Group items tagged

IP Helper-Address The ip helper-address command is a static command that is configured on a router interface to direct broadcasts to desired destinations within your internetwork. Configuring the ip helper-address command is simple and straightforward. You just have to be aware of which interface the broadcasts are being received on and where you want to forward these broadcasts to. For example, in Figure 7.21, the 2501A router Ethernet0 interface receives a Dynamic Host Configuration Protocol (DHCP) client request from HostA, which is a broadcast looking for a DHCP server. Figure 7.21: An ip helper-address single server example The 2501A router needs to be configured as follows: 2501A#config t 2501A(config)#interface ethernet0 2501A(config-if)#ip helper-address 172.16.30.2 The 2501A router now receives the DHCP client broadcast and forwards this broadcast to the DHCP server, which then provides a DHCP address to the client. If you have more than one DHCP server for redundancy purposes, as shown in Figure 7.22, you can configure a subnet broadcast address instead of a single server address. Figure 7.22: An ip helper-address multiple server example The 2501A router would be configured as follows: 2501A#config t 2501A(config)#interface ethernet0 2501A(config-if)#ip helper-address 172.16.30.255 The 2501 router now takes a DHCP client broadcast and sends this to any DHCP server on the 172.16.30.0 network. Remember that when you enable the ip helper-address command, you are forwarding more than just DHCP requests. Let’s discuss all the ports that are being forwarded

I’ve been a malware fighter for more than 20 years. I consider myself fairly up-to-date on the subject of malicious mobile code, malware, hackers, and exploitation vectors in general. So it was with surprise then that I read another of Google’s recent studies purporting that IIS Web servers were twice as likely to contain malware as Apache Web servers (although Apache and IIS Web servers contained malicious Web sites in equal numbers). This astounded me for several reasons. First, my personal experience tells me it isn’t so. I run multiple IIS and Apache Web servers on my honeynet, and my Apache Web servers get 89 percent more hacking traffic than my IIS servers.  Most of the traffic is PHP/CGI/MySQL based. This is not unexpected, as the Internet contains at least twice as many Apache Web servers, and popularity draws malicious hacking