Showing posts with label internet. Show all posts
Showing posts with label internet. Show all posts

Make Your Internet Speed As Fast as Possible

Make Your Internet Speed As Fast as Possible

Posted by tech master  |  at  2:16 AM



Here are Registry Tweaks and Scroll down to see Patches


1.Increase bandwidth by tweaking QoS in Windows XP Pro

The following tweak applies only to Windows XP Professional edition.

The default system behavior is that all 100% bandwidth is available, however, if there is a running application that indicates to the OS it needs to send high priority/real time data, then as long as it has the socket open, Windows XP will restrict “best effort” traffic to 80% of the bandwidth so that high priority traffic can be accommodated. Basically, applications can make this request to the operating system for QoS support using the QoS application programming interfaces (APIs) in Windows and this only applies if a specific app is requesting QoS.

If you'd like to change how much bandwidth is reserved for QoS (the default is 20% of the total bandwidth), do the following:

1. Make sure you're logged in as "Administrator" (not just any account with admin privileges).
2. Navigate to START>Run and type: gpedit.msc
3. Navigate to Local Computer Policy > Administrative Templates > Network > QOS Packet Scheduler
4. In the right window, double-click the limit reservable bandwidth setting
5. On the setting tab, check the enabled setting.
6. Where it says "Bandwidth limit %", change it to read 0 (or whatever percentage you want to reserve for high priority QoS data)
7. Click OK, close gpedit.msc

Under START > My Computer > My Network Connections > View Network Connections, right-click on your connection and under Properties (where it lists your protocols), make sure QOS Packet Scheduler is enabled.



The tweak desribed below helps boost priority for DNS & hostname resolution in general. What this means is, it helps web pages load faster, and has negligible effect on downloads (not counting the couple of ms gain with the host resolution at connect-time).

Applying this tweak assumes some proficiency in editing the Windows Registry using Regedit (Start > Run > type: regedit). As always, backup your Registry before making any changes so you can revert to the previous state if you don't like the results.


2.Host Resolution Priority Tweak
host name resolution priority
Windows 2k/XP

First, open the Windows Registry using Regedit, and (after backing up) navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider



Note the following lines (all hex dwords):
Class = 008 (8) - indicates that TCP/IP is a name service provider, don't change.

LocalPriority = 1f3 (499) - local names cache
HostsPriority = 1f4 (500) - the HOSTS file
DnsPriority = 7d0 (2000) - DNS
NetbtPriority = 7d1 (2001) - NetBT name-resolution, including WINS

What we're aiming to do is increase the priority of the last 4 settings, while keeping their order. The valid range is from -32768 to +32767 and lower numbers mean higher priority compared to other services. What we're aiming at is lower numbers without going to extremes, something like what's shown below should work well:

Change the "Priority" lines to:
LocalPriority = 005 (5) - local names cache
HostsPriority = 006 (6) - the HOSTS file
DnsPriority = 007 (7) - DNS
NetbtPriority = 008 (8) - NetBT name-resolution, including WINS

Windows 9x/ME

The tweak is essentialy the same as in Windows 2000/XP, just the location in the Registry is slightly different. For a more detailed description see the Windows 2000/XP section above.

Open the Windows Registry using Regedit, and (after backing up) navigate to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP\ServiceProvider

You should see the following settings:
Class=hex:08,00,00,00

LocalPriority=hex:f3,01,00,00
HostsPriority=hex:f4,01,00,00
DnsPriority=hex:d0,07,00,00
NetbtPriority=hex:d1,07,00,00

The "priority" lines should be changed to:
LocalPriority=hex:05,00,00,00
HostsPriority=hex:06,00,00,00
DnsPriority=hex:07,00,00,00
NetbtPriority=hex:08,00,00,00

Reboot for changes to take effect.


In addition to the tweaks already covered in Win 2k/XP Registry Tweaks and More Win 2k/XP Tweaks, the Windows XP Service Pack 2 introduces a few new issues covered in the article below. Please make sure you understand what you are doing before making any changes to your Operating System. Note the information below only applies to Windows XP Service Pack 2.



3.Remove the limit on TCP connection attempts

Windws XP SP2 introduces a few new twists to TCP/IP in order to babysit users and "reduce the threat" of worms spreading fast without control. In one such attempt, the devs seem to have limited the number of possible TCP connection attempts per second to 10 (from unlimited in SP1). This argumentative feature can possibly affect server and P2P programs that need to open many outbound connections at the same time.

