Exit codes and other things

Ok, I'm messing around with DOS and am trying to create a very simple Intrusion Detection System. I'm new with this stuff, so if something I say doesn't make sense, please just tell me.

Basically, it runs Netstat, logs it, gives the user a list of options to stop or view the log, and if they don't choose an option in 5 seconds, it continues logging.

@echo off
goto net
:net
netstat>>log.txt
choice /c:csv /n /t:c,5 Press S to stop or V to view the log.
IF errorlevel 1 goto net
IF errorlevel 2 goto stop
IF errorlevel 3 goto view
:stop
echo You've stopped logging.
:view
start C:\Windows\log.txt

I also wanted to add an FC to compare the log to normal traffic, and then use IF with errorlevel to determine if there is an intruder. But I am not sure of the exit codes for the FC command. Can someone please explain exit codes to me?

RTFM

Is this a pure DOS or a shell that you're using? If it's a shell Win XP [and I assume other versions as well] has an extensive command referrence help. There's also Google that should turn up quite a number of results on that.

No I don't know anything about the exit codes for the FC command. I just recommend you follow these steps before posting a question.

http://www.google.com/search?hl=en&i...=Google+Search

;)

Not to get off-topic, but NemorY: You are the king of Researching with Google ;).

Quote:

---

No I don't know anything about the exit codes for the FC command. I just recommend you follow these steps before posting a question.

---

Wait, you want him to go somewhere else to get answers to his questions, instead of posting in the newbie questions section of our website?

Geesh guys, either help the guy or ignore him, but don't be rude about it.

I wasn't being rude to him in any way, if anything I believe the people that come with questions that they refused to research on their own are rude. Now if I had known anything about this particular subject I would have most likely give him an idea, but I'd still tell him to RTFM. I mean I come to AO after I've tried researching a topic as much as possible... and if sometimes it still doesn't get through up there I might want to discuss it on IRC or on the forum and try to clear things out for myself.

Your idea is a good one. In fact, so good that it has been done over and over already. A quick google search gives you a plethora of tools that provide realtime "Netstat" views.

http://www.google.com/search?hl=en&l...+realtime+view

If this is only for a proof of concept, then continue on, but for functionality, you have miles to go.

"Now if I had known anything about this particular subject I would have most likely give him an idea."

hypronix please dont think im singleing in on you becase i think your reasoning is typical of the google my post count up crowd. but if you dont know anything about the subject then why are you posting?...memory?

blithendell check out the 'interval' argument in netstat this will refresh the netstat output every <?> seconds until you ctrl-c. a nice example of this with a GUI added can be found in IPtools http://www.ks-soft.net/ip-tools.eng/

IMO there was a lack of any knowledge regarding that part of what he wanted to do. Now if the question was anything along the lines of "I've tried this and it doesn't work" or "I don't get the hang of that" it would be more likely to get an extensive answer from members of the community.

There was a chat a while back on UnError or SMDC-Network about why the answer to many question is RTFM, and the conclusion of that particular discussion was similar to the point that I was trying to make with my first post. We're not here to reinvent the wheel every time somebody needs a wagon.

As well I did point out to some referrence that he could use in his task. Not much, I admit, but it was a starting point. I could have as well pasted here the manual but that clearly wouldn't be advantageous for him.

I always had the impression that AO was a community not only there to help out with questions but to help its members to develop a basic skill set for when they encounter various problems. To make users aware of what the steps are when it comes down to learning something. By simply writing out code for somebody [starting from scratch] you're pretty much writing a tool that a script kiddie would use. No more, no less, since there is absolutely no theoretical understanding of the concepts involved on the part of the receiver.

P.S. I am not trying to put down anybody's computer enthusiasm, either current thread posters or other casual readers. But if somebody considers themselves an enthusiast well... they should be more active when it comes to learning new things.

Quote:

---

Now if the question was anything along the lines of "I've tried this and it doesn't work" or "I don't get the hang of that" it would be more likely to get an extensive answer from members of the community.

