are unsure which hosts handle DNS for your domain, see Finding out which Name Servers are authoritative for a domain.
  • To periodically check that this host is "up", click on the "ICMP Ping" to ensure the host has not "crashed".

Click on the "OK" button, and InternetPeriscope will immediately begin monitoring the services you selected. If InternetPeriscope determines that one of the selected services is having problems, the icon of that machine will blink yellow, then red.

If a machine's icon is blinking red or yellow, you can get more information on the problems the machine is having by double-clicking on the machine's icon, or by viewing the machine's problem history.

If you would like to receive an email notification when one of your machine's is having a problem, see Setting up email notification

Important Notes:

  • Be sure to leave InternetPeriscope running on your workstation at all times -- otherwise, it will not be monitoring your remote hosts, or keeping a history of their problems.
  • If your machine hosts several different websites, it is recommended that you add an icon for each of these sites to the console, and setup monitoring for each of these sites. For example, if your machine hosted two web sites, www.internetperiscope.com and www.thehungersite.com, then you should add an icon for each of these sites to the console, and setup Web Site monitoring for both.
  • A slow or bad connection between your machine and the remote host you are monitoring may cause a machine to temporarily blink yellow or red.
  • A firewall may cause a monitored machine's icon to erroneously blink red. For example, if your remote host is behind a firewall that prevents "pings", and you are running InternetPeriscope from outside the firewall, monitoring "ICMP Pings" on that machine will cause it's icon to blink red, even though the machine is not having problems.


Viewing a machine's problem history

InternetPeriscope enables you to keep a history of the problems a remote host has experienced, helping you to determine if a machine should be replaced or upgraded.

It also notifies you in real-time that a machine is having problems, enabling you to fix the problem before it affects your users or customers.

Before viewing a machine's problem history, you must first add that machine to the console, and setup monitoring for that machine.

To view a host's problem history, right click on that host's icon, move your mouse over the "Monitor" menu item, and click on the "Problem History..." menu item, as shown in the Figure.

InternetPeriscope will display a dialog displaying a history of problems this machine has had. The display includes the date and time that the problem was detected, the monitored service that had the problem, and, if available, the date and time that the service recovered.


Setting up email notification

InternetPeriscope can send you email notifications when it detects that one or more of your machines is having problems.

Before setting up email notification, you must first add that machine to the console, and setup monitoring for that machine.

To setup email notification, right click on that host's icon, move your mouse over the "Monitor" menu item, and click on the "Setup Host Monitoring..." menu item, as shown in the Figure.

The "Monitor Host" dialog appears as shown below
To receive email when InternetPeriscope detects a problem, you must first select the services you want to monitor. See How to monitor a remote machine for problems for more information.

After you have chosen the services you wish to monitor, do the following:

  • 1.) Click on the "Enable Email Notification" checkbox to tell InternetPeriscope that you want it to send you an email when it detects a problem with this machine.

  • 2.) Enter your email address in the "Send Email To" checkbox.

  • 3.) When InternetPeriscope sends you an email, it needs to "fill out" the from address in that email. Enter the email address that these emails should come from. If you are unsure of what to enter here, enter your own email address in this textbox. To prevent emails from bouncing, this should be a valid (real) email address.

  • 4.) Enter the SMTP server that InternetPeriscope should use to send you an email. Your ISP or IT department should have given you the name or IP address of your SMTP server when you setup your email program.

    If you do not know what your SMTP server's name is, you can probably determine it's name by checking your email program's settings. For example, if you use Outlook Express, click on the "Tools" menu, then click on the "Accounts" menu, then click on the "Mail" tab, then click on the "Properties" button, and click on the "Servers" tab to see your SMTP server.

  • 5.) Enter the Subject that you would like to have in the "Email Subject" textbox. When you receive the email, it will have this text in it's subject line.

  • 6.) Click on the "Test Email" button to send yourself a test email. Check your email program to make sure you receive the email. This will confirm that everything is working.


Finding out what Internet (TCP/IP) Services your remote host is running

Finding out what TCP and UDP Services your remote host is running

InternetPeriscope can help you determine what Internet Services are running on your host by enabling you to do Port Scans on your remote machine.

A Port scan can give you a better idea of what software your machine is running. This is important for the following reasons:

  • Hackers often perform port-scans to determine a host's vulnerabilities. You should know what the hackers see when they scan your machines.
  • A Port Scan can help you to determine what unnecessary services are running on your remote machine. Turning off unneeded services makes it more difficult for a hacker to break into your machine.
  • By periodically performing a Port Scan on your machines, and using the Scan History feature, you can determine if unauthorized (i.e. hacker) software has been installed on your remote host.
  • "Firewalls" often give a false sense of security. By using InternetPeriscope's Port Scan feature from outside the firewall, you can confirm that your firewall is working as expected, and also find what vulnerabilities can still be exploited from outside the firewall.

Before you can perform a Port Scan on a machine, you must first add the host to the console.

Then, right-click on the host, and choose the "Port Scan..." menu item, as shown in the figure.

The Port Scan Dialog will appear.

This dialog allows you to scan for TCP and/or UDP ports. Some Internet services use TCP ports, some use UDP ports, and some use both. For example, mail (SMTP) servers use TCP Port 25. BackOrifice, a popular hacker tool, uses UDP Port 31337 (among others). DNS, uses both TCP and UDP port 53. Each Internet Service "listens" on a designated port. To find out which services run on which ports, see Finding out what an Internet Services does (TCP/IP Ports and Descriptions)

You must enter the Start Port and End Port that you want to scan on the selected host. Port numbers range from 1 to 65535. "Well-known" Internet services like ftp, telnet, and mail run in the range 1 - 1024. Many of the better-written hacker utilities run at the higher port numbers. InternetPeriscope includes a list of many port numbers and their descriptions, though new services are being added all the time.

Click on the "Scan" Button to start the scan. The Internet Services that this host is running will appear in the "Ports Found" list box.

After several scans, you can use the scan history button to see a history of the Port Scans you have performed, and the services that were found (or found to have been removed) on each scan.

In addition to scanning your machines for TCP/IP services, you should also determine what Remote Procedure Calls (RPC) Services your machines are running. See Finding out what RPC Services your Unix machines are running and Finding out what RPC Services your Windows machines are running for more information.

Note to techies: Some services that are found by the port scan may be RPC services. The port scan will tell you that these ports are in use, but most likely will not give you a description of these services (RPC services are not typically assigned well known port numbers). To find out what ports are used by RPC services, use the RPC Unix or RPC Windows tools to find out which UDP and TCP ports are used by RPC services.


What is RPC?

InternetPeriscope enables you to determine what Remote Procedure Call (RPC) Services are running on your Unix and Windows machines.

RPC is an application level interface that allows programmers to develop distributed applications. Programmers create applications by writing "functions." RPC enables a programmer to write a program that runs on one machine, and makes remote procedure calls (function calls) to another machine, thus utilizing the resources of two machines.

There are two industry standards for RPC. Microsoft Windows machines typically implement the Network Computing System (NCS) standard. Unix machines typically implement the Open Network Computing (ONC). Note that it is possible for both Windows and Unix machines to run either standard. This is often done so that Windows and Unix machines can interoperate (e.g. share files).

Many popular services are implemented using RPC, including the Network File System (NFS) and the Network Information Service (NIS) on Unix, and Directory Services and DCOM on Windows platforms.

InternetPeriscope enables you to query either type of RPC server, to find out what RPC services the host supports.

It is recommended that you use InternetPeriscope to query all your hosts for both types of RPC. Recently, RPC services have become a favored target of hackers. It is strongly recommended that you disable any unneeded RPC services. InternetPeriscope can help you to determine which unnecessary services are running on your remote hosts.


Finding out what RPC services your Unix machines are running

InternetPeriscope enables you to query the Sun RPC Portmapper service to determine what RPC Services are running.

Before you can query the Portmapper service, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "Remote Procedure Call (RPC)" menu, and then click on the "Query Sun RPC Portmapper Service...(for Unix machines)" menu item, as shown in the Figure.