Rant: The forward thinking of Microsoft developers here is that you can only infect 10 new systems per second via TCP/IP ?!?... If you also consider that each of those infected computers will infect 10 others at the same rate:
second 1: 1+10 computers
second 2: 10+10*10 computers (110 new ones)
second 3: 10+100*10 computers ( 1110 new ones)
second 4: 10+1000*10 computers (11110 new ones)
....
all the way to 10*60 + 10^60 computers in a single minute (that's a number with 60 digits, or it would far exceed Earth's population). Even if we consider that 90% of those computers are unreachable/protected, one would still reach ALL of them within a minute.

In other words, even though it is not going to stop worm spreading, it's going to delay it a few seconds, limit possible network congestion a bit, and limit the use of your PC to 10 connection attempts per second in the process ! I have no problem with the new default setting limiting outbound connection attempts. Still, users should have the option to easily disable or change this setting. I might be going out on a limb here, but ever since the introduction of Windows XP I can't help thinking that I dislike all the bult-in Windows "wisardry" in a sense that the system also limits user access. That irritating trend to ease the mental load on end users is somewhat insulting, considering that Windows is to make the more "intelligent" choice instead of the end user, as well as limit their access to tuning such settings...
End of rant.

With the new implementation, if a P2P or some other network program attempts to connect to 100 sites at once, it would only be able to connect to 10 per second, so it would take it 10 seconds to reach all 100. In addition, even though the setting was registry editable in XP SP1, it is now only possible to edit by changing it directly in the system file tcpip.sys. To make matters worse, that file is in use, so you also need to be in Safe mode in order to edit it.

You only need to worry about the number of connection attempts per second if you have noticed a slowdown in network programs requiring a number of connections opened at once. You can check if you're hitting this limit from the Event Viewer, under System - look for TCP/IP Warnings saying: "TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts". Keep in mind this is a cap only on incomplete outbound connect attempts per second, not total connections. Still, running servers and P2P programs can definitely be affected by this new limitation. Use the fix as you see fit.

To change or remove the limit, you can use the following program:

Event ID 4226 Patcher v2.11


http://www.speedguide.net/files/xp_sp2/EvID4226Patch211a-en.zip


- A patching program for removing or changing the limit imposed on connection attempts in SP2. The patcher has the ability to restore tcpip.sys back to the original... Still, you might want to back up tcpip.sys, use it at your own risk. The author of this patch can be reached @ http://www.lvllord.de/

4. Recommended settings for Windows 2000 / XP
Windows 2000 & XP, unlike NT supports large windows as described in RFC1323 ( the 'RcvWindow' has a maximum value of 2**30 rather than 64K), and includes some other improvements over its predecessors you can use to speed up any TCP/IP transfers. , the descriptions and other options are added to provide you with better understanding and enable you to customize your settings.

All the following entries, unless otherwise noted should be placed in the Windows 2000/XP Registry under the key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

TCPWindowSize

The value of TCP Window in the Windows 2000 Registry is DWORD, representing number of bytes, with range from 0 to 2^30. The recommended values (in red) optimize TCP for any high speed Internet connection and work best in most cases, however if you'd like to use a custom value follow these guidelines:

For best results, the TCPWindow should be a multiple of MSS (Maximum Segment Size). MSS is generally MTU - 40, where MTU (Maximum Transmission Unit) is the largest packet size that can be transmitted. MTU is usually 1500 (1492 for PPPoE connections). To determine the MTU value of your ISP, check out the Advanced Registry Editing section of our site.

There are three places in the Windows 2000 Registry where you can add the TCP Window parameter.

HKLM/SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
GlobalMaxTcpWindowSize="256960" (DWORD, number of bytes) Valid range is from MSS to 2^30. Add the value as a decimal. Note: For best results RWIN has to be a multiple of MSS lower than 65535 times a scale factor that's a power of 2, i.e. 44 x 1460 = 64240 x 2^2 = 256960. If you choose to use a RWIN lower than 65535, you can simply make it multiple of MSS and turn scaling off (Tcp1323Opts=0)

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
TcpWindowSize="256960" (DWORD, number of bytes) Valid range is from MSS to 2^30. Add the value as a decimal. TcpWindowSize can also exist under TcpipParametersInterface - if added at this location, it overrides the global setting for this particular . Note (10/20/00): Seems MS has found another bug in Windows 2000, the TCPWindowSize should be configured with the global setting (GlobalMaxTcpWindowsSize) rather than this one - Q263088

Note: For best results RWIN has to be a multiple of MSS lower than 65535 times a scale factor that's a power of 2, i.e. 44 x 1460 = 64240 x 2^2 = 256960. If you choose to use a RWIN lower than 65535, you can simply make it multiple of MSS and turn scaling off (Tcp1323Opts=0)

Tcp1323Opts

Tcp1323Opts is a necessary setting in order to enable Large TCPWindow support as described in RFC 1323. Without this parameter, the TCPWindow is limited to 64K.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Tcp1323Opts="1" (DWORD, recommended setting is 1. The possible settings are 0 - Disable RFC 1323 options, 1 - Window scaling but no Timestamp options, 3 - Window scaling and Time stamp options.)

