Re: Identifying whether 2 IPs are from the same server

[Andrew Simmons <asimmons () messagelabs com>]

Hello,


BSK wrote:
> Hello,
>
> I am doing a Penetration Testing for 2 IP addresses.
> My findings till now for both the servers are exactly
> same. I strongly feel that both the IPs belong to the
> same machine. May be a scenario where two NICs are on
> the same machine with two Public IPs. I ran HPING to
> match their IP IDs but it shows different series for
> both of them.
>
> Is there any other technique that we can use to
> ascertain such a situation?


Steven Bellovin did a paper on counting unique hosts behind NATs a while 
back, using some techniques that might be implementable manually with 
hping and so on... *googles* ah, here we are:

http://www.cs.columbia.edu/~smb/papers/fnat.pdf

"A Technique for Counting NATted Hosts
Steven M. Bellovin
smb () research att com
AT&T Labs Research

"Abstract— There have been many attempts to measure
how many hosts are on the Internet. Many of those endpoints,
however, are NAT boxes (Network Address Translators),
and actually represent several different computers.
We describe a technique for detecting NATs and counting
the number of active hosts behind them. The technique is
based on the observation that on many operating systems,
the IP header’s ID field is a simple counter. By suitable
processing of trace data, packets emanating from individual
machines can be isolated, and the number of machines
determined. Our implementation, tested on aggregated local
trace data, demonstrates the feasibility (and limitations)
of the scheme."


I remember it well, because the massively detailed graph data choked my 
printer :)

ISTR some related research appeared in the last year or two that went 
further than this, but my memory's frustratingly hazy and google's not 
working for me at this late hour.

This:
http://www.mit.edu/~rbeverly/papers/tcpclass-pam04.pdf
is along similar lines,.. but that's not what I'm trying to remember.

Something to do with Dan Kaminsky? Or p0f? anyone?


cheers

\a

--
Andrew Simmons
MessageLabs Security Dept.

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------