After a few moments, a dialog will pop up displaying that machine's RPC services.

This dialog displays the following:

  • A Program Number. Each RPC service is assigned a unique Program Number. In this example, the nlockmgr service is assigned the Program Number 100021.
  • A Version Number. RPC Services have revision numbers like any other kind of software. The first version of an RPC Service is usually "1", the second version "2", etc. Note that in the figure above, that there are multiple versions of the nlockmgr service. This is done for backward compatibility. An older client program, written for version 1 of the nlockmgr service (and written before version 2, 3, or 4 were available), will request version 1 of the nlockmgr service. Newer client software will request version 4 of the software. In this way, client software that uses this RPC service does not have to be upgraded (re-written) each time the RPC service software is upgraded.
  • The transport protocols that a client can use to connect to this service. In this example, udp and tcp are displayed. TCP is a connection-oriented transport layer protocol. UDP is a connectionless transport layer protocol. See "Finding out what TCP/IP services your remote host is running" for more information on TCP and UDP.
  • The port number used by the transport protocol. See "Finding out what Internet (TCP/IP) Services your remote host is running" and "Finding out what an Internet Service does (TCP/IP Ports and Descriptions)" for more information.
  • The name of the service.


Finding out what RPC services your Windows machines are running

InternetPeriscope enables you to query the Microsoft DCE Locator Service, a service that provides you with a list of RPC services that are running on your machine.

Before you can query the Locator service, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "Remote Procedure Call (RPC)" menu, and then click on the "Query Microsoft DCE Locator Service..." menu item, as shown in the Figure.

After a few moments, a dialog will pop up displaying that machine's RPC services.

This dialog displays the following:

  • A Protocol. To see a description of the protocol, click on the item in the list box. In the figure above, the user has clicked on the third item in the list box. A description of that protocol, ncacn_http appears below the listbox, stating that ncacn_http is "Connection Oriented TCP/IP using Microsoft Internet Information Server as HTTP proxy."
  • A Network address. The network address type is dependent on the protocol type. For example, TCP and UDP protocols use IP Addresses (e.g. 192.168.100.202). The named pipes protocol uses a NetBios name like "\\HANNAH".
  • A Port or Endpoint. This field is also dependent on the protocol type. A TCP or UDP protocol will specify a Port Number. The Named Pipes protocol will specify a name like "\PIPE\INETINFO"
  • A Description of the service.
  • The version of the service.


What is NetBT?

NetBT is an acronym that means "NetBios over TCP/IP". NetBios stands for "Network Basic Input Output System". TCP/IP stands for "Transport Control Protocol/Internet Protocol".

NetBios is a session layer API. As such, it can run on a variety of transport protocols, such as TCP/IP, NetWare, VINES, etc. An API is an application-programming interface. The NetBios API defines an interface that programmers can use to write code that performs various networking functions. NetBios functions enable a programmer to write programs that can log in to a remote machine, connect to a shared drive on a remote machine, get a lists of sessions and users from a remote machine, and many other networking tasks.

TCP/IP is commonly referred to as the "Internet Protocol". It is responsible for sending and receiving data to and from your machine and the Web Servers, Mail Servers, and DNS servers you use on the Internet. It is the protocol that makes it possible for you to use the Internet.


Getting a list of Users from your Windows machines

InternetPeriscope allows you to view a list of user accounts on a remote Windows machine using NetBT.

Before you can get a list of users, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "NetBT (NetBios over TCP/IP)" menu, and then click on the "Get list of users" menu item, as shown in the Figure.

If you are not currently logged in to the remote machine or it's domain, you will see the message shown in the figure.

Click on the OK button to see the login dialog.

Enter your username and password, and click on OK. Note: this dialog can also be used to check for the "Null Session Vulnerability". After a few moments, a dialog will appear, displaying the local user accounts that have been created on that machine.


Getting a list of Shares from your Windows machines

InternetPeriscope allows you to view a list of shares on a remote Windows machine using NetBT. A "share" is a directory or printer on a server that can be used remotely by authenticated users on their workstations. This allows many users to "share" the printer or disk space.

Before you can get a list of shares, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "NetBT (NetBios over TCP/IP)" menu, and then click on the "Get list of shares" menu item, as shown in the Figure.

If you are not currently logged in to the remote machine or it's domain, you will see the message shown in the figure.

Click on the OK button to see the login dialog.

Enter your username and password, and click on OK. Note: this dialog can also be used to check for the "Null Session Vulnerability".

After a few moments, a dialog will appear, displaying the shares that have been created on that machine.

This dialog displays shared printers and directories that are hosted by that machine. Note that share names that end with a "$" are called "Administrative" or "Hidden" shares. These shares are typically hidden from normal Users. That is, users will not see these shares when browsing through their "Network Neighborhood" or "My Network Places". These shares are setup for various administrative and operating system tasks.


Getting a list of Groups from your Windows machines

InternetPeriscope allows you to view a list of groups on a remote Windows machine using NetBT.

Groups enable an administrator to more easily perform administrative tasks. An administrator may wish to give 100 different users permissions to use two different shared printers. Individually assigning each of the users permission to both of the printers would take a very long time. Instead, the administrator can create a "Group", and add the 100 users to the group. Then, she can give the group permission to use each of the printers. This greatly reduces the administration time and complexity.

Before you can get a list of groups, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "NetBT (NetBios over TCP/IP)" menu, and then click on the "Get list of Local Groups" menu item, as shown in the Figure.

If you are not currently logged in to the remote machine or it's domain, you will see the message shown in the figure.

Click on the OK button to see the login dialog.

Enter your username and password, and click on OK. Note: this dialog can also be used to check for the "Null Session Vulnerability".

After a few moments, a dialog will appear, displaying the Local Groups that have been created on that machine.

On the left side of this dialog box, a listbox displays the list of Local Groups. In this figure, the user has clicked on the "FTP Users" group, to see that the "FTP Users" group includes the users Alex, Ali, Amy, and Elmo (shown in the listbox on the right).


Getting a list of Sessions from your Windows machines

InternetPeriscope allows you to view a list of sessions on a remote Windows machine using NetBT.

When a user connects to a shared printer or directory on a remote machine, a "session" is created for that connection.

Before you can get a list of sessions, you must first add the machine to the console.

Then, right click on the machine's icon, move your mouse over the "NetBT (NetBios over TCP/IP)" menu, and then click on the "Get list of Sessions" menu item, as shown in the Figure.

If you are not currently logged in to the remote machine or it's domain, you will see the message shown in the figure.

Click on the OK button to see the login dialog.

Enter your username and password, and click on OK. Note: this dialog can also be used to check for the "Null Session Vulnerability".

After a few moments, a dialog will appear, displaying the Sessions that are active on that machine.

In this figure, there are currently three remote sessions to this machine.

  • The user named "administrator" has been logged on from the machine named "Anita" for one hour and 51 minutes.
  • There is a NULL Session from the machine named "Miso".
  • The user named "administrator" has been logged on from the machine named "Miso" for one hour and 52 minutes. This user is currently doing something with one of this machine's resources (perhaps a printer or share), as the idle time is shown as zero minutes.


Determining what type of Web Server a host is running

InternetPeriscope can help you determine what type and version of Web Server is running on a remote host.

To find out what kind of Web Server a host is running, click on the Tools menu, move your mouse over the "Fingerprint" menu item, and click on "Web Server" as shown in the Figure below.

A dialog will appear prompting you for host's domain name or IP address.

Enter the host's name, and press OK. In the Figure below, the user has entered the domain name "www.internetperiscope.com".

After a few moments, InternetPeriscope will display the name of the host's Web Server, as shown below.


Determining what type of Mail Server a host is running

InternetPeriscope can help you determine what type and version of Mail (SMTP) Server is running on a remote host.

To find out what kind of Mail Server a host is running, click on the Tools menu, move your mouse over the "Fingerprint" menu item, and click on "Mail Server" as shown in the Figure below.

A dialog will appear prompting you for host's domain name or IP address.

