...making Linux just a little more fun!

next -->

# Mailbag

### This month's answers created by:

[ Amit Saha, Ben Okopnik, Dave Richardson, Kapil Hari Paranjape, Lew Pitcher, Neil Youngman, Rick Moen, Samuel Kotel Bisbee-vonKaufmann, Steve Brown, Thomas Adam ]
...and you, our readers!

# Gazette Matters

### A couple of small suggestions

Neil Youngman [ny at youngman.org.uk]
Mon, 19 Feb 2007 17:01:52 +0000

First off, TWDT is no longer TWDT. If you click on TWDT you find that the mailbag has "Thread continues here" links. Could we make TWDT be TWDT?

Secondly, we have the answers to last month's geekword. It would be nice to have the questions with it, so anyone that wants to admire the subtlety of the clues, or pick nits, don't have to flick between windows.

Neil

[ Thread continues here (3 messages/2.39kB) ]

# Still Searching

### Schema for nmap XML Output

Amit Kumar Saha [amitsaha.in at gmail.com]
Tue, 20 Feb 2007 09:31:10 -0800

hi list Attached is the XML output for a Nmap scan

[[[ I have actually included it below. - Kat ]]]

The goal is to move Nmap XML files into a database, with a well-thought out DB schema. Ideally, this should work with PostgreSQL, MySQL, and other popular databases.

Please suggest a possible database schema for the same

Please point out any similar works

    <?xml version="1.0"?>
    <!-- Nmap 4.00 scan initiated Sat Feb 17 08:39:44 2007 as: nmap -oX scan.xml www.yahoo.com -->
    <nmaprun scanner="nmap" args="nmap -oX scan.xml www.yahoo.com" start="1171681784" startstr="Sat Feb 17 08:39:44 2007" version="4.00" xmloutputversion="1.01">
      <scaninfo type="syn" protocol="tcp" numservices="1672" services="1-1027,1029-1033,1040,1043,1050,1058-1059,1067-1068,1076,1080,1083-1084,1103,1109-1110,1112,1127,1139,1155,1158,1178,1212,1214,1220,1222,1234,1241,1248,1337,1346-1381,1383-1552,1600,1650-1652,1661-1672,1680,1720,1723,1755,1761-1764,1827,1900,1935,1984,1986-2028,2030,2032-2035,2038,2040-2049,2053,2064-2065,2067-2068,2105-2106,2108,2111-2112,2120-2121,2201,2232,2241,2301,2307,2401,2430-2433,2500-2501,2564,2600-2605,2627-2628,2638,2766,2784,2809,2903,2998,3000-3001,3005-3006,3049,3052,3064,3086,3128,3141,3264,3268-3269,3292,3306,3333,3372,3389,3421,3455-3457,3462,3531,3632,3689,3900,3984-3986,3999-4000,4008,4045,4125,4132-4133,4144,4224,4321,4333,4343,4444,4480,4500,4557,4559,4660,4672,4899,4987,4998,5000-5003,5010-5011,5050,5060,5100-5102,5145,5190-5193,5232,5236,5300-5305,5308,5400,5405,5432,5490,5510,5520,5530,5540,5550,5555,5560,5631-5632,5679-5680,5713-5717,5800-5803,5900-5903,5977-5979,5997-6009,6017,6050,6101,6103,6105-6106,6110-6112,6141-6148,6346,6400-6401,6502,6543-6544,6547-6548,6558,6588,6666-6668,6699,6969,7000-7010,7070,7100,7200-7201,7273,7326,7464,7597,7937-7938,8000,8007,8009,8021,8080-8082,8443,8888,8892,9090,9100,9111,9152,9535,9876,9991-9992,9999-10000,10005,10082-10083,11371,12000,12345-12346,13701-13702,13705-13706,13708-13718,13720-13722,13782-13783,15126,16959,17007,17300,18000,18181-18185,18187,19150,20005,22273,22289,22305,22321,22370,26208,27000-27010,27374,27665,31337,32770-32780,32786-32787,38037,38292,43188,44334,44442-44443,47557,49400,54320,61439-61441,65301" />
      <verbose level="0" />
      <debugging level="0" />
      <runstats>
        <finished time="1171681798" timestr="Sat Feb 17 08:39:58 2007" />
        <hosts up="0" down="1" total="1" />
        <!-- Nmap run completed at Sat Feb 17 08:39:58 2007; 1 IP address (0 hosts up) scanned in 15.003 seconds -->
      </runstats>
    </nmaprun>

    --
    Amit Kumar Saha
    GSM :+91 9903140286
    http://amitsaha.in.googlepages.com

# Our Mailbag

### please do this, for a free ipod nano

amitsaha.in at gmail.com.using.fakeaddress.invalid [(amitsaha.in at gmail.com.using.fakeaddress.invalid)]
Sat, 24 Feb 2007 23:40:10 -0800

