Home / user-6962

MikeJ-UK's questions

Martin Hope
MikeJ-UK
Asked: 2010-01-27 06:20:24 +0800 CST
  • 2

We have inherited a legacy application which runs under DOS 6.2 and the Phar-Lap DOS extender (if anyone is old enough to remember that). It also uses up to 6 serial ports (16550) which are expected to exist at fixed port addresses & IRQs. There are still many of these systems in the field but the PCs are starting to fail and finding compatible motherboards is impossible due to the hard-coded IRQs used.

(The software installs interrupt handlers for the COM ports with COM3 to COM6 expected to use port/IRQ combinations of 3E8/10, 280/11, 2A0/12 & 3A8/15. With modern motherboards, this is a problem).

Does anyone know of any virtualization technology which allows you run-up a DOS guest on a host with 6 COM ports whose physical resources are mapped to the guest as above? The display requirement is VGA 640X480 and there is no network requirement.

virtualization serial legacy
Martin Hope
MikeJ-UK
Asked: 2009-09-18 08:08:53 +0800 CST
  • 3

Recently (in the last few days), my installation of IE8 has been taking 15 to 20 seconds to load my home page. Specifically, the sequence of events (as reported by WireShark) is:-

  • Browser issues a DNS A query to resolve the home page server's IP address.
  • Browser then spends the next 15-20 seconds broadcasting DNS SRV _LDAP._TCP queries, (roughly on a 2 second tick) to which it receives no answer (we have no LDAP servers).
  • Browser re-issues the DNS A query and resolves the server's IP address again.
  • Finally, the browser issues an HTTP GET for the home page.

Does anyone know why this is happening?

EDIT:
@Massimo, LDAP query is :-

Domain Name System (query)
  Transaction ID: 0x11c5
  Flags: 0x0100 (Standard query)
  Questions: 1
  Answer RRS: 0
  Authority RRS: 0
  Additional RRS: 0
  Queries
    _LDAP._TCP: type SRV, class IN
      Name: _LDAP._TCP
      Type: SRV (Service location)
      Class: IN (0x0001)
ldap
Martin Hope
MikeJ-UK
Asked: 2009-06-10 08:28:03 +0800 CST
  • 5

We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and 37777 for proprietary software access.

All this has suddenly stopped working and a little investigation shows that TCP SYN packets sent to his IP address (on either port) are getting immediately terminated with RST packets containing the message "Go away, we're not home". Googling this message gets a lot of stuff about the Storm Botnet which apparently does exactly this.

So the question is, how on earth can the Storm Botnet hijack an embedded Linux box. Or am I missing something else entirely?

firewall security botnet