Showing posts with label address. Show all posts
Showing posts with label address. Show all posts

Tuesday, September 11, 2012

IP ADDRESS STRUCTURE


Every station on a PSN (packet switched network) that is based on the TCP/IP
protocol (your computer is one, for example. Yes, we're referring to a host
that is connected to the net) must have an IP address, so it can be identified,
and information can be relayed and routed to it in an orderly fashion.



An IP address consists of a 32 bit logical address. The address is divided
into two fields:



1) The network address:


Assigned by InterNIC (Internet Network Information Center).
In fact most ISPs (internet service providers) purchase a number of addresses
and assign them individually.



2) The host address:


An address that identifies the single nodes throughout the network. It can be assigned
by the network manager, by using protocols for it such as DHCP, or the workstation itself.



[The IP networking protocol is a logically routed protocol, meaning that address 192.43.54.2
will be on the same physical wire as address 192.43.54.3 (of course this is not always true. It depends on the

subnet mask of the network, but all of that can fill a text of its own)


IP address structure:


   ---.---.---.---

   ^             ^
   |             |
network    |    host

Every " --- " = 8 bits.
The first bits ===> network address
The last bits  ===> host address.
with 8 bits you can present from 0-255 . (binary=(2 to the power of 8)-1)

Example:
11000010.01011010.00011111.01001010 (binary)
194.90.31.74 (decimal)
IP address CLASSES :
We can classify IP addreses to 5 groups. You can distinguish them by comparing the "High Order" bits (the first four bits on the
left of the address):

type  | model  | target | MSB |addr.range    |bit number| max.stations|
     |        | groups |     |              |net./hosts|             |
------|--------|--------|-----|--------------|----------|-------------|
 A   |N.h.h.h | ALL    |  0  | 1.0.0.0      |   24/7   | 16,777,214  |
     |        | ACCEPT |     |    to        |          |             |
     |        | HUGE   |     | 127.0.0.0    |          |             |
     |        | CORPS  |     |              |          |             |
-----------------------------------------------------------------------
     |N.N.h.h | TO ALL | 10  | 128.1.00     | 16/14    | 65,543      |
 B   |        | LARGE  |     |    to        |          |             |
     |        | CORPS  |     | 191.254.00   |          |             |
-----------------------------------------------------------------------
     |N.N.N.h |TO ALOT | 110 | 192.0.1.0    | 8/22     |  254        |
 C   |        |OF      |     |    to        |          |             |
     |        |SMALL   |     | 223.225.254  |          |             |
     |        |CORPS   |     |              |          |             |
-----------------------------------------------------------------------
D    | NONE   |MULTI-CA|1110 | 224.0.0.0     | NOT FOR |   UNKNOWN   |
     |        |ST ADDR.|     |    to         | USUAL   |             |
     |        |RFC-1112|     |239.255.255.255| USE     |             |
-----------------------------------------------------------------------
E    | NOT FOR|EXPERIME|1,1,1,1| 240.0.0.0     |NOT FOR|  NOT FOR USE|
     |  USE   |NTAL    |       |   to          |USE    |             |
     |        |ADDR.   |       |254.255.255.255|       |             |
-----------------------------------------------------------------------

N=NETWORK , h=HOST .



Notice the address range 127.X.X.X.
These addresses are assigned to internal use to the network device, and are
used as an application tool only. For example: 127.0.0.1, the most common one,
is called the loopback address - everything sent here goes directly back to
you, without even traveling out on the wire.
Also, some IPs are reserved for VPNs - Virtual Private Networks. These are
local area networks over wide area networks that use the Internet Protocol to
communicate, and each computer inside the network is assigned with an IP
address. So, suppose a certain computer wants to send a data packet to
another host on the network with the IP 'x', but there's also another host on
the Internet that has the same IP - what happens now? So this is why you
cannot use these and other forms of reserved IPs on the Internet.

