Hello, welcome to the Friday, April 14th, 2017 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich,

and the day I'm recording from Orlando, Florida. Pretty interesting diary today by Rob about how to use net shell to capture packets for a specific process. If you're using TCP dump or

Wireshark to collect packets, then of course you're losing the information as to which process

did create packets or receive them. Well, turns out if you are collecting network packets directly in net shell, then this information is retained and you can later filter by it.

In order to do so, you need to load the net shell capture in Microsoft Message Analyzer, which allows you to then select messages, which includes packets by process, and from

there you can export these packets into a PCAP file for further analysis.

And Akamai is reporting that they're seeing large denial of service attacks that use connectionless LDAB as an

amplification vector. For connectionless LDAP, you have LDAB servers that are exposed as part of

voice over IP gateways. Turns out that a lot of systems that are running SIP also use LDAAP for all vacation and do not properly protect the LDAB server.

For connectionless LDAAP, the queries being used here are about 50 bytes in length, while the reply is close to 3 kilobytesytes length, so you certainly have a pretty neat

amplification. And of course, there are thousands, if not tens of thousands, vulnerable systems

out there that can be used as amplifier. And Juniper released a number of bulletins fixing

various vulnerabilities in June OS.

Some of these vulnerabilities affect open source software that is included in Juniper's operating system.

One of the more interesting vulnerabilities being addressed in this update is atomic fragments.

This is really an issue with the IPV6 specification.

The specification has been amended recently, allowing you to turn off this feature.

The problem arises if a host receives a message that a packet is too large and needs to be fragmented,

but the MTAU advertised is less than 120 bytes.

MTOs of less than 1280 bytes are not valid in IPV6,

so operating systems are supposed to send atomic fragments, which are really complete

packets that include a fragment header. Since this required behavior has led to potential denial

...