---

I don't care how or what someone asks, if I know the answer then I will help. If I do not know the answer, then I will not help.

Quote:

---

There was a chat a while back on UnError or SMDC-Network about why the answer to many question is RTFM, and the conclusion of that particular discussion was similar to the point that I was trying to make with my first post. We're not here to reinvent the wheel every time somebody needs a wagon.

---

Then since almost every single question posted on AO is documented somewhere on the net already, we should tell each and everyone of them to RTFM? Do you know how small that would make the entire AO forum as a whole, and how many people would -still- come back to ask us the question again, hoping someone can explain it better than a cryptic man page. I don't care how many times I have to answer a question, I will still answer it. My responce and help would be no different than them running the 'man' command.

Quote:

---

To make users aware of what the steps are when it comes down to learning something. By simply writing out code for somebody [starting from scratch] you're pretty much writing a tool that a script kiddie would use. No more, no less, since there is absolutely no theoretical understanding of the concepts involved on the part of the receiver.

---

Rare are the times I see that happen on AO, and I mean very rare. People here almost always post explainations and examples to the question rather than simply coding it out for them. Learning is greatly encouraged here, as is obvious even in this post. However, explaining concepts that would take thirty seconds or so from someone here who already knows it, and put it into words that is understandable is just so much more efficient and kind than having someone RTFM, google, ask questions, get flamed, google more, get confused, and then maybe catch on a few days later.

Quote:

---

P.S. I am not trying to put down anybody's computer enthusiasm, either current thread posters or other casual readers. But if somebody considers themselves an enthusiast well... they should be more active when it comes to learning new things.

---

Active or not isn't the point here. The parent poster took an active step of asking for the personal advice and knowlege of those already here. I've posted many topics of things I know full well I could google and RTFM, but why should I be forced to when I know I can gain much more insight and personal experience from those who have already done it first hand?

A question is a question, which can be answered many ways. Choose the path of least resistance (even if that means posting it to a forum where you know people can explain it better than a manual) and do not force a common standard of prerequisits :)


edit

I guess my primary point is this: You teach people new to the security/programming world to read read read read read and study study study and to never hesitate to ask questions. Yet now when they ask questions we slap them for their newbiness and give then RTFM finger? Sounds like the debian community :P

We all remember what it was like starting out and I'm sure the majority of us would have enjoyed having the chance to speak with someone who could explain a concept or security practice in a way that made more sense than man or doc pages.

Quote:

---

Originally posted here by pooh sun tzu

Then since almost every single question posted on AO is documented somewhere on the net already, we should tell each and everyone of them to RTFM? Do you know how small that would make the entire AO forum as a whole, and how many people would -still- come back to ask us the question again, hoping someone can explain it better than a cryptic man page. I don't care how many times I have to answer a question, I will still answer it. My responce and help would be no different than them running the 'man' command.

---

Oh so it's a popularity contest of what Internet forum can have the highest attendance in members then? Yes a lot of questions are probably documented somewhere, hence why some of us know the answers. I seem to observe a thorough and repeated misunderstanding of my reply. I did, upon joining AO, agree to share my knowledge when it comes to 'anything computers'. Otherwise the community would not function and there would indeed be limited - if any - participation. My original reply was not flammatory or 'bitter'. I simply recommended some steps that should be followed when it comes to questions... For one, I always Google the heck out of whatever I can, the man and whatever referrence books I have, even go to IRC ocasionally for some stuff. Does that take long? Depends. And if I don't find the stuff I'm looking for or I don't get it, I'm not afraid of asking the question at AO. Why? First of all, because I have some knowledge of what I want explained and that helps me formulate the question better as well as understand the answers better.

Quote:

---

However, explaining concepts that would take thirty seconds or so from someone here who already knows it, and put it into words that is understandable is just so much more efficient and kind than having someone RTFM, google, ask questions, get flamed, google more, get confused, and then maybe catch on a few days later.