Note: Tcp1323Opts="3" might help in some cases where there is increased packet loss, however generally you'll achieve better throughput with Tcp1323Opts="1", since Timestamps add 12 bytes to the header of each packet.

DefaultTTL

DefaultTTL determines the time in seconds and the number of hops a packet lives. While it does not directly affect speed, a larger value increases the amount of time it takes for a packet to be considered lost, discarded and retransmitted. A value that's too small can cause packets to be unable to reach distant servers at all.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
DefaultTTL="64" (DWORD, recommended setting is 64. Other settings that are widely used are 128 and 32)

EnablePMTUDiscovery

When set to 1 (True), TCP attempts to discover MTU automatically over the path to a remote host. Setting this parameter to 0 causes MTU to default to 576 which reduces overall performance over high speed connections. Note that this setting is different than our Windows 9x recommendation.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
EnablePMTUDiscovery="1" (DWORD - boolean, valid settings are 0-->False and 1-->True. Many connections perform better with this entry at 1, however, if you prefer to set your upstream to send fixed 1500 packets, you might want to use 0 instead). When set at 1, establishing connections and initial transfer speed might slow down a bit, however you will get better throughput if somewhere in the path large packets need to be fragmented.

EnablePMTUBHDetect

Setting this parameter to 1 (True) enables "black hole" routers to be detected, however it also increases the maximum number of retransmissions for a given segment. In most cases you'd want to keep BHDetect to 0 (False).

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
EnablePMTUBHDetect="0" (DWORD - boolean, valid settings are 0-->False and 1-->True. Recommended setting is 0)

SackOpts

This parameter controls whether or not SACK (Selective Acknowledgement) support is enabled, as specified in RFC 2018. SACK is especially important for connections using large TCP Window sizes.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
SackOpts="1" (DWORD - boolean, recommended setting is 1. Possible settings are 0 - No Sack options or 1 - Sack Option enabled).

TcpMaxDupAcks

This parameter determines the number of duplicate ACKs that must be received for the same sequence number of sent data before "fast retransmit" is triggered to resend the segment that has been dropped in transit.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
TcpMaxDupAcks="2" (DWORD - range 1-3, recommended setting is 2).



Patches


This Includes

1. sguide_tweak_2k.zip
Description: Generic patch for Windows XP and Windows 2000 (all versions). This patch will optimize your TCP/IP Registry settings for high speed Internet connections. To install, extract the .inf file first, then double-click (or right-click on filename and choose install from the pull-down menu) and reboot for changes to take effect.


http://www.speedguide.net/files/sguide_tweak_2k.zip


2.sguide_tweak_2k_pppoe.zip

Description: Generic patch for Windows XP/2000 and DSL connections using PPPoE. This patch will optimize your TCP/IP Registry settings for high speed Internet connections. It is specifically designed for PPPoE DSL connections. To install, extract the .inf file first, then double-click (or right-click on filename and choose install from the pull-down menu) and reboot for changes to take effect.


http://www.speedguide.net/files/sguide_tweak_2k_pppoe.zip



3. winxp_dnscache.zip

Description: Patch Windows 2k/XP not to cache failed DNS entries. By default, when a DNS lookup fails (due to temporary DNS problems), Windows still caches the unsuccessful DNS query, and in turn fails to connect to a host regardless of the fact that the DNS server might be able to handle your lookup seconds later. This patch fixes the problem by configuring the DNS client to continue sending queries to an unresponsive network. To install, save to your HD, unzip the .reg file, then double-click the filename.