Enter the host's name, and press OK. In the Figure below, the user has entered the domain name "mail.internetperiscope.com". If you are unsure which host(s) receive email for your domain you can use InternetPeriscope's DNS Tool to find out which hosts receive email for your domain.

After a few moments, InternetPeriscope will display the name of the host's Mail Server, as shown below.

This dialog shows that the host mail.internetperiscope.com is running Sendmail version 8.9.0.

InternetPeriscope "asks" the mail server what version it is running. In the dialog box, there is a section titled "What the server 'said'". This section shows the full text that the mail server sent to InternetPeriscope.


Checking your Website for broken links

InternetPeriscope can help you check your website for broken links.

Over time, you may find that your website has links to other websites that no longer exist. Alternatively, if you remove a page that is no longer needed from your website, you may forget to update the pages that link to the old, deleted page. When a user clicks on one of these "dead" links, they will get an error message.

To analyze your website for broken links, click on the "Tools" menu, move your mouse over the "website" submenu, and click on "Check website for broken links", as shown in the figure below.

A dialog box appears, prompting you for the website hostname. Enter your websites name in the box as shown below:

InternetPeriscope will begin checking your website for bad links, and display the dialog shown

  • At the top of the dialog box is a status message, that shows you which webpage is currently being checked for errors.

  • Below the status message is a read-only edit control that lists any errors that have been found. In the current figure, no errors have yet been found.

  • Below the error messages is a listbox that shows the names of all of the webpages that have been checked so far.

  • Below the list of urls is a list of urls that InternetPeriscope could not check. For example, InternetPeriscope has no way of checking "mailto" links, so it lists them here. These links can be checked manually by clicking on one of the links in the listbox to select it, and then clicking on the "Open URL" button located at the bottom of the dialog.
  • At the bottom of the listbox are a list of "foreign urls". These are urls that your webpages have links to, but these pages are not part of your website, they are part of another organization's website, hence the name "foreign". InternetPeriscope checks to make sure that these pages are reachable, but it does not check them for errors.

  • At the bottom of the dialog is an "Open URL" button. If you click on an entry in one of the listboxes, or select some text in the Error textbox, you can then click on this button to open the URL in question.

  • You can use the "Stop" button to stop the check of further urls. If you click on "Stop", you will be given a chance to view the results of the scan, but InternetPeriscope will not continue checking urls.

  • Click on the "Done" button to remove the dialog from the screen.


Detecting Intrusion Attempts by Hackers

InternetPeriscope allows you to detect Intrusion Attempts by Hackers. A Hacker may run a port scan against your machine, or may try to connect to a particular port as part of a scan of many machines. The hacker does this in order to find vulnerabilities in your machine. InternetPeriscope allows you to detect these and other Hacker activities to safeguard your machines.

To detect Hacker probes of your machines, click on the "Hosts" menu, move your mouse over the "This Host" submenu, and click on "Detect Hacker Probes (Port Scans)" as shown in the Figure below.

The "Detect Hacker Probes" dialog box will appear.

Click on the "Enable Port Scan Detection" checkbox to enable Port Scans.

There are two listboxes that list the TCP Ports and UDP Ports that InternetPeriscope will "watch" for hacker activity on.

TCP stands for "Transmission Control Protocol". UDP stands for "User Datagram Protocol". When a programmer writes a new Internet Service, she may use either or both of these Layer 4 protocols to implement the new service. Each Internet service is assigned a port number. A program wishing to connect to this service can connect to that port number using the correct protocol (TCP or UDP).

For example, your mail program connects to TCP Port 25 on your mail server when it wishes to send mail. Port 25 is the well-known port for SMTP (mail) servers. Your mail program connects to TCP Port 110 on your mail server when it wishes to check your mail, as port 110 is the well known port for a POP Server.

Similarly, when you "surf" the web, you are connecting to port 80 on various machines. If you went to http://www.microsoft.com in your web browser, your browser software would be connecting to TCP port 80 on Microsoft's web server.

There are two listboxes shown in the "Detect Hacker Probes" dialog box. One is labeled "Detect Scans on these TCP Ports". This listbox lists the TCP Ports that InternetPeriscope will "listen to" for hacker probes. The other listbox lists the UDP ports that InternetPeriscope will listen for unwanted activity on.

InternetPeriscope can only listen on Ports that your machine is not already using. For example, if the machine you are running InternetPeriscope on is running a Web Server, you will not be able to have InternetPeriscope monitor port 80 on that machine. InternetPeriscope will display an error message if you try to do this. For a list of ports that your machine is already using, see "Finding out what Internet (TCP/IP) Services your remote host is running".

Note that the default list of Ports that InternetPeriscope monitors includes a number of Hacker software programs, like "BackOrifice". It is strongly recommended that you monitor as many services as possible. See Finding out what an Internet Service does (TCP/IP Ports and Descriptions) for descriptions of the different ports that you may wish to monitor.

You can add and remove ports from the "monitored" lists by using the Add and Remove buttons on the right side of the dialog box. In the figure below, the user is adding TCP Port 80 to the list by entering the number "80" into the text box, and clicking on the "Add TCP Port" button. She knows that the only people likely to make a connection to a web server on her machine are hackers searching for vulnerable web servers.

In the figure below, the user is removing the tftp port from the UDP list of monitored ports. She is doing this because she is running a TFTP server on the machine that she is running InternetPeriscope on. She cannot have InternetPeriscope monitor port 69, AND run a tftp server, as the two programs will interfere with each other. When she tried to setup UDP port 69 for monitoring, InternetPeriscope displayed an error, telling her that this port was already in use. For a list of ports that your machine is already using, see Finding out what Internet (TCP/IP) Services your remote host is running". Note that if you enable Port Scan detection, a port scan of this machine will also display the ports that InternetPeriscope is monitoring.

After you have enabled Port Scan Detection, click on the OK button. If you have selected any ports that are already in use by your machine, you will see an error message similar to the following:

In this case, the user needs to go back to the "Detect Hacker Probes" dialog box, and remove UDP port 135, by clicking on Port 135 in the UDP listbox, and then clicking on the "Remove UDP Port" button.

When a hacker attempts to probe your machine, you will see a message similar to the following:

See How to contact the Hacker's ISP for information on what to do when a hacker probe is detected.

InternetPeriscope also allows you to view a history of intrusion attempts.


Viewing a History of Intrusion Attempts

InternetPeriscope allows you to keep and view a history of Hacking attempts.

Before you can view the history of intrusion attempts, you must setup Intrusion Detection.

To see a history of Intrusion Attempts, click on the "Hosts" menu, move your mouse over the "This Host" menu, and click on the "History of Detected Port Scans..." menu item, as shown in the figure below.

The Detected Port Scans dialog box appears. This dialog box shows several hacker attempts in the "Detected Ports Scans" listbox. You can click on any of the scans in this listbox to see what the hacker attempted to probe. In this example, the hacker attempted to connect to port 111, the Sun RPC Portmapper Service. As of this writing, this is a very popular port to test with Hackers from outside the US.

Click on the "Get ISP contact info (arin.net)..." button to bring up the Whois (arin.net) dialog box.

The whois.arin.net dialog appears. Click on the search button to find out the hacker's ISP. Note that the Registry is set to the American Registry for Internet Numbers.

After a few moments, InternetPeriscope displays the Whois Search Results Dialog.

The text informs us that these IP addresses are managed by European Regional Internet Registry (RIPE). To find the hacker's ISP, we must ask InternetPeriscope to search this registry for us. Click on OK to remove the Results dialog box.

Change the Registry to "RIPE" as shown in the figure below, and click on the Search button.

After a few moments, the following results will be displayed.

Scrolling through this information, you will see a number of email addresses. It is recommended that you send a complaint email to all of these addresses, notifying them of the intrusion attempt.

You may be able to find out more information about the hacker by using InternetPeriscope's Whois and DNS features.


How to contact the Hacker's ISP

InternetPeriscope enables you to get the name, address, phone number, fax number, and email address of an attempted intruder's Internet Service Provider (ISP). InternetPeriscope's Whois IP address Tool enables you to do this.