[[[ I've cleaned up a bunch of html, as well as munging the address of the spammer. - Kat ]]]

hey, go here and we both get a free ipod nano

pretty pretty please

http://www.fakeaddress.invalid/xbgxedmeoa http://www.fakeaddress.invalid/xbgxedmeoa

This was sent by amitsaha.in at gmail.com via AStupidSpammerSite, Box xxxx, San Jose CA xxxx Visit this page http://www.fakeaddress.invalid/ to unsubscribe from all future fakeaddress.invalid email

[ Thread continues here (4 messages/3.29kB) ]

### how 2 delete large num of files

Ramachandran Iyer [riyer at kodiaknetworks.com]
Thu, 22 Feb 2007 12:26:39 +0530

Hi, I have some 40,000 entries/files in a directory I know there is some combinations or rm & xargs to delete this long list,, I am not getting the exact syntax. Can u pl pass it on,, Rama

[ Thread continues here (3 messages/1.49kB) ]

### Silly question but...

Ben Okopnik [ben at linuxgazette.net]
Sun, 18 Feb 2007 21:56:00 -0500

Hi, Don -

On Sat, Feb 17, 2007 at 09:24:58PM -0600, Don Crowder wrote:

    > I've become very fond of Debian (Sarge) Linux even though it can be a tough
    > row for a beginner to hoe.  I noticed that the Linux Gazette was in the
    > repository so I downloaded the whole set thinking that reading them all would
    > be a good learning experience only now I can't find them.  Synaptic says
    > they're on my computer but it doesn't tell me "where they live" nor, for that
    > matter, is it clear what application will be needed to read them (though I'd
    > expect them to be HTML files, readable by a browser but that's an assumption,
    > thus suspect.).  At any rate, I'd be grateful for a clue  Sure, I could have
    > found a Debian forum and asked there but they wouldn't have a vested interest
    > in the answer to my question, like you do grin.

[laugh] You're a smart fellow, Don - just what I'd do in a similar situation, including the expository.

    > I've often lamented the fact that I'm not able to become a Linux developer but
    > I promote Linux as best I can by writing about it in my email and in the
    > twice-monthly ezine my wife and I write.  We also "talk it up" at every
    > opportunity.  I

Well, there's all kinds of stuff you could do with 'apt-cache' to tell you where the files are, but in short, they're all under '/usr/share/doc/lg*'. In fact, '/usr/share/doc' should be the first place you look for anything on your system that doesn't have built-in help or a manpage.

For future reference, the editor@ address at LG is used for article submissions and publication-related issues. If you have more general questions like the one above, please send them to The Answer Gang (tag at lists.linuxgazette.net) - that way, the answers get shared with the rest of our readers and benefit the entire community. I've CCd TAG on this exchange.

Best,

    --
    * Ben Okopnik * Editor-in-Chief, Linux Gazette * http://LinuxGazette.NET *

### Purpose of some spam messages?

Kapil Hari Paranjape [kapil at imsc.res.in]
Thu, 1 Feb 2007 17:58:37 -0800

Hello,

I was just wondering if someone has thought about what is the purpose of SPAM messages which only contain some mish-mash text. The qualifying criteria are:

    	1. Only text without attachments.
    	2. Text that contains incoherent sentences or disconnected sentences. [*]
    	3. Definitely messages from addresses not known to the recipient.

(The last is to exclude e-mail messages written by friends who are not quite sober at the time of writing ).

Here are some possiblities that occured to me.

A. These are messages that are designed to test/mar the efficiency of the spam detection systems currently employed by servers.

B. These messages contain coded messages that are flooded across the internet in an attempt to disguise their true origin/destination. The real message could be short one such as "the machine from which this has been sent has serious security holes".

C. This is generated for someone's research project.

D. This is the result of some spam generating software/virus which has bugs.

I don't know if this is worth wondering about ... except ... why is someone going to some trouble to make (a program which is making) life difficult for everyone?

Pointers to prior discussion welcome.

Thanks and regards,

Kapil. [*] Clearly (2) is subjective which makes such spam hard to detect automatically. --

[ Thread continues here (7 messages/12.19kB) ]

### how did it(the webzine) all start?

MNZ [mnzaki at gmail.com]
Wed, 21 Feb 2007 23:49:52 +0400

Dear TAG, I am a regular reader and wanted to first thank you for the great zine. I'll probably be starting my own site/zine (long story short: 'tis all to keep in touch with my friends, who I have known for all my life but will have to leave them soon). The zine part won't be linux related(except maybe for one column every now and then).

I know I talk too much but, my question(s): When LG first started out, how did you get the readers? How was it publicized? How did you get your very first reader? Also any tips (Kat? Ben? team?) ?