Web Patches - faster loading of Web Pages

The following patch increases Web page loading speed, by doubling the number of possible concurrent open connections. For example, imagine a web page has 20 images and some text - in order for your browser to get all these files, it opens 2 or 4 concurrent connections, depending on the Web server. Increasing the number of open connections allows for faster retrieving of the data. Please note that the patch sets some values outside of the HTML specs. If you decide to install it, backup your Registry first. Changes will take effect after you reboot. Download the patch appropriate for your OS:

OS: Windows 9x/ME

http://www.speedguide.net/files/sg_webtweak_9x.zip


OS: Windows 2K/XP/2k3


http://www.speedguide.net/files/sg_webtweak_2k.zip


TCP OPTIMISER

Image

Description: The TCP Optimizer is a free, easy Windows program that provides an intuitive interface for tuning and optimizing your Internet connection. Just download and run, there is no installaion required. The program makes it easy to find the best MTU and RWIN values, test latency and tweak all the important broadband related registry parameters. The Optimizer can be helpful with tuning any Internet connection type, from dialup to Gigabit+


URL http://www.speedguide.net/files/TCPOptimizer.exe

Store your files online with Livedrive

Store your files online with Livedrive

Posted by tech master  |  at  10:49 PM

Ever wanted to store file online with Unlimited storage space.Then try live drive

About Livedrive

Livedrive is creating technology that will revolutionize the way people store and access their files, photos, music, videos and other digital content.

Our vision is simple: don't store files on your PC; store them on your Livedrive instead. Livedrive is your personal storage space on the Internet. Its unlimited, it's secure and it's there forever.

Store it on Livedrive, access it anywhere
Works on your PC just like a normal hard drive or USB drive
See the same files on all your PCs
See all your files on your mobile, PDA or other devices
Access everything from the web
Share anything with just one click
No need to backup - everything on your Livedrive is stored securely
read more @about

Features

* Unlimited storage
space unlimitedstorage-star
* See the same files on all your PCs, the Web and your mobile.
* Works like a normal hard drive
* Send files to anyone

Send large documents, presentations and ZIP files to contacts and clients. Forget the hassle of emailing attachments
* Livedrive is optimised for Apple iPhones
* Work online - Office compatible
* Works even when your PC is disconnected
* Works with your favourite sites
More features can be found here

Tracking A Hacker

Tracking A Hacker

Posted by tech master  |  at  11:04 PM

Sometimes, it's just not enough to simply know that there's a Trojan or Virus onboard. Sometimes you need to know exactly why that file is onboard, how it got there - but most importantly, who put it there.

By enumerating the attacker in the same way that they have enumerated the victim, you will be able to see the bigger picture and establish what you're up against. But how can you do this? Read on...

## Connections make the world go round ##

The computer world, at any rate. Every single time you open up a website, send an email or upload your webpages into cyberspace, you are connecting to another machine in order to get the job done. This, of course, presents a major problem, because this simple act is what allows malicious users to target a machine in the first place.

# How do these people find their victim?

Well, first of all, they need to get hold of the victim's IP Address. Your IP (Internet Protocol) address reveals your point of entry to the Internet and can be used in many ways to cause your online activities many, many problems. It may not reveal you by name, but it may be uniquely identifiable and it represents your digital ID while you are online (especially so if you're on a fixed IP / DSL etc).

With an IP address, a Hacker can find out all sorts of weird and wonderful things about their victim (as well as causing all kinds of other trouble, the biggest two being Portnukes/Trojans and the dreaded DoS ((Denial of Service)) attack). Some Hackers like to collect IP Addresses like badges, and like to go back to old targets, messing them around every so often. An IP address is incredibly easy to obtain - until recently, many realtime chat applications (such as MSN) were goldmines of information. Your IP Address is contained as part of the Header Code on all emails that you send and webpages that you visit can store all kinds of information about you. A common trick is for the Hacker to go into a Chatroom, paste his supposed website address all over the place, and when the unsuspecting victim visits, everything about your computer from the operating system to the screen resolution can be logged...and, of course, the all important IP address. In addition, a simple network-wide port scan will reveal vulnerable target machines, and a war-dialler will scan thousands of lines for exposed modems that the hacker can exploit.

So now that you know some of the basic dangers, you're probably wondering how these people connect to a victim's machine?

## Virtual and Physical Ports ##

Everything that you recieve over the Internet comes as a result of other machines connecting to your computer's ports. You have two types; Physical are the holes in the back of your machine, but the important ones are Virtual. These allow transfer of data between your computer and the outside world, some with allocated functions, some without, but knowing how these work is the first step to discovering who is attacking you; you simply MUST have a basic knowledge of this, or you won't get much further.

# What the phrases TCP/UDP actually mean

TCP/IP stands for Transmission Control Protocol and Internet Protocol, a TCP/IP packet is a block of data which is compressed, then a header is put on it and it is sent to another computer (UDP stands for User Datagram Protocol). This is how ALL internet transfers occur, by sending packets. The header in a packet contains the IP address of the one who originally sent you it. Now, your computer comes with an excellent (and free) tool that allows you to see anything that is connected (or is attempting to connect) to you, although bear in mind that it offers no blocking protection; it simply tells you what is going on, and that tool is NETSTAT.