In some cases, InternetPeriscope can also get you the name, address, phone number, fax number, and email address of the hacker's employer.

In the figure below, the user is Viewing a History of Intrusion Attempts, Specifically, the user is viewing information on the intrusion attempt from IP address 4.60.103.165. (This is from a real intrusion attempt. Intrusion attempts are a common occurence, and this in no way should be considered a blemish on the reputation of the ISPs mentioned here.)

Note that this hacker attempted to connect to port 111, the SunRPC Portmapper service. As of this writing, many hacker's have been scanning machines for exploits against this service.

First, the user will obtain the hacker's ISP information by clicking on the "Get ISP contact info (arin.net)..." button. The brings up the "Whois (arin.net)" dialog box shown below.

Note that the IP address, 4.60.103.165 has already been filled in for you in the "Search String" box.

Also note that the Registry is set to the "American Registry for Internet Numbers". If it turns out that this intrusion attempt came from Europe or Asia, you will have to select the appropriate registry (InternetPeriscope will let you know if this is necessary).

The user then clicks on the Search button to find the ISP's contact information. Unfortunately, the "American Registry for Internet Numbers" is busy, and displays the following message.

The user clicks on the OK button, waits 10 seconds, and then again clicks on the Search button to obtain the following results:

Here we see that BBNPlanet is the Maintainer of the hacker's IP address. We also see that it might be a good idea to send an email to genuity.net about this incident. Scrolling down, we see near.net, bbnplanet.com, and barrnet.net also take part in managing the IP address range that contains the hacker's address.

At this point, you would probably want to send email to: abuse@genuity.net, abuse@near.net, abuse@bbnplanet.com, and abuse@barrnet.net, (and any email addresses listed in the whois results), notifying them of the date, your timezone, the hacker's IP address, and the port scanned by the intruder.

If the attack is of great concern, you may wish to find even more contact info for these ISPs, to make sure the relevent people are notified. InternetPeriscope enables you to do this with its Whois (Domain Name) Tool, and by using its DNS features to find the Source of Authority for the domains (genuity.net, near.net, bbnplanet.com, and barrnet.net).

In this case, the user wishes to find more contact information for BBNPlanet, as she feels that they are the best point of contact for this incident. She closes all the open dialogs, and then invokes the "Whois (Domain Name)" dialog box by clicking on the Tools menu, moving her mouse over the "Whois" menu item, and clicking on "Domain Name...", as shown in the figure.

She enters "bbnplanet.com" into the "Search String", and clicks on "Search".

The figure below shows that she now has a few more email addresses and phone numbers she can use to contact the ISP (scroll down to see all of them.)

Going back to the Intrusion History dialog, we see that InternetPeriscope has found a host name, lsanca1-ar20-4-60-103-165.vz.dsl.gtei.net, for the hacker's machine.

InternetPeriscope did this by using DNS to look up the PTR Record for the IP address 4.60.103.165. Since InternetPeriscope was able to find the host name, the "Get Domain Contact Info (networksolutions)..." button is enabled. If InternetPeriscope cannot find a host name, this button will be disabled.

The user then clicks on the "Get Domain Contact Info (networksolutions)..." button and the dialog shown below appears.

InternetPeriscope has "guessed" that you wish to find contact info for the domain gtei.net (Remember that the host name is: lsanca1-ar20-4-60-103-165.vz.dsl.gtei.net, and that whois is used for looking up Second Level Domain [SLD] Names.)

The user then clicks on the Search button to obtain the following results:

This dialog displays email addresses at bbnplanet.com and gtei.net. In addition to these addresses, the user should also send email to abuse@bbnplanet.com and abuse@gtei.net. Most ISP's maintain an "abuse" address for handling hacker and spam problems.

Using the Whois dialogs to find contact info for ISPs and domains in Europe and Asia requires that the user use a different registry. The reader is referred to the Whois (IP Address) and Whois (Domain Name) documentation.


Checking your Web Server for vulnerabilities

InternetPeriscope can check your Web server for vulnerable scripts which hacker's could use to compromise your web site.

When you install a webserver (e.g. IIS, Apache, etc.) on your Internet Host, many files will be copied to your host, including a number of programs and scripts.

Hacker's like to investigate the many files that are installed by default when you install a Web Server or other Web-enabling (e.g. Shopping Cart) software.

Often, they are able to find vulnerabilities in these scripts and programs that enable them to exploit your web server.

There are many lists of such potential vulnerabilities on hacker sites, as well as programs to test for them.

InternetPeriscope enables you to test for many of these scripts and programs, enabling you to remove or patch any vulnerable scripts or programs that may be on your Web server.

Click on the Tools menu, move your mouse over the "Check for Vulnerabilities" menu item, and click on "Check Web Server...", as shown in the figure.

Enter the domain name of the Web server you wish to check for vulnerable scripts. In the example below, the user enters "www.internetpersicope.com", and clicks on the OK button.

After a few moments, the "Results of Web Server Vulnerability Test" dialog appears.

At the top of the dialog box is a listbox that shows the vulnerabilities that were tested. Note that hackers are finding new vulnerabilities every day, and that this list should by no means be considered exhaustive.

Underneath that list, is a list of the vulnerabilities that were found. In this case, InternetPeriscope found that there is a file called "test-cgi" on the server. "test-cgi" is known to be a target of hackers. This script should probably be removed, or at least the version should be checked to see if any vulnerability have been fixed. It would also be a good idea to use go to one's favorite Web Search engine, and search for the words "test-cgi hack", for more information.

Very Important: If your web server hosts more than one website, it is important that you test all of the websites separately for vulnerabilities. For example, if your web server hosts two websites, one called www.securityisfun.com, and another called www.myhobbies.com, then it would be important to test each of these sites separately for web script vulnerabilities.


Determining if your Window's machines are vulnerable to a "Null Session" attack

Microsoft Windows machines allow remote users to log in remotely (or via their domain) to a server in order to use a shared resource, such as a printer or shared directory. Once a user is logged in, their connection to the remote machine is referred to as a "session".

Microsoft Windows Servers run many services and programs. Some of these services need to communicate with other Windows Servers in order to complete their tasks. Sometimes, a Windows server needs to create a "session" with another Windows server. In some cases, a Windows server will login to a remote Windows Server using a blank username and password. This is referred to as a "Null Session".

Unfortunately, a number of hackers have learned that they also can login to some remote Windows Servers using a blank username and password. They can use this to obtain NetBios information from this machine, and to perform various other exploits against this machine. This is referred to as exploiting the "Null Session Vulnerability".

InternetPeriscope allows you determine if your Windows machines are susceptible to the "Null Session Vulnerability".

In order to complete this test on one of your servers, you must run InternetPeriscope on a machine that is not logged in to that server (i.e. not currently sharing a drive or printer, and not logged onto the server's domain, if any.)

To check for this vulnerability, click on the Tools menu, move your mouse over the "NetBT" menu item, and click on the "Get list of users..." menu item, as shown in the figure.

Enter the domain name of your Windows server in the resulting dialog box.

After a few moments, you will see an error message.

If you do not see an error message, then you are already logged into this remote server. Log out of the server (try rebooting your machine), or run the test from another machine that is not currently connected to the server.

Click on the OK Button, to remove the error message, and you will see the dialog shown below.

We wish to test for the "Null Session Vulnerability" by attempting to login to the remote host using a blank username and password. Leave the username and password fields blank, and click on the OK button.

A dialog appears, displaying a list of user accounts on that machine. We were able to see this list of user accounts by using a blank username and password. This tells us that this machine is vulnerable to the "Null Session Vulnerability". Had InternetPeriscope instead presented us with another error message, we would know that this machine is not prone to that vulnerability.


Checking your machines for vulnerabilities (pretending you're the hacker)

Using InternetPeriscope, you can scan and test your machines for vulnerabilities. It is recommended that you do this periodically (at least once a month), as software updates, configurations, and hacker activity can make a previously "safe" machine vulnerable to a hacker's attack.