---

So because I have information that I could teach somebody else in 30 seconds I should simply disregard the fact that I would be able to learn something new [in those 30 seconds] and spoon-feed another person? Which in turn causes them to become more and more reliant and dependent on me and/or others that can simply offer that information. Information that I [for the most part] learned on my own time from sources readily available to anybody. Whereas if somebody needs clarification with something and I might be able to provide it, I am more likely to do so. I then have the certainty that the person will really learn what I'm trying to explain instead of interrupting me constantly and needing to backtrack and explain other information.

Quote:

---

I've posted many topics of things I know full well I could google and RTFM, but why should I be forced to when I know I can gain much more insight and personal experience from those who have already done it first hand?

---

Because we are all individuals and therefore responsible for our own evolution within this world on all levels that it may come to us. I discuss code or concepts with people too, but I try to have a certain degree of base knowledge that [as said] can help me really take advantage of the help I'm given. The person that would offer said help is more likely to offer it to me on this basis as well.

Quote:

---

I guess my primary point is this: You teach people new to the security/programming world to read read read read read and study study study and to never hesitate to ask questions. Yet now when they ask questions we slap them for their newbiness and give then RTFM finger?

---

M-hm. On the topic of the FC command the first two steps were skipped and the jump to the question was made.

And for blithendell

The F[ile] C[ompare] command as available per the Windows XP DOS Shell is used to compare [as the name says] two or more files for differences. The files can be either compared in ascii [with additional options such as case ignore or considering tabs as 1 or 8 characters] or binary format.

When executed from a shell the command would either display the differences in the two files [different method between ascii and binary comparison modes], return a "Resynch Failed. Files are too different" or a "FC: no differences enountered" message.

As far as I get it you're writing out a batch file. Was it your intention to compare the logs as files? [That bit isn't too clear] Because that won't work out too great, with different file stamps and whatnot [which you could avoid through netstat if I remeber correctly]. Anyway unfortunately I do not think at that level FC would do much good for you, what I would try to do is code a small app in C that would peruse the files against a 'standard traffic table' or something and alert when something out of the ordinary is happening. That kind of a thing would involve a lot of string manipulation but it's an option.

Alternatively somebody out there might be able to help out with some other command that could do the trick.

P.S. http://www.microsoft.com/windowsxp/h...tdoc/en/fc.asp

My entire argument against how you treated him can be summed up like this:

Quote:

---

So because I have information that I could teach somebody else in 30 seconds I should simply disregard the fact that I would be able to learn something new [in those 30 seconds] and spoon-feed another person?

---

Google and man pages are forms of information gathering. The human brain is a form of information gathering. If someone chooses to speak to a human instead of a computer for answers (which would be the same answers whether they did the 31337 process of searching for it or not) then that's perfectly fine. Not only do they get the same information from a human as if they had googled it themselves, but it doesn't make the newbies feel as if someone 'leeter' is pushing them away. IF you feel human contact with a question/answering process results in cookie cutter answers, then I guess I must be guilty on all accounts and have no ability of my own to learn beyond others. I mean, after all, when I started out I learned better through having others show me and guide me through experiences first-hand than reading a monotone tutorial on it that couldn't answer my curiosity in full.

Some people learn better on their own, some people learn better with others. I embrace both, and will never hesitate to help, explain, and teach (read: not 'spoon-feed') the knowledge which I have learned. If google has the same information that I would give someone, more power to google. Otherwise, they asked here, not google.

Patience is one of the greatest virtues of teaching.

Hi, i am also a newbie. Does a newbie like me have any oppotunity to "exist" in this community? For those newbie who posted question that i felt that i am able to help,
Am i allow to help even thought my answer is not as good as those from hardcore
guru like u all?

Summer, welcome to AO first off :) You "exist" in this community regardless of opprotunity or how much you know. The knowledge levels here range from both brand spankin new people to hardened security veterans. Each has their place and each (so long as their attitude is in check ie. kind) are welcome here.