## Netstat: Your first line of defence ##

Netstat is a very fast and reliable method of seeing exactly who or what is connected (or connecting) to your computer. Open up DOS (Start/Programs/MS-DOS Prompt on most systems), and in the MSDOS Prompt, type:

netstat -a

(make sure you include the space inbetween the "t" and the "a").

If you're connected to the Internet when you do this, you should see something like:


Active Connections

Proto Local Address Foreign Address State
TCP macintosh: 20034 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED
TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING


Now, "Proto(col)" simply means what kind of data transmission is taking place (TCP or UDP), "Local address" is your computer (and the number next to it tells you what port you're connected on), "Foreign Address" is the machine that is connected to you (and what port they're using), and finally "State" is simply whether or not a connection is actually established, or whether the machine in question is waiting for a transmission, or timing out etc.

Now, you need to know all of Netstat's various commands, so type:

netstat ?

You will get something like this:


Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default.


Have a play around with the various options, but the most important use of these methods is when you combine them. The best command to use is

netstat -an

because this will list all connections in Numerical Form, which makes it a lot easier to trace malicious users....Hostnames can be a little confusing if you don't know what you're doing (although they're easily understandable, as we shall see later). Also, by doing this, you can also find out what your own IP address is, which is always useful.

Also,

netstat -b

will tell you what ports are open and what programs are connecting to the internet.

## Types of Port ##

It would be impossible to find out who was attacking you if computers could just access any old port to perform an important function; how could you tell a mail transfer from a Trojan Attack? Well, good news, because your regular, normal connections are assigned to low, commonly used ports, and in general, the higher the number used, the more you should be suspicious. Here are the three main types of port:

# Well Known Ports These run from 0 to 1023, and are bound to the common services that run on them (for example, mail runs on channel 25 tcp/udp, which is smtp (Simple Mail Transfer Protocol) so if you find one of these ports open (and you usually will), it's usually because of an essential function.

# Registered Ports These run on 1024 to 49151. Although not bound to a particular service, these are normally used by networking utilities like FTP software, Email client and so on, and they do this by opening on a random port within this range before communicating with the remote server, so don't panic (just be wary, perhaps) if you see any of these open, because they usually close automatically when the system that's running on them terminates (for example, type in a common website name in your browser with netstat open, and watch as it opens up a port at random to act as a buffer for the remote servers). Services like MSN Messenger and ICQ usually run on these Ports.

# Dynamic/Private Ports Ranging from 49152 to 65535, these things are rarely used except with certain programs, and even then not very often. This is indeed the usual range of the Trojan, so if you find any of these open, be very suspicious. So, just to recap:


Well Known Ports 0 to 1023 Commonly used, little danger.
Registered Ports 1024 to 49151 Not as common, just be careful.
Dynamic/Private Ports 49152 to 65535 Be extremely suspicious.


## The hunt is on ##

Now, it is essential that you know what you're looking for, and the most common way someone will attack your machine is with a Trojan. This is a program that is sent to you in an email, or attempts to bind itself to one of your ports, and when activated, it can give the user your passwords, access to your hard drive...they can even make your CD Tray pop open and shut. At the end of this Document, you will find a list of the most commonly used Trojans and the ports they operate on. For now, let's take another look at that first example of Netstat....



Active Connections

Proto Local Address Foreign Address State
TCP macintosh: 27374 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED
TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING


Now, straight away, this should make more sense to you. Your computer is connected on two ports, 80 and 27374. Port 80 is used for http/www transmissions (ie for all intents and purposes, its how you connect to the net, although of course it's a lot more complicated than that). Port 27374, however, is distinctly suspicious; first of all, it is in the registered port range, and although other services (like MSN) use these, let's assume that you have nothing at all running like instant messengers, webpages etc....you're simply connected to the net through proxy. So, now this connection is looking even more troublesome, and when you realise that 27374 is a common port for Netbus (a potentially destructive Trojan), you can see that something is untoward here. So, what you would do is:


1) run Netstat , and use:

Netstat -a

then

Netstat -an

So you have both Hostnames AND IP addresses.


## Tracerouting ##

Having the attacker's IP is all well and good, but what can you do with it? The answer is, a lot more! It's not enough to have the address, you also need to know where the attacker's connections are coming from. You may have used automated tracerouting tools before, but do you jknow how they work?