The following list illustrates a few of the ways you can use InternetPeriscope to test your machines for vulnerabilities:
  • Is your firewall working the way you think it should? Has your firewall's configuration changed? Run a Port Scan from a machine outside of your firewall, to see what the hacker's see when they scan your machines. Use the Scan History feature to determine if your firewall configuration has changed. If it has changed, make sure you know why.

  • Run a Port Scan from inside your firewall (if you have one), to see what Internet Services are installed on your machine. Run this test for all ports (1-65535) and for all protocols (UDP and TCP). Does InternetPeriscope list any of these services as hacker software? Can any of these services be disabled? Disabling unsused services can make your machines less vulnerable to attack.

    Does the Scan History show that any suspicious software has been installed since your last scan?

  • Many hackers attempt to exploit RPC services. Are there any Unix RPC Services that you can remove from your machines? Are there any Windows RPC Services that you can remove from your machines? Removing unnecessary services can make your machines less vulnerable to attack.

  • Check your Windows machines for the Null Session Vulnerability.

  • Check your Windows machines for unused user accounts. Unused accounts should be deleted or disabled as they make it easier for hackers to guess logins and passwords. InternetPeriscope can give you a list of accounts. It is up to you to determine which accounts are in use. It is recommended that you disable the Guest account on all Windows machines.

  • Periodically check your Windows machines to see what Sessions are active. Are any of these Sessions suspicious? Can you account for all the Null Sessions?

  • Use InternetPeriscope to fingerprint your web servers. Are you running the most recent versions? Often, web software is updated with hotfixes and patches to fix vulnerabilities.

  • Use InternetPeriscope to fingerprint your mail servers. Are you running the most recent versions? Often, mail software is updated with hotfixes and patches to fix vulnerabilities.

  • Use InternetPeriscope's Intrustion Detection Service (IDS) to find out if hacker's are scanning your machine. Use the Intrustion History feature to find patterns of attack.

  • Check your Web Servers to see if they have vulnerable cgi-scripts or programs,

  • Monitor as many machines and services as possible. This can alert you to Denial of Service (DOS) attacks against your machines, enabling you to respond quickly. Malicious hackers use DOS attacks to disable services on your machines.


Scan History - checking your machines for suspicious software additions

InternetPeriscope allows you to see a history of the Port Scans that you have performed on your remote hosts.

By checking your Port Scan history, you can determine if unauthorized software has been installed on your machines. If you run Port Scans from outside your firewall, you can use the Port Scan History to ensure that your firewall's configuration has not changed over time, and that your firewall has not been accidentally misconfigured.

To view a host's Port Scan History, right click on the host, and choose "Port Scan...", as shown in the Figure below.

The Port Scan dialog will appear. Click on the "Scan History" button that appears in the middle of this dialog.

The Scan History dialog appears.

This dialog tells us that:

  • The user performed a Port Scan on 6/4/01, to determine what services were running on this machine. She scanned ports 1-65535 for both TCP and UDP because she wanted a list of all of the Internet Services that were running on this machine. The results of this scan are shown on the right side of the dialog.
  • On 7/4/01, she again scanned the same ports on this machine. She did this to determine if any new services had been installed on this machine. The results of this scan are shown on the left side of the dialog.
  • She found that a several services (finger, RPC Portmapper, and NFS) had been installed on her machine. She plans on finding out why these services were installed. She wants to be sure this software is needed and has been authorized.
  • She has also found that "BackOrifice", a popular Hacker software program, has been installed on this machine. This is a very serious security breach requiring immediate attention.


Checking startup files for trojans

This feature was motivated by All Known and Unknown Autostarting Methods used for executing files by TLSecurity.net and ANTH®ªX

A virus or trojan may install itself on your machine so that it "auto-starts" every time you restart or login to your machine. InternetPeriscope helps you check these startup mechanisms to see which programs are automatically launched when you login or restart your program.

To check your startup files, click on the Hosts menu, move your mouse over the "This Host" menu item, and click on "Check Startup Files for Trojans..." as shown in the figure.
After a few moments, the following dialog will appear.

InternetPeriscope checks the following auto-start mechanisms, displaying any that are used on your system:

  • It finds any files that are located in the logged in user's Autostart folder.

  • It checks the "load=" and "run=" sections in your win.ini file. Note to Techies: These sections may actually reside in the registry if your system does not have these sections in the win.ini file. InternetPeriscope should find them wherever they are.

  • It checks the "Shell=" section of system.ini.

  • It checks for a winstart.bat file in your windows directory.

  • It checks the following registry keys:
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

  • It checks for a wininit.ini file in your Windows directory.

  • It checks to see if there is an autoexec.bat file on your C drive.

  • It checks the following registry keys to make sure that their value is "%1 %*" and not something else like "trojan.exe %1 %*" (known as the Unknown Starting Method).
    • HKEY_CLASSES_ROOT\exefile\shell\open\command
    • HKEY_CLASSES_ROOT\comfile\shell\open\command
    • HKEY_CLASSES_ROOT\batfile\shell\open\command
    • HKEY_CLASSES_ROOT\htafile\shell\open\command
    • HKEY_CLASSES_ROOT\piffile\shell\open\command
    • HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command
    • HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command
    • HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command
    • HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\shell\open\Command
    • HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command

  • If you have ICQ installed, it checks HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\ to see what applications ICQ launches when it detects an Internet connection.

  • It looks in your Windows, System, and Windows\Command directories for .pif files. It is strongly recommended that you right click on these files in Explorer, choose Properties, click on the Program Tab, and click on the "Advanced" button to see what autoexec and config files your pif file uses. Then, you should check the contents of the autoexec and config files to make sure they don't run any hacker programs.

Note to techies: If more than one user logs into this machine, it is recommended that you have each user log into the machine, and then check their startup files, as each user will have a different profile, and will run different startup files.


What is DNS?

"DNS" stands for the "Domain Name System". Sometimes, this acronym is used to mean the "Domain Name Service".

A domain name is one of the familiar names that you type into your web browser, such as "www.microsoft.com", or "www.cnn.com". These names are familiar and easy for a human to remember. When you type in one of these names into your web browser, your web browser attempts to connect to the website you specified. To make this connection, your web browser first needs to obtain the IP address of the target website.

An IP address is like a phone number for a computer. It takes the form of four numbers separated by periods (e.g. 207.104.128.4). Every computer on the Internet has at least one of these IP addresses. For example, www.microsoft.com has several IP addresses, 207.46.197.102, 207.46.230.218, and 207.46.197.100. www.thehungersite.com has the address 206.253.208.199.

When you type "http://www.microsoft.com" into your browser, your browser needs to look up the IP address of www.microsoft.com. It needs a "directory service" to look up the IP address from the name, just as you would use the phone company's 411 service to look up someone's phone number from their name.

The Directory service that your computer uses to look up IP addresses from domain names is called the "Domain Name Service", or "DNS". When you type in "http://www.cnn.com" into your web browser, your machine contacts a DNS server, asking it to find the IP address for www.cnn.com. The DNS server then contacts other DNS servers on the Internet. These servers determine which DNS server is "authoritative" for www.cnn.com, and then ask one of the authoritative servers to answer the question: What is the IP address of www.cnn.com?

When the System Administrators at cnn.com setup their website and email, they (or their ISP) also setup four authoritative DNS servers. These DNS servers are the "authority" for any questions regarding the domain name to IP address mappings for cnn.com.

These authoritative name servers for www.cnn.com can also answer the following questions:

  • Which hosts are responsible for receiving the email for cnn.com (What are the MX records for cnn.com)?
  • Which name servers are authoritative for cnn.com (What are the NS records for cnn.com)? (You can also use Whois to determine this).
  • Convert a cnn.com domain name into an IP address. For example, they can tell you that europe.cnn.com has the IP address 207.25.71.28. This is called an A record. An "A Record" converts a domain name into an IP address.
  • They can convert an IP address into a domain name. For example, they can tell you that IP address 207.25.71.28 has the name www8.cnn.com. This is called a PTR record. A "PTR Record" converts an IP address into a domain name.
  • They can give you administrative information about the domain, such as the email address of the administrator of the domain. This is called a SOA (Start of Authority) Record. A "SOA Record" contains the email address of the administrator, the serial number of the zone, and several timeouts that are used to manage the cnn.com zone.

