DHCP and the Resulting Theoretical Attacks

[Tedob1]

if someone were to give up 1 - 3 weeks of their RT lives and responsibilities to research and explain something to us that would be very noble and much appreciated but also not necessary. if you want to change the standards here it would be nice if you asked what the rest of us think first.

[avenger_jcc]

You all talk about how this post is "not up to standards" or lacking....
It was a effort, more than most members here make, to attempt to educate someone on something. I could say "Hey, Web Browsers use port 80 by default to communicate." Is that a tut? Nope. I could go on and explain what I know about it and call it a tut. SOMEONE will learn SOMETHING from it, therefore it is a tut on what port the WWW service uses. Is it complete? no. Is it lacking? to some, yes...BUT... someone will find it informative, therefore they learned something, and teh tut was helpful.

Bottom line... I got something out of reading about it. I didnt know the entire comm process involved in a DHCP request. I knew the basic of how it worked but didnt know the actual commands or steps involved. My knowledge was you plugged in, the computer sent the request and got the address. I didnt know there were 5 steps... so I LEARNED SOMETHING.

[AngelicKnight]

As someone new to network administration, I found this very informative and educational, a must-read for any fellow newbie.

It also is in the forum section that fits it best. It is not exactly a tutorial per se, but that's what it is closest to. Otherwise, where else would put it? We don't have a general "lessons" forum, so this is the best fit.

[Juridian]

I never suggested someone dedicate another 3 weeks of their life to it. I suggested they take more time to make it better and work out some of the topics raised.

And no one arbitrarily raised the bar on the tutorials. Chsh posted some harsh criticism and I made a suggestion on improving the tutorial, and attempted to start a discussion with the group as a whole on how we could improve things for everyone. I don't have the power to decide these things, I'm simply trying to get people to talk about it.

You are more than welcome to hold onto your mediocrity like a child clutching his security blanket on a dark night. But if you choose to do so be prepared for the occasional bump of criticism to come echoing back from the darkness.

[AngelicKnight]

*ahem* Again I'll direct your attention to my last post.

What about another forum category, since some threads such as this are lessons in security, but not "how to" tutorials per se. If we're going to split hairs as such, that seems to be a feasible solution.

[chsh]

Originally posted here by KorpDeath
Maybe chsh should moderate the tut's forum? That way he could allow what he thinks is a proper tutorial.

I have no wish to moderate this forum.

I'm not attacking you, chsh and I do think that to some extent your criticism is valid however, there is a limit.

In your opinion. In mine, I am not outright calling the OP an idiot, I gave him harsh but rather (IMO) poignant criticism, therefore it's well within reason.

One man's trash is another man's treasure. That's why garage/yard sales exist. Just because it doesn't suit your concept of a tut doesn't mean it's all that worthless.

When the original tutorial poster himself doesn't bother to finish the tutorial, or go into any detail, how can you say it's something that might end up in a garage/yard sale? To me, if this tutorial were a woodworking project, it might end up in the scrap bin.

Originally posted here by gothic_type
Did you not read his tutorial? Because if you had done, I'm sure you would have seen that he had several examples of ways to "break the system" along with a method of "securing the system" against each scenario.

The examples given were no more explanatory than a single vague reference. "It can be done" vs "this is how to break it".

Originally posted here by HTRegz
Hey Hey,

Perhaps I should post a few things hear to clear them up... However I'm posting very little and I have no interest in arguing.

chsh: These inexpensive Catalyst 2950s that you speak of. Are they the same onces that start with a price tag of $650USD and work their way up to nearly $2000USD? I don't know about your bank account balance but to me that's a substantial amount of money.

You are not running a business.

Want to look at it from a business point of view? You've got 20 employees and you're scratching to make ends meet, the last thing you want is downtime or problems due to some sort of attack on your computer system, yet you have no money.

If you have no money, you can't do anything anyways. You have no way to expend the resources necessary to secure your systems.

Could you justify spending nearly $2000USD on a switch for this purpose? That could be a months profit for a smaller business.

$2000 profit for a company with 20 employees? If that's their fiscal situation they better start downsizing quick, random internal DHCP MITM attacks are the least of their worries.

You can't always look at things from a big business point of view. As far as your opinion of my tutorial. You don't like it that's fine. You've managed to bash many tutorials lately... if that's how you get your jolies... enjoy.

If you consider it bashing to say this should have been done better, so be it. The reaction of the cast of "regulars" speaks volumes about what is acceptable and what isn't.

When you post your own tutorial and show us all how it's done... then I'll start to respect your opinion.

I have posted several tutorials, even Tiger Shark managed to dig one up, so I know you are capable of it. When I have the time I will post a tutorial as I believe a tutorial should be written. Until then, I'll just have to live with your lack of respect for my opinion.

Thanks to the rest of ya for the feedback, glad to see most people enjoyed the read.

I find this most ironic of all, you only thank people for feedback that is positive. HT, look for a career in management, you'd be good at it.

[Negative]

http://www.neg.be/index/search.php?q=chsh... There you go.

This tutorial is in the Tutorials Section, has always been there, and will always remain there; therefore it is a Tutorial. How's that?

[AngelicKnight]

Now that's how you solve an argument. Kudos Neg.

[Tiger Shark]

even Tiger Shark managed to dig one up

Trust me Chris.... It wasn't the "little treasure" your know-it-all. "you do it wrong", "I'm so bloody superior" attitude around here had led me to believe it would be. In fact none of your tutorials are any better or worse than the ones you have been picking at recently. I can pick the same holes in all of them that you are picking now.

Keep throwing your stones little boy, your glass house is breaking too, every time you throw them.

Neg: It's quite clear that his intent is only to cause trouble here in recent times...... All he does is divert perfectly viable threads into his silly little flame wars.... If you look carefully he states he gives "constructive criticism" but he never contributes, he merely states that is isn't good enough..... Boot the silly little boy please.... He's a waste of bandwidth. If he comes back with a new account then he can prove himself to be of use or he can be negged right back off the board by the users themselves, right now he's got too many, (old), pos AP's for that to occur. Logically, that's a perfectly reasonable course of action. His over-inflated ego could probably use the pin-***** too.

[Juridian]

And flaming back and prodding to continue the fight is the proper way to handle things? The tone of your own posts doesn't exactly suggest that you wanted to continue the discussion in a polite manner...