A few bits of advice I can give you:

1. Read read read read read.
2. When you don't understand something, ask and don't hesitate to ask.
3. Since you are a bit new, don't hesitate to speak out on something you may know about, but also don't forget to learn. If someone corrects you on something or expands something you have said, listen and learn.

Once again, welcome to AO!

Thanks pooh, actually i created this acct quite sometime back as i was digging for fixes of some windows exploit. I have been use to do this all on my own but i suppose nothing beat the feeling of being in a community and make a few friend on the way.

I suppose all of us have one thing in common, that is hunger for knowledge. We enjoy the process of finding out what we wanted as much as the final solution. So whoever join the community with different priority most likely will be treated as alien.

Some of us are more tolerable to these "alien", some are not. But all of us are part of these community. All of us are looking at issue with different perspective/ level of expertiz. That is what makes being in a community interesting.

To some extend i agree with hypronix, you must teach the guy how to fish rather than keep feeding him. But everyone of us were here for different reason. Lets be more tolerable to each other. It would be a kind answer if hypronix point us newbie in a direction to look for relevant information. RTFM also should tell us which manual to read rite?

Quote:

---

Originally posted here by Summer_breeze
[BIt would be a kind answer if hypronix point us newbie in a direction to look for relevant information. RTFM also should tell us which manual to read rite? [/B]

---

I am a newbie in millions of way, comparing to pooh sun tzu and many, many others. Anyway I believe our little ideological discussion here took the thread away from what it was meant to do... and there hasn't been any recent repsonse from the starter of the thread so.. what's up?

P.S. RTFM is meant in regards to the original manual documenting a said application. As in Linux it would be [i]man man[i] for example.

To start off, I'm sorry for causing a flame war. I honestly did try searching on google for FC exit codes before I posted, but I only found ones for the diskcomp command.

I don't think I was too clear on my intentions. I was trying to create an IDS ideal for broadband connections left on at night (just a little project for me...not to be used as serious protection). The User could set what 'normal' traffic would look like and save it in a file, and netstat would run every few seconds and put the output into a seperate file. The FC command would compare the two after netstat is run. I needed the exit codes to see if the files were alike (no intruder), or if they were different (intruder).

1. A disagreement is nothing close to a flame war. I don't think any flammatory remarks were uttered by either of us. A flame war also tends to have a baseless starting point.

2. I didn't know anything about FC. But I knew it is documented in the reference, and the Windows Knowledge Base has an entry on it [the manual... I read it so I know some stuff about FC now :D]

3. Check up on that link if my reply didn't really make sense. I still think that using FC will give birth to a lot of bugs in terms of simple things. So there might be a lot of false-positives that you'd immediately detect [or after so much as a WHOIS query] but the program might not.

Well I guess the only way to find out is to write the code... so get cracking at it! :D

hypronix is correct :) This never reached a flame war, just a discussion level. You will find this happens a lot on AO, but don't mistake it for flame wars. People here will of course have varying opinions and thus it will lead to discussions, ideas, and disagreements. But that is in no way a flamewar or meant to be personal to either arguing party. Unless of course someone starts name calling or personally insulting each other....

hypronix makes his mom tuck him in at night! harharhar!!!

Quote:

---

Originally posted here by pooh sun tzu
hypronix is correct :) This never reached a flame war, just a discussion level. You will find this happens a lot on AO, but don't mistake it for flame wars. People here will of course have varying opinions and thus it will lead to discussions, ideas, and disagreements. But that is in no way a flamewar or meant to be personal to either arguing party. Unless of course someone starts name calling or personally insulting each other....

hypronix makes his mom tuck him in at night! harharhar!!!

---

Right so this thread is long dead... but for the record this was an unfair hit from pooh. He knew very well I was spending the week installing Gentoo so I couldn't check the site... which is like a hit below the belt... especially since my mom was tucking me in so I can sleep better after the long hours of configuration of the OS :)

NB: my mom lives about 5k clicks away from me.
NB2: and pooh and Shrek helped out a lot during that Gentoo install :)