Note for Techies: You tell your machine which DNS server to use when you configure your TCP/IP settings, or your machine is told which DNS server to use by a DHCP server. You can see which DNS servers your machine is using by typing "ipconfig /all" at a command prompt.


What kinds of DNS records can you look up with Internet Periscope?

InternetPeriscope lets you look up the following types of DNS records:

  • A Records. Given a domain name, InternetPeriscope can tell you the IP Address associated with that domain name, by looking up it's A Record.
  • PTR Records. Given an IP Address, InternetPeriscope can tell you the domain name associated with that IP Address, by looking up it's PTR Record.
  • NS Records. Given a Second Level Domain Name (SLD), InternetPeriscope can tell you which name servers are authoritative for that domain, by looking up the domain's NS Record. Note: Second Level Domain Names (SLDs) are domain names that have one period in them. For example, microsoft.com and cnn.com are SLDs. www.microsoft.com and www.cnn.com are NOT SLDs, because they both have two periods in them.

    NS records will tell you which name servers the DNS administrator configured as authoritative for the zone. However, DNS administrators do sometimes make mistakes. To find out which Nameservers NetworkSolutions believes to be authoritative for the zone, use the Whois Tool.
  • CNAME records are alias records. For example, www.microsoft.com is really any alias for www.microsoft.akadns.net. InternetPeriscope enables you to look up CNAME Records.
  • MX Records are called "Mail Exchange" Records. They determine where the email for a domain should go. For example, if you sent email to cnn.com, your email would be routed to the machine named atlmail1.turner.com (or the machine named atlmail3.turner.com). InternetPeriscope enables you to determine which machines receive email for a domain.
  • SOA Records are called "Start of Authority" Records. They tell you
    • The Primary Nameserver of the domain. When a DNS makes changes to a domain's zone file, they usually perform the changes on this name server. The "secondary" name servers later receive the zone's changes from the primary nameserver.
    • The email address of the person responsible for this domain.
    • The Serial number of the zone. Every time the administrator changes a record in the domain's zone file, she increases this number. A secondary nameserver can use this number to determine if the primary nameserver has an updated zone file. If so, the secondary nameserver can request the new zone file from the primary nameserver.
    • The refresh interval, in seconds. This is how often the secondary nameservers check with the primary nameserver to see if any changes have been made to the domain's zone file.
    • The retry interval, in seconds. If a secondary nameserver is unable to contact the primary nameserver (perhaps it has crashed, or the connection between them is saturated), then it will retry the connection after this many seconds.
    • The Expire interval, in seconds. If a secondary nameserver is unable to contact the primary nameserver for this many seconds, then it will "expire" the zone. That is, it will no longer answer questions about this domain.
    • The Minimum TTL (time to live), in seconds. When you type in a URL like http://www.microsoft.com, your computer asks its DNS server for the IP address for www.microsoft.com. (This DNS server is probably located at your ISP). This DNS server then asks Microsoft's DNS server for the IP address of www.microsoft.com. Microsoft's DNS server returns an answer to your DNS server, which then caches this result for TTL seconds. By caching this record, it reduces the load on Microsoft's DNS server, and allows your web browser to more quickly connect to the website, as it doesn't have to spend a lot of time looking up the IP address.


Finding out which hosts receive email for a domain name (MX Records)

You can use InternetPeriscope to find out which hosts receive email for a domain. To do this, you look up the Mail Exchange (MX) record of the domain, using DNS.

To bring up the DNS Tool, click on the "Tools" menu, move your mouse over the "DNS" menu item, and click on "DNS Query...", as shown in the figure.

In this example, we will find out which hosts receive email for the domain sendmail.com. In the figure below, the user has entered the name "sendmail.com" into the "Query String" text field, and has clicked on the "Mail Exchange (MX) Records" radio button. She then clicks on the "Send Query" button.

Note that she entered "sendmail.com" into the "query string" text box, and not "www.sendmail.com". This is because she is interested in knowing which hosts receive email for bob@sendmail.com. If she wanted to know which hosts receive email for bob@www.sendmail.com, then she would enter "www.sendmail.com" into the "query string" text box.

After a few moments, the DNS Query results dialog appears.

This dialog tells us the following:

  • If you were to send mail to bob@sendmail.com, the email would go to the host smtp.sendmail.com. It would go to this host because it has the lowest numbered preference, 10.
  • If smtp.sendmail.com was unreachable (perhaps it crashed, or is too busy to handle new email), then the email would be temporary stored on pot.sendmail.com. This is because pot.sendmail.com has the next highest preference number, 20.
  • If smtp.sendmail.com and pot.sendmail.com were unreachable, the mail would be temporarily stored on spork.sendmail.com (preference 30), kettle.sendmail.com (preference 40), knecht.sendmail.com (preference 60), or smtp.gshapiro.net (preference 70).
  • If you send email to someone at sendmail.com, it is very likely that your email will reach its destination. Sendmail.com has 6 servers that can back up it's email in case one of its servers has a problem.

You can find out what kind of mail servers sendmail.com is using by using the Fingerprint Mailserver tool.


Looking up the IP Address of a domain name (A Record)

Internet Periscope enables you to find the IP addresses associated with a domain name using DNS. When we look up the address of a domain name, we look up the "A Record" of that domain name.

To bring up the DNS Tool, click on the "Tools" menu, move your mouse over the "DNS" menu item, and click on "DNS Query...", as shown in the figure.

In this example, we want to find out the IP address for www.fun.com. From the IP address, we can find the ISP of www.fun.com using Whois.

The user enters "www.fun.com" into the query string text box. Note that the "Address (A) Record" radio button is selected. She then clicks on the "Send Query" button.

After a few moments, the DNS Results dialog appears, telling us that the IP address for www.fun.com is 64.70.27.148.

InternetPeriscope also allows you to find the contact information for a domain.

Also see Finding out which ISP owns an IP address.


Looking up the domain name of an IP Address (PTR Record)

Using the DNS Tool, InternetPeriscope helps you find the domain name associated with an IP address. Note that not all IP addresses have domain names, although they probably should. When we look up the IP address of a domain name, we are looking up the PTR record for that IP address. This is also referred to as a "reverse lookup".

Note to Techies: It is strongly recommended that you have PTR records for all of your IP addresses, and that the "reverse lookups" match the "forward lookups". This is because some hosts (mainly Unix hosts) use a kind of TCP/IP wrapper that checks the reverse lookup, and compares it to the forward lookup, dropping a connection if these don't match. This is meant to prevent various "spoofing" attacks. If your (user's) machines don't have reverse DNS correctly setup (and matching the forward lookups), they may experience problems connecting to ftp servers, telnet servers, etc. that use these kinds of TCP/IP wrappers.

To bring up the DNS Tool, click on the "Tools" menu, move your mouse over the "DNS" menu item, and click on "DNS Query...", as shown in the figure.

In this example, we are looking up the IP address 200.188.1.46. This is the IP address of a hacker who has probed one of our systems. (See Detecting Intrusion Attempts by Hackers). We are looking up this IP address so that we can find out more information about this hacker, his ISP, and perhaps the company that he works for.

The user enters the IP address into the "Query String" text box, and clicks on the "PTR Record" radio button. She then clicks on the "Send Query" button.

After a few moments, the DNS Results Dialog tells us that the IP addresses PTR record maps to "C8BC012E.dedicated.mg.psinet.com.br".

To further track down information about this hacker, we can use the Whois Tool to find out information about psinet.com.br.

See also: Finding out which ISP owns an IP address.


Finding out which Name Servers are authoritative for a domain

InternetPeriscope can help you find out which nameservers are authoritative for a zone by using DNS. This is called looking up an NS record.