EXTRA:

Distinguishing different groups:

You have to compare the first byte on the left in the address as follows:




Type |    First byte  | MSB
    |    in decimal  |
----------------------------
A    | 1-127          | 0
----------------------------
B    | 128-191        | 10
----------------------------
C    | 192-223        | 110
----------------------------
D    | 224-239        | 1110
----------------------------
E    | 240-254        | 1111
----------------------------


NOTES: Yes, we know, we've left A LOT of things unexplained in this text.
With time, we will write more tutorials to cover these and other subjects. So
in the meantime, I suggest that you go to http://blacksun.box.sk, find the
tutorials page and see if there's anything else that's interesting to you.
And remember - we also have a message board, so if you have any questions,
feel free to post them there.


weird shit (newbie note):

1) Multicast: (copied from RFC 1112)
  IP multicasting is the transmission of an IP datagram to a "host
  group", a set of zero or more hosts identified by a single IP
  destination address.  A multicast datagram is delivered to all
  members of its destination host group with the same "best-efforts"
  reliability as regular unicast IP datagrams, i.e., the datagram is
  not guaranteed to arrive intact at all members of the destination
  group or in the same order relative to other datagrams.

  The membership of a host group is dynamic; that is, hosts may join
  and leave groups at any time.  There is no restriction on the
  location or number of members in a host group.  A host may be a
  member of more than one group at a time.  A host need not be a member
  of a group to send datagrams to it.

  A host group may be permanent or transient.  A permanent group has a
  well-known, administratively assigned IP address.  It is the address,
  not the membership of the group, that is permanent; at any time a
  permanent group may have any number of members, even zero.  Those IP
  multicast addresses that are not reserved for permanent groups are
  available for dynamic assignment to transient groups which exist only
  as long as they have members.

  Internetwork forwarding of IP multicast datagrams(ip packets)is handled by
  "multicast routers" which may be co-resident with, or separate from,
  internet gateways.  A host transmits an IP multicast datagram as a
  local network multicast which reaches all immediately-neighboring
  members of the destination host group.  If the datagram has an IP
  time-to-live greater than 1, the multicast router(s) attached to the
  local network take responsibility for forwarding it towards all other
  networks that have members of the destination group.  On those other
  member networks that are reachable within the IP time-to-live, an
  attached multicast router completes delivery by transmitting the
  datagram(ip packet) as a local multicast.

  *if you donot understand the above do not worry, it is complicated and dry
  but reread it and read it again get a dictionary if it helps.
  Hacking is not easy.

2) MSB: Most Significent Bit:
  In set numbers the first number on the left is the most important because it
  holds the highest value as opposed to the LSB=> least significent bit, it
  always holds the the smallest value.

Let us know your comments ...

Wednesday, August 29, 2012

Change Your IP In Less a Minute

Change Your Ip In Less Then 1 Minute


1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit ok

You should now be at an MSDOS prompt screen.

4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.
7. Click on "properties"

You should now be on a screen with something titled "Local Area Connection", or something close to that, and, if you have a network hooked up, all of your other networks.

8. Right click on "Local Area Connection" and click "properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the "General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until i fill the area up).
12. Press "Tab" and it should automatically fill in the "Subnet Mask" section with default numbers.
13. Hit the "Ok" button here
14. Hit the "Ok" button again

You should now be back to the "Local Area Connection" screen.

15. Right-click back on "Local Area Connection" and go to properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP address automatically"
tongue.gif 18. Hit "Ok"
19. Hit "Ok" again
20. You now have a new IP address

With a little practice, you can easily get this process down to 15 seconds.

P.S:
This only changes your dynamic IP address, not your ISP/IP address. If you plan on hacking a website with this trick be extremely careful, because if they try a little, they can trace it back

Leave your comments for better review

check dos to see if you are infected


Check For Dos Check to see if you are infected

When you first turn on you computer (BEFORE DIALING INTO YOUR ISP),
open a MS-DOS Prompt window (start/programs MS-DOS Prompt).
Then type netstat -arn and press the Enter key.
Your screen should display the following (without the dotted lines
which I added for clarification).

-----------------------------------------------------------------------------
Active Routes:

  Network Address          Netmask  Gateway Address        Interface  Metric
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
  255.255.255.255  255.255.255.255  255.255.255.255          0.0.0.0      1

--------------------------------------------------------------------------------

If you see anything else, there might be a problem (more on that later).
Now dial into your ISP, once you are connected;
go back to the MS-DOS Prompt and run the same command as before
netstat -arn, this time it will look similar to the following (without
dotted lines).