Go back to MSDOS and type


tracert *type IP address/Hostname here*


Now, what happens is, the Traceroute will show you all the computers inbetween you and the target machine, including blockages, firewalls etc. More often than not, the hostname address listed before the final one will belong to the Hacker's ISP Company. It'll either say who the ISP is somewhere in there, or else you run a second trace on the new IP/hostname address to see who the ISP Company in question is. If the Hostname that you get back doesn't actually seem to mention an actual geographical location within its text, you may think all is lost. But fear not! Suppose you get a hostname such as

http://www.haha.com

Well, that tells us nothing, right? Wrong....simply enter the hostname in your browser, and though many times you will get nothing back, sometimes it will resolve to an ISP, and from there you can easily find out its location and in what areas they operate. This at least gives you a firm geographical location to carry out your investigations in.

If you STILL have nothing, as a last resort you COULD try connecting to your target's ISP's port 13 by Telnet, which will tell you how many hours ahead or behind this ISP is of GMT, thus giving you a geographical trace based on the time mentioned (although bear in mind, the ISP may be doing something stupid like not having their clocks set correctly, giving you a misleading trace. Similarly, a common tactic of Hackers is to deliberately have their computer's clock set to a totally wrong time, so as to throw you off the scent). Also, unless you know what you're doing, I wouldn't advise using Telnet (which is outside the parameters of this tutorial).

## Reverse DNS Query ##

This is probably the most effective way of running a trace on somebody. If ever you're in a chatroom and you see someone saying that they've "hacked into a satellite orbiting the Earth, and are taking pictures of your house right now", ignore them because that's just bad movie nonsense. THIS method is the way to go, with regard to finding out what country (even maybe what State/City etc) someone resides, although it's actually almost impossible to find an EXACT geographical location without actually breaking into your ISP's Head Office and running off with the safe.

To run an rDNS query, simply go back to MS-DOS and type

netstat

and hit return. Any active connections will resolve to hostnames rather than a numerical format.

# DNS

DNS stands for Domain Name Server. These are machines connected to the Internet whose job it is to keep track of the IP Addresses and Domain Names of other machines. When called upon, they take the ASCII Domain Name and convert it to the relevant numeric IP Address. A DNS search translates a hostname into an IP address....which is why we can enter "www.Hotmail.com" and get the website to come up, instead of having to actually remember Hotmail's IP address and enter that instead. Well, Reverse DNS, of course, translates the IP Address into a Hostname (ie - in letters and words instead of numbers, because sometimes the Hacker will employ various methods to stop Netstat from picking up a correct Hostname).

So, for example,

298.12.87.32 is NOT a Hostname.
mail6.bol.net.au IS a Hostname.

Anyway, see the section at the end? (au) means the target lives in Australia. Most (if not all) hostnames end in a specific Country Code, thus narrowing down your search even further. If you know your target's Email Address (ie they foolishly sent you a hate mail, but were silly enough to use a valid email address) but nothing else, then you can use the Country codes to deduce where they're from as well. You can also deduce the IP address of the sender by looking at the emails header (a "hidden" line of code which contains information on the sender)...on Hotmail for example, go to Preferences, and select the "Full Header's Visible" option. Alternatively, you can run a "Finger" Trace on the email address, at:

www.samspade.org

Plus, some ISP's include their name in your Email Address with them too (ie Wanadoo, Supanet etc), and your Hacker may be using an email account that's been provided by a Website hosting company, meaning this would probably have the website host's name in the email address (ie Webspawners). So, you could use the information gleaned to maybe even hunt down their website (then you could run a website check as mentioned previously) or report abuse of that Website Provider's Email account (and thus, the Website that it goes with) to

abuse@companynamegoeshere.com

If your Hacker happens to reside in the USA, go to:

www.usps.gov/ncsc/lookups/abbr_state.txt

for a complete list of US State abbreviatons.

## List of Ports commonly used by Trojans ##

Please note that this isn't a complete list by any means, but it will give you an idea of what to look out for in Netstat. Be aware that some of the lower Ports may well be running valid services.