Sometimes DNS Administrators do not correctly setup their NS records. It is recommended that you also use the Whois Tool to find out which name servers are authoritative for a zone.

For this example, we will determine which nameservers are authoritative for bind.com. Note that we are looking up the NS records for bind.com (a second level domain [SLD]), and not www.bind.com.) It is recommended that you only look up NS records for SLDs, unless you have advanced knowledge of DNS.

To bring up the DNS Tool, click on the "Tools" menu, move your mouse over the "DNS" menu item, and click on "DNS Query...", as shown in the figure.

In the figure below, the user has entered "bind.com" into the "query string" text box. She has clicked on the "NS Record" radio button. She then clicks on the "Send Query" button.

After a few moments, the DNS Results dialog appears, telling us that NAMESERV2.bind.com and NAVESERV1.bind.com are the authoritative nameservers for bind.com.


Looking up the Start of Authority (SOA) Record for a domain

InternetPeriscope enables you to look up the Start of Authority (SOA) record for a DNS zone.

The SOA Record gives you the following information:

  • The Primary Nameserver of the domain. When a DNS makes changes to a domain's zone file, they usually perform the changes on this name server. The "secondary" name servers later receive the zone's changes from the primary nameserver.
  • The email address of the person responsible for this domain (the DNS Administrator).
  • The Serial number of the zone. Every time the administrator changes a record in the domain's zone file, she increases this number. A secondary nameserver can use this number to determine if the primary nameserver has an updated zone file. If so, the secondary nameserver can request the new zone file from the primary nameserver.
  • The refresh interval, in seconds. This is how often the secondary nameservers check with the primary nameserver to see if any changes have been made to the domain's zone file.
  • The retry interval, in seconds. If a secondary nameserver is unable to contact the primary nameserver (perhaps it has crashed, or the connection between them is saturated), then it will retry the connection after this many seconds.
  • The Expire interval, in seconds. If a secondary nameserver is unable to contact the primary nameserver for this many seconds, then it will "expire" the zone. That is, it will no longer answer questions about this domain.
  • The Minimum TTL (time to live), in seconds. When you type in a URL like http://www.microsoft.com, your computer asks its DNS server for the IP address for www.microsoft.com. (This DNS server is probably located at your ISP). This DNS server then asks Microsoft's DNS server for the IP address of www.microsoft.com. Microsoft's DNS server returns an answer to your DNS server, which then caches this result for TTL seconds. By caching this record, it reduces the load on Microsoft's DNS server, and allows your web browser to more quickly connect to the website, as it doesn't have to spend as much time looking up the IP address, since it already exists in its cache.

For this example, we will look up the SOA Record for bind.com

To bring up the DNS Tool, click on the "Tools" menu, move your mouse over the "DNS" menu item, and click on "DNS Query...", as shown in the figure.

The user enters "bind.com" into the "Query String" text box. She clicks on the "SOA" radio button, and then clicks on "Send Query", as shown in the figure.

After a few moments, the DNS Results dialog appears (see figure above), giving us the following information:

  • The primary nameserver for bind.com is nameserv1.bind.com. When the DNS Administrator for bind.com makes a change to the DNS for the bind.com zone, she makes the change on this server.
  • The email address of the DNS administrator is hostmaster@bind.com.
  • The Serial number of this zone is 20000627. Different administrators use different schemes for their serial numbers. This administrator is probably using the "date format", and this number probably indicates that the last DNS change was made to this zone on June 27, 2000.
  • Every hour, the secondary nameserver, nameserv2.bind.com, checks the Serial number on the primary nameserver, nameserv1.bind.com, to see if the administrator has made any changes to the bind.com zone. If so, the secondary nameserver gets the new zone file from the primary nameserver.
  • If the secondary nameserver is unable to contact the primary nameserver (to see if the Serial number has been updated), then it will retry the primary nameserver every 15 minutes.
  • If the secondary nameserver (nameserv2.bind.com) is unable to contact the primary nameserver (nameserv1.bind.com) for 5 weeks, 6 days, and 16 hours, then it will delete the bind.com zone from its database, and it will no longer answer any DNS queries for the zone bind.com.
  • When the user clicked on the "Send Query" button, her DNS server, 207.212.252.54 "talked" to nameserv1.bind.com. Her nameserver asked nameserv1.bind.com to send it the SOA Record. nameserv1.bind.com told her nameserver the answer, and told it that it should only cache (save) this information for one hour. If the user presses the "Send Query" button again, her nameserver will return the cached record. If she waits an hour and again presses the "Send Query" button, the record will have expired, and her nameserver will have to "ask" the nameserv1.bind.com server for the SOA record again.


What does Whois do?

Using InternetPeriscope's Whois Tools, you can:

  • Find out if a domain name has been registered
  • Perform a Wild Card Search, searching for all domain names that begin with a word you specify.
  • Find the name, address, email, phone number, and fax number of a domain name's owner.
  • Find the name, address, email, phone number, and fax number of an IP address's owner (usually, this is an ISP).
  • Find out which domains (up to 50) are hosted by an ISP.

InternetPeriscope looks up this information by connecting to registries. The figure below shows a listing of these registries that can be found in the Whois (domain name) Tool.

When searching for a domain name, you will usually want to start with the whois.networksolutions.com registry. whois.networksolutions.com is one of several registries that allow you to register domain names that end with .com, .org, .net, and other extensions. Using InternetPeriscope's Whois Tool, you can find out if a domain name has been registered, and if so, to whom.

You can also use InternetPeriscope to find out who owns an IP Address. You might want to do this if you detected a hacker intrusion, and wish to notify the hacker's ISP, or if you received email spam, and wished to notify the spammer's ISP.


Finding out if a domain name has been registered

You can use InternetPeriscope's Whois Tool to find out if a domain name has been registered, and if so, you can obtain contact information for the current owner (perhaps you are interested in buying the domain from them).

In this example, a user named "Wilma" wishes to find out if the domain "wilma.com" has been registered.

To do so, she clicks on the Tools menu, moves her mouse over the "Whois" sub-menu, and then clicks on "Domain Name...", as shown in the figure.

The Whois dialog appears. She enters "wilma.com" into the Search String text box, and clicks on the Search button. Note that she entered "wilma.com", and not "www.wilma.com". "wilma.com" is a Second Level Domain (SLD) name. SLDs have only one "." in them. Only SLDs can be registered with Network Solutions. It would not make sense to do a Whois lookup on "www.wilma.com", as it is not a SLD (its has two "."'s in it).

The results of the query appear. At the top of the results is some legalese from Network Solutions. To find out if her domain has already been registered, she should scroll down in the results.

After scrolling down, she sees that unfortunately, the domain has already been registered. However, she now has contact information for the current owners of the domain in case she wishes to ask them if they would sell the domain. Alternatively, she may wish to do a Wildcard Search to find out which domains that begin with the word "wilma" have already been registered.


Wildcard Searches - Finding all domain names that begin with a word you specify

In this example, a user named "Wilma" wishes to register a domain name that begins with the word "Wilma". She has already found out that "wilma.com" domain has been taken.

To begin, she clicks on the Tools menu, moves her mouse over the "Whois" sub-menu, and then clicks on "Domain Name...", as shown in the figure.

She enters the text "wilma" into the Search String textbox. She clicks on the Wildcard Search checkbox to enable a wildcard search. She then clicks on the Search button.

The results dialog appears. She scrolls past the legalese to see a list of fifty domain names that begin with the word "wilma". If she is interested in buying any of these domains from their current owners, she can use InternetPeriscope to get contact info for the current owners of the domain. Alternatively, she may be trying to find an unregistered domain name that begins with "Wilma" by process of elimination.


Finding out which ISP owns an IP address

InternetPeriscope enables you to find out which ISP owns a given IP address. You might do this after you detected an Intrusion attempt, or if you wished to contact an ISP to notify them that you received unsolicited email (SPAM) from their network.

If you only have a domain name (e.g. www.microsoft.com), you should first use DNS to find out the IP address of the domain. Then you can find out which ISP that hosts this IP address, as described below.

