Bug #9785
FBI blocking fails if IP has two non-terminated MAC end hosts in NCIS.
0%
Description
It should never happen in practice, but under rare circumstances it is possible for NCIS to have two non-terminated end hosts for one IP address and two MAC addresses.
Case #1) An ARP record is bouncing between two MACs for one IP from a misconfigured system.
Case #2) Two different systems (with their own MAC addresses) are (trying) to use the same IP address.
The current blocking code only assumes that one and only one non-terminated end host can be found and tracebacks if multiple end host records are found.
History
#1 Updated by Michael Zalokar about 5 years ago
Comments about the problem put into the code:
bash-4.1$ cvs commit tissue_core/RELEASE_NOTES tissue_core/TissueCoreImpl/BlockImpl.py tissue_core/TissueCoreImpl/EventImpl.py tissue_core/TissueEvent/DetectedData.py RELEASE_NOTES
Checking in tissue_core/RELEASE_NOTES;
/cvs/cd/tissue/tissue_core/RELEASE_NOTES,v <-
new revision: 1.107; previous revision: 1.106
done
Checking in tissue_core/TissueCoreImpl/BlockImpl.py;
/cvs/cd/tissue/tissue_core/TissueCoreImpl/BlockImpl.py,v <-- BlockImpl.py
new revision: 1.41; previous revision: 1.40
done
Checking in tissue_core/TissueCoreImpl/EventImpl.py;
/cvs/cd/tissue/tissue_core/TissueCoreImpl/EventImpl.py,v <-- EventImpl.py
new revision: 1.38; previous revision: 1.37
done
Checking in tissue_core/TissueEvent/DetectedData.py;
/cvs/cd/tissue/tissue_core/TissueEvent/DetectedData.py,v <-- DetectedData.py
new revision: 1.24; previous revision: 1.23
done
bash-4.1$ cvs commit ncis_hw_factory/NcisHwFactory/HwFactory.py HwFactory.py
Checking in ncis_hw_factory/NcisHwFactory/HwFactory.py;
/cvs/cd/ncis/ncis_hw_factory/NcisHwFactory/HwFactory.py,v <-
new revision: 1.23; previous revision: 1.22
done