UDP: 1349 Back Ofrice DLL
31337 BackOfrice 1.20
31338 DeepBO
54321 BackOfrice 2000


TCP: 21 Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash
23 Tiny Telnet Server
25 Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2 0.17A-0.30
31 Hackers Paradise
80 Executor
456 Hackers Paradise
555 Ini-Killer, Phase Zero, Stealth Spy
666 Satanz Backdoor
1001 Silencer, WebEx
1011 Doly Trojan
1170 Psyber Stream Server, Voice
1234 Ultors Trojan
1243 SubSeven 1.0 - 1.8
1245 VooDoo Doll
1492 FTP99CMP
1600 Shivka-Burka
1807 SpySender
1981 Shockrave
1999 BackDoor 1.00-1.03
2001 Trojan Cow
2023 Ripper
2115 Bugs
2140 Deep Throat, The Invasor
2801 Phineas Phucker
3024 WinCrash
3129 Masters Paradise
3150 Deep Throat, The Invasor
3700 Portal of Doom
4092 WinCrash
4567 File Nail 1
4590 ICQTrojan
5000 Bubbel
5000 Sockets de Troie
5001 Sockets de Troie
5321 Firehotcker
5400 Blade Runner 0.80 Alpha
5401 Blade Runner 0.80 Alpha
5402 Blade Runner 0.80 Alpha
5400 Blade Runner
5401 Blade Runner
5402 Blade Runner
5569 Robo-Hack
5742 WinCrash
6670 DeepThroat
6771 DeepThroat
6969 GateCrasher, Priority
7000 Remote Grab
7300 NetMonitor
7301 NetMonitor
7306 NetMonitor
7307 NetMonitor
7308 NetMonitor
7789 ICKiller
8787 BackOfrice 2000
9872 Portal of Doom
9873 Portal of Doom
9874 Portal of Doom
9875 Portal of Doom
9989 iNi-Killer
10067 Portal of Doom
10167 Portal of Doom
10607 Coma 1.0.9
11000 Senna Spy
11223 Progenic trojan
12223 Hack´99 KeyLogger
12345 GabanBus, NetBus
12346 GabanBus, NetBus
12361 Whack-a-mole
12362 Whack-a-mole
16969 Priority
20001 Millennium
20034 NetBus 2.0, Beta-NetBus 2.01
21544 GirlFriend 1.0, Beta-1.35
22222 Prosiak
23456 Evil FTP, Ugly FTP
26274 Delta
30100 NetSphere 1.27a
30101 NetSphere 1.27a
30102 NetSphere 1.27a
31337 Back Orifice
31338 Back Orifice, DeepBO
31339 NetSpy DK
31666 BOWhack
33333 Prosiak
34324 BigGluck, TN
40412 The Spy
40421 Masters Paradise
40422 Masters Paradise
40423 Masters Paradise
40426 Masters Paradise
47262 Delta
50505 Sockets de Troie
50766 Fore
53001 Remote Windows Shutdown
54321 SchoolBus .69-1.11
61466 Telecommando
65000 Devil


## Summary ##

I hope this tutorial is useful in showing you both how to secure yourself against unwanted connections, and also how to determine an attacker's identity. The Internet is by no means as anonymous as some people think it is, and although this is to the detriment of people's security online, this also works both ways....it IS possible to find and stop even the most determined of attackers, you just have to be patient and keep hunting for clues which will help you put an end to their exploits.

How to connect to Internet on your Mobile using Broadband

How to connect to Internet on your Mobile using Broadband

Posted by tech master  |  at  11:39 AM

Sony Ericsson Users can now access all internet services free of cost using your Broadband connection.

My model Sony Ericsson w700i must use TCP/IP for its data connection. I thought why not make a TCP/IP connection to my local area LAN and surf the Internet through my broadband? The first thing i can do is to ask google. I have found some forums talking about this and a perfect procedure was found in the above URL.

I would like to credit the whole thing to the creator Andre
Source : http://users.skynet.be/yozy/tutorials/

Required Things:

1. Sony Ericsson Compatible Model

MIDP 1.0 and CLDC 1.04:
- P800 series
- T610 series
- T630 series
- Z600 series

MIDP 2.0 and CLDC 1.0 HI:
- P900/P910 series

MIDP 2.0 and CLDC 1.1:

- S700/S710 series
- V800
- F500i

- J300 series

- K300 series
- K310 series
- K500 series
- K510 series
- K600 series
- K610 series (Java Platform 7)
- K700 series
- K790 series (Java Platform 7)
- K750 series
- K800 series (Java Platform 7)

- P900
- P910
- P990

- M600

- W300 series
- W550 series
- W600 series
- W700 series
- W710 series (Java Platform 7)
- W800 series
- W810 series
- W850 series (Java Platform 7)
- W900 series
- W950 series

- Z520 series
- Z530 series
- Z550 series
- Z710 series (Java Platform 7)
- Z800 series
- Z525
- Z500a
- Z1010

2. Necessary Software

1. The J2SE Software Development Kit (SDK)
Mirror site : JAVA SDK

2. Sony Ericsson SDK

3. Opera Mini : Best way is to download the compatible version for your mobile from Opera Official site.

Step wise procedure:


1. First install JAVA JDK and then SONY ERICSSON SDK. Downloading these two things would be a little problem but cant help...

