Originally posted here by pooh sun tzu

Then since almost every single question posted on AO is documented somewhere on the net already, we should tell each and everyone of them to RTFM? Do you know how small that would make the entire AO forum as a whole, and how many people would -still- come back to ask us the question again, hoping someone can explain it better than a cryptic man page. I don't care how many times I have to answer a question, I will still answer it. My responce and help would be no different than them running the 'man' command.
Oh so it's a popularity contest of what Internet forum can have the highest attendance in members then? Yes a lot of questions are probably documented somewhere, hence why some of us know the answers. I seem to observe a thorough and repeated misunderstanding of my reply. I did, upon joining AO, agree to share my knowledge when it comes to 'anything computers'. Otherwise the community would not function and there would indeed be limited - if any - participation. My original reply was not flammatory or 'bitter'. I simply recommended some steps that should be followed when it comes to questions... For one, I always Google the heck out of whatever I can, the man and whatever referrence books I have, even go to IRC ocasionally for some stuff. Does that take long? Depends. And if I don't find the stuff I'm looking for or I don't get it, I'm not afraid of asking the question at AO. Why? First of all, because I have some knowledge of what I want explained and that helps me formulate the question better as well as understand the answers better.


However, explaining concepts that would take thirty seconds or so from someone here who already knows it, and put it into words that is understandable is just so much more efficient and kind than having someone RTFM, google, ask questions, get flamed, google more, get confused, and then maybe catch on a few days later.
So because I have information that I could teach somebody else in 30 seconds I should simply disregard the fact that I would be able to learn something new [in those 30 seconds] and spoon-feed another person? Which in turn causes them to become more and more reliant and dependent on me and/or others that can simply offer that information. Information that I [for the most part] learned on my own time from sources readily available to anybody. Whereas if somebody needs clarification with something and I might be able to provide it, I am more likely to do so. I then have the certainty that the person will really learn what I'm trying to explain instead of interrupting me constantly and needing to backtrack and explain other information.

I've posted many topics of things I know full well I could google and RTFM, but why should I be forced to when I know I can gain much more insight and personal experience from those who have already done it first hand?
Because we are all individuals and therefore responsible for our own evolution within this world on all levels that it may come to us. I discuss code or concepts with people too, but I try to have a certain degree of base knowledge that [as said] can help me really take advantage of the help I'm given. The person that would offer said help is more likely to offer it to me on this basis as well.

I guess my primary point is this: You teach people new to the security/programming world to read read read read read and study study study and to never hesitate to ask questions. Yet now when they ask questions we slap them for their newbiness and give then RTFM finger?
M-hm. On the topic of the FC command the first two steps were skipped and the jump to the question was made.

And for blithendell

The F[ile] C[ompare] command as available per the Windows XP DOS Shell is used to compare [as the name says] two or more files for differences. The files can be either compared in ascii [with additional options such as case ignore or considering tabs as 1 or 8 characters] or binary format.

When executed from a shell the command would either display the differences in the two files [different method between ascii and binary comparison modes], return a "Resynch Failed. Files are too different" or a "FC: no differences enountered" message.

As far as I get it you're writing out a batch file. Was it your intention to compare the logs as files? [That bit isn't too clear] Because that won't work out too great, with different file stamps and whatnot [which you could avoid through netstat if I remeber correctly]. Anyway unfortunately I do not think at that level FC would do much good for you, what I would try to do is code a small app in C that would peruse the files against a 'standard traffic table' or something and alert when something out of the ordinary is happening. That kind of a thing would involve a lot of string manipulation but it's an option.

Alternatively somebody out there might be able to help out with some other command that could do the trick.

P.S. http://www.microsoft.com/windowsxp/h...tdoc/en/fc.asp