In this example, the user wishes to find out which ISP is responsible for the IP address 212.174.160.27. She wishes to do this because she has detected an intrusion attempt by a hacker from this IP address, and wishes to notify the ISP of the intrusion attempt.

To begin, she clicks on the Tools menu, moves her mouse over the "Whois" sub-menu, and then clicks on "IP Address...", as shown in the figure below.

She then enters the IP address into the Search String text box, and presses the Search button. Note that she has left the Registry with the default "American Registry for Internet Numbers (ARIN)" . This registry keeps track of which IP addresses are used on the American continents.

After a few moments, the results shown below appear. Unfortunately, she has not yet found the ISP responsible for this IP address. The results are telling her that the European Regional Internet Registry/RIPE NCC (RIPE) is responsible for IP addresses in the range 212.0.0.0 - 212.255.255.255. She needs to run her search again, but this time using "RIPE" as the registry, instead of "ARIN".

Note: Had the address been in Asia, she would have been referred to the "Asia Pacific Network Information Center (APNIC)", and would have used this registry in the steps outlined below.

She clicks on OK to remove the Whois Results dialog. She then changes the Registry in the "Search whois.arin.net" dialog to "RIPE", and again clicks on the Search button, as shown below.

She scrolls through the results, finding a number of contacts for this IP address range. She also discovers that this intrusion attempt came from somewhere in the country of Turkey.


Finding out which domains are hosted by an ISP

InternetPeriscope's Whois Tools can help you mine a lot of data from domain names and IP addresses.

In this example, we will use InternetPeriscope to find fifty customers of an ISP.

In this example, our user is investigating an ISP called Monkey Brains, an ISP the author highly recommends. Our user is looking for a new ISP. She has heard good things about this ISP, and wishes to confirm that it has a large customer base.

To begin, our user clicks on the Tools menu, moves her mouse over the "Whois" sub-menu, and then clicks on "Domain Name...", as shown in the figure.

She first needs to find out which servers handle DNS for this ISP. She enters the Second Level Domain Name (SLD) "monkeybrains.net" into the Search String, and clicks on the Search button, as shown in the figure.

Note that she can also use DNS to find out which servers handle DNS for this domain. Use both methods if you are trying to find all the DNS servers for a domain.

The Whois results dialog appears. She scrolls down to where the DNS servers are listed. She holds down the left mouse button while dragging her mouse over the name of one of the DNS servers to select it. She then clicks on the Copy button to copy the name of this DNS server into the clipboard.

She then clicks on the OK button to remove the Whois results dialog. She is returned to the "Search whois.networksolutions.com" dialog. She clicks on the Paste button to paste the DNS server into the Search String text box. She clicks on the Host radio button because she wishes to look up information on this host. Specifically, she wishes to find out the host's handle. Every host in Network Solution's database is given a unique handle. Later, we will use this handle to find out which domains this server handles DNS for.

She again clicks on the Search button.

After a few moments, the Whois results dialog appears, giving the results shown in the figure below. She clicks and drags her mouse over the host's handle, and clicks on the Copy button to copy the host's handle into the clipboard. She then clicks on the OK button to remove the Whois Results dialog.

Back at the "Search whois.networksolutions.com" dialog, she clicks on the Paste button to paste the host's handle into the Search String text box. She clicks on the Server radio button. She clicks on the Summary radio button because she only wants a list of names of domains that are hosted by that server.

She clicks on the Search button to find a list of fifty domains that are hosted by that server.

From here, she may wish to do the following:

  • Find out what kind of webserver software these clients are running.
  • Find out which hosts handle email for these clients, and then find out what kind of mail server software that they are using.
  • Get contact information for these customers, so that she can get references for this ISP.
  • Check the security at this ISP (but be sure to get their permission, first).
  • Find out the IP addresses of these clients websites, and then use these IP addresses to find out where this ISP got their IP address range, and thus how well connected they are. You may also be able to determine how big their IP space is (i.e. How many IP addresses does this ISP manage).


Subnet Calculator

InternetPeriscope's Subnet Calculator can help you calculate subnet masks and ranges of IP addresses.

In this example, our user has just setup her company's office with a new ISP. The ISP has told her that her address range is 207.104.128.1/25. She uses the Subnet Calculator tool to determine what this means. Later in the example, she uses the Subnet Calculator Tool to further subdivide her network in order to reduce network congestion from Broadcast traffic.

To run the Subnet Calculator Tool, she clicks on the Tools menu, and clicks on the "Subnet Calculator..." menu item, as shown in the figure below.

She enters her IP address, 207.104.128.1 into the IP Address control. She then clicks once on the up-down control to set the number of network bits to "/25", the value her ISP specified.

The dialog above shows the following:

  • If she does not further subnet her IP address range, she should set the subnet mask on all of her computers to 255.255.255.128
  • Her ISP has given her part of a Class C address space.
  • The network address is 207.104.128.0. Routing tables store the "route" to this network using the network address. Routing tables are used by software such as RIP and OSPF.
  • Without using a NAT server or proxy server, she can setup up to 126 machines with unique addresses (she will probably need to use one of these addresses as her router address, depending on her setup).
  • The broadcast address is 207.104.128.127. If she sends a message to this address, it will be broadcasted to all of the machines in that subnet.
  • The first usable host address is 207.104.128.1. Most admins assign this to the router that connects their site to their ISP. They then configure their client machines to use this address as a default gateway.
  • For this network, the administrator should only configure machines with IP addresses in the range 207.104.128.1 - 207.104.128.126.

The administrator wishes to further subnet her IP address range. She wishes to do this to decrease broadcast traffic. This will give her users faster network performance.

Currently, her company has two departments, each with 20 computers. She wishes to create a separate subnet for each of these departments, giving each department room for future growth. She plays around with the Subnet Calculator, and comes up with the following:

  • She will create two subnets, each with 30 IP addresses.
  • The first subnet will have the IP address range 207.104.128.33 - 207.104.128.62. She has decided to use the first address, 207.104.128.33, as the default gateway (router address) for this subnet.
  • Hosts on both networks will use the subnet mask 255.255.255.224


Finding out what an Internet Service does (TCP/IP Ports and Descriptions)

Finding out what an Internet Services does (TCP/IP Ports and Descriptions)

InternetPeriscope includes a list of commonly used TCP and UDP port numbers.

TCP is an acronym for the "Transport Control Protocol". UDP is an acronym for the "User Datagram Protocol". When a programmer writes an Internet application, she will choose to use one of these two protocols. TCP is a connection-oriented, reliable protocol. UDP is an unreliable protocol (data delivery is not guaranteed), but it has lower overhead than TCP. It is much easier to write software using the TCP protocol rather than using UDP.

  • Your browser uses a TCP connection when it connects to a website to retrieve a webpage.
  • Your mail program uses a TCP connection when it connects to an SMTP server to send email, and when it connects to a POP server to retrieve email.
  • When your computer looks up a domain name, it sends a UDP datagram to your DNS server.
  • The more sophisticated hacker software is written using UDP, perhaps because UDP Ports are more difficult to detect than TCP Ports. Fortunately, InternetPeriscope's Port Scan feature can detect both UDP and TCP ports.

    When your machine makes a TCP or UDP connection to another machine, it specifies a port that it wishes to connect to. For example, if your web browser was connecting to Microsoft's website, it would specify to Microsoft's server that it wishes to connect to port 80. If your email software was sending mail for you, it would specify that it was connecting to port 25 on your mail server. Each Internet service has a unique port number that clients specify when they wish to use said service.

    Note that some services have a UDP port number, some have a TCP port number, and some have both a UDP and a TCP port number.

    To see a list of Port numbers and descriptions, click on the Tools menu, move your mouse over the "Ports" submenu, and then click on either "List of Well Known TCP Port numbers..." or "List of Well-Known UDP Port numbers...".

    The Port numbers dialog box lists commonly used Internet applications and their port numbers. Note that this list is not complete, as new services with new port numbers are being created all the time.