2. Connect your mobile to PC via bluetooth or USB.

2. When the Sonyericsson SDK installed successfully, you should find a Connection Proxy icon on your system tray, otherwise Click Start > Programs > Sony Ericsson > J2ME SDK > ConnectionProxy to start the connection proxy which while active will show its status on the system tray.

3. Click on Settings icon (Gear). Select correct COM port for your connection. Choosing correct COM port would not be a big task. Open your device manager and you will find the com ports for your mobile USB/Bluetooth connection. Choose the lowest COM port apart from the COM ports that are attached to your system. Choose the BaudRate as 115200.

4. Now click Connect. You should see your mobile pic on the connection proxy saying that it is connected. ( see the source URL for sample Pic)

5. Open Sony Ericsson Device Explorer.
Click Start > Program > Sony Ericsson > J2ME SDK > Device Explorer. You should see that the software is negotiating a connection with your mobile, and when successful, it will display a list of applications installed. In my case it displayed all the games installed in my W700 games folder.

Important Note : If anyone faces error at this particular step saying "Malformed Response...... .... " then it is due to some error in parsing the characters in the installed games. Delete games one by one in your games folder and Refresh the Device Explorer. It should work at some time..

6. In Sony Ericsson Device Explorer menu bar, click File and check Serial Networking and restart the Device Explorer. WIth this, the settings on the system is completed.

7. On your Sony Ericsson mobile, create a new data account.
For that, Go to Connectivity > Data comm. > Data accounts > New account.
Account type: GPRS data
Name: Anything you want. Leave APN, Username and Password empty.

8. Go to Connectivity > Internet setting > Internet profiles > New profile
Name: anything you want
Connect using: select the account you just added in the above step

9. Still in Internet profiles window, highlight the profile you going to use and press More and select Settings.
In this window:
Connect using: the new data account you just added
Internet Mode: Http (already there)
Use Proxy: No
Username and Password: empty

Press Save to save this profile

Quote:
Note: For broadband users under Corporate LAN, The settings are different. Use this profile settings.

here.. Note the following...
My IP address in LAN : 172.16.5.111
DNS Address : 172.24.2.71
Proxy server Address : 172.30.3.3


create a data account named "broadband"
ip address : 172.16.5.111
dns address : 172.24.2.71

create an internet profile named " broadband"
internet mode : http
use proxy : yes
proxy address: 172.30.3.3
port : 8080

streaming settings :
connect using : broadband
use proxy : yes
proxy address: 172.16.5.111
port number : 6082
10. Opera Mini Installation

Default browser that comes with sony ericsson mobile just not mean to be used with this type of connection. You need to download other browser to be installed. Download the compatible version of opera for your model from its official site. You must download both jar and jad files. This is a quick download since the file is quite small. Now you can install Opera Mini browser by just rightclicking the JAD File you just downloaded and select "Install on Device".
When installation is successful, highlight the Opera Mini in the Device Explorer and click on "Play button", or right click and select Start to launch the Opera Mini on your mobile.

Note : Launching Opera Mini by using the phone itself will not work.

11. Now, If you are using Opera 3.0, it tests for network connection before opening the browser. If the connection test fails, check your settings once again. Restart your phone and try again. If everything is correct, i would suggest you to download opera mini 2.0. and proceed with the same steps above. Search google or download it from here ( Copy it to your phone and install from the phone since i cannot upload a jad file in my hosting site.)

12. Enter any URL in your mobile and you are done if you are able to see that site on your mobile..

Note: Please do not expect that you will be succeeded in the first trial. There is every possiblity that you may miss small things. I have spent one complete day for the connection and then succeded.

Some Points to note :
1. Make sure "Serial Networking" is checked in device explorer.
2. Connection proxy is connected
3. Device explorer shows all the applications(games) installed on your mobile. If not, try restarting your device explorer.
4. If every setting is correct and still you are not able to connect to internet, restart your mobile
5. Use Opera mini 2.0 Advanced instead of latest version if you are not able to connect using it.


Finally... Please post your results in this thread so that people facing problems can troubleshoot...

Tags

What they says

Copyright © 2013 Techsense. WP Theme-junkie converted by BloggerTheme9
Blogger template. Proudly Powered by Blogger.| Distributed by Rocking Templates
back to top