One more thing: Write more POLOTMs or else I'll have to resort to violent methods!

    --
    //MNZ\\

[ Thread continues here (4 messages/11.14kB) ]

### Paypal spam

Benjamin A. Okopnik [ben at linuxgazette.net]
Thu, 15 Feb 2007 20:51:48 -0800

On Mon, Feb 12, 2007 at 08:39:20PM -0800, Mike Orr wrote:

    > Another twist on the Paypal phishing scam.
    >
    > http://sluggo.scrapping.cc/tmp/cartoon-paypal-fraud-part1.png
    > http://sluggo.scrapping.cc/tmp/cartoon-paypal-fraud-part2.png

Love that URL in part 2. Freakin' "0xc8.0x2b.0x50.0x74"? You'd think that anyone dumb enough to just click on URLs in these "bank" emails has already been stripped to the bone by sharks, but a) it doesn't kill them off, and 2) There's One Born Every Minute. I guess the spammers and the scammers will never run out of "soft targets".

Just for fun:

    ben at Fenrir:~$ perl -wle'print join ".", map hex, "0xc8.0x2b.0x50.0x74" =~ /0x(..)/g'
    200.43.80.116
    ben at Fenrir:~$ whois 200.43.80.116|egrep '^[a-z-]+:'
    inetnum:     200.43.80.112/28
    status:      reallocated
    owner:       Coop.Telef?ica de Villa del Totoral Ltda.
    ownerid:     AR-CVTL-LACNIC
    responsible: Carlos Sanchez
    address:     Pte.Per?, 551,
    address:     5236 - Villa del Totoral (Cordoba) -
    country:     AR
    phone:       +54 3524 647574 []
    owner-c:     CRS3
    tech-c:      CRS3
    created:     20040420
    changed:     20040420
    inetnum-up:  200.43/16
    nic-hdl:     CRS3
    person:      Carlos R. Sanchez
    e-mail:      csanchez24 at COOPTOTORAL.COM.AR
    address:     Pte Peron 551, 0054, 3524470900
    address:     5236 - Villa del Totoral -
    country:     AR
    phone:       +0054 3524 470900 [470000]
    created:     20040213
    changed:     20040213

Ah, a default install of RHEL that got cracked. I'm feeling a bit too lazy to ping the admin myself... it would be like sweeping back the tide.

    --
    * Ben Okopnik * Editor-in-Chief, Linux Gazette * http://LinuxGazette.NET *

[ Thread continues here (4 messages/7.84kB) ]

### Followup: please recommend books about Linux

JOHN INGRESS [ingress at sbcglobal.net]
Fri, 2 Feb 2007 21:57:22 -0800 (PST)

[[[ This is a followup to http://linuxgazette.net/134/misc/lg/please_recommend_books_about_linux.html - Kat ]]]

Thanks. I have to admit I have not yet taken your advice, though they sound like good suggestions. I did, however, find Marcel Gagne's book Moving to Linux at the library. He mentioned Mandrake. I went to their site, now Mandriva, and downloaded Mandriva One, a free release (I'm willing to pay, but my needs are light...no gaming, just music, video, word processing.) However, when I try to open it, Microsoft says it can't find the file to open it, and I get lost after that. I've had MS Windows for 5 years, which I installed, and I have downloaded a dozen or two programs, but I'm still a newbie, I need specific instructions in some cases. Like this one. Any help would be most appreciated. The "Blue screen of Death" is killing me! Thanks. John

[ Thread continues here (2 messages/4.28kB) ]

### wifi

guido dom [guido.dom at telenet.be]
Mon, 05 Feb 2007 12:29:15 +0100

Hello

My wireless - unsupported - card is inprocomm 2020 in an Acer Aspire Laptop.

I managed to get it working (with ndiswrapper - wifi radar and so in) in UBUNTU 5.04 en 5.10 but not in UBUNTU 6.04 and 6.10.

It simply is not recognised.

Cab you help, please?

[ Thread continues here (2 messages/1.22kB) ]

### Mandriva 2007 - WiFi cards cannot find network

Savill, Owen [Owen.Savill at analog.com]
Mon, 5 Feb 2007 13:03:31 -0000

Hello Answer Gang,

This is my first time posting to you so I hope I get it right.

I am having big issues with my WiFi connectivity. Basically everything seems to be okay but attempting to ping an address results in a network unreachable message. I've used drakconnect to setup the wireless setup. The router itself is reporting the card as attached ! And ifconfig shows a continuous stream of traffic to the card but nothing from it.

The contents of /var/messages looks fine, apart from perhaps the last line:

    Jan 5 08:49:10 localhost kernel: pccard: CardBus card inserted into slot 0
    Jan 5 08:49:10 localhost kernel: PCI: Enabling device 