-------------------------------------------------------------------------------------

Active Routes:

  Network Address          Netmask  Gateway Address        Interface  Metric
          0.0.0.0          0.0.0.0    216.1.104.70    216.1.104.70      1
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      216.1.104.0    255.255.255.0    216.1.104.70    216.1.104.70      1
    216.1.104.70  255.255.255.255        127.0.0.1        127.0.0.1      1
    216.1.104.255  255.255.255.255    216.1.104.70    216.1.104.70      1
        224.0.0.0        224.0.0.0    216.1.104.70    216.1.104.70      1
  255.255.255.255  255.255.255.255    216.1.104.70    216.1.104.70      1

Route Table

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:0              0.0.0.0:0              LISTENING
  TCP    216.1.104.70:137      0.0.0.0:0              LISTENING
  TCP    216.1.104.70:138      0.0.0.0:0              LISTENING
  TCP    216.1.104.70:139      0.0.0.0:0              LISTENING
  UDP    216.1.104.70:137      *:*      

--------------------------------------------------------------------------------

What you are seeing in the first section (Active Routes) under the heading of
Network Address are some additional lines. The only ones that should be there
are ones belonging to your ISP (more on that later). In the second section
(Route Table) under Local Address you are seeing the IP address that your ISP
assigned you (in this example 216.1.104.70).

The numbers are divided into four dot notations, the first three should be
the same for both sets, while in this case the .70 is the unique number
assigned for THIS session. Next time you dial in that number will more than
likely be different.

To make sure that the first three notation are as they should be, we will run
one more command from the MS-DOS window.
From the MS-DOS Prompt type tracert /www.yourispwebsite.com or .net
or whatever it ends in. Following is an example of the output you should see.

---------------------------------------------------------------------------------------

Tracing route to /www.motion.net [207.239.117.112]over a maximum of 30 hops: 
1  128 ms  2084 ms  102 ms  chat-port.motion.net [216.1.104.4]
2  115 ms  188 ms  117 ms  chat-core.motion.net [216.1.104.1]
3  108 ms  116 ms  119 ms  www.motion.net [207.239.117.112]
Trace complete.

------------------------------------------------------------------------------------------

You will see that on lines with the 1 and 2 the first three notations of the
address match with what we saw above, which is a good thing. If it does not,
then some further investigation is needed.

If everything matches like above, you can almost breath easier. Another thing
which should you should check is programs launched during startup. To find
these, Click start/programs/startup, look at what shows up. You should be
able to recognize everything there, if not, once again more investigation is
needed.

-------------------------------------------------------------------------------------------

Now just because everything reported out like we expected (and demonstrated
above) we still are not out of the woods. How is this so, you ask? Do you use
Netmeeting? Do you get on IRC (Internet Relay Chat)? Or any other program
that makes use of the Internet. Have you every recieved an email with an
attachment that ended in .exe? The list goes on and on, basically anything
that you run could have become infected with a trojan. What this means, is
the program appears to do what you expect, but also does just a little more.
This little more could be blasting ebay.com or one of the other sites that
CNNlive was talking about.

What can you do? Well some anti-virus software will detect some trojans.
Another (tedious) thing is to start each of these "extra" Internet programs
one at a time and go through the last two steps above, looking at the routes
and connection the program uses. However, the tricky part will be figuring
out where to tracert to in order to find out if the addresses you see in
step 2 are "safe" or not. I should forewarn you, that running tracert after
tracert, after tracert might be considered "improper" by your ISP. The steps
outlined above may not work exactly as I have stated depending upon your ISP,
but with a true ISP it should work. Finally, this advise comes with NO
warranty and by following my "hints' you implicitly release me from ANY and
ALL liability which you may incur.


 Other options

Display protocol statistics and current TCP/IP network connections.
Netstat [-a] [-e] [-n] [-s] [-p proto] [-r] [intervals]

-a.. Display all connections and listening ports.
-e.. Display Ethernet statistics. This may be combined with the -s option.
-n.. Diplays address and port numbers in the numerical form.
-p proto..Shows connections for the protocol specified by proto; proto may be
TCP or UDP. If used with the -s option to display per-protocol statistics,
proto may be TCP, UDP, of IP.
-r.. Display the routing table.
-s.. Display per-protocol statistics. By default, statistics are shown for TCP
UDP and IP; the -p option may be used to specify a subset of the default
interval..Redisplay selected statistics, pausing intervals seconds between each
display. If omitted. netstat will print the current configuration information
once


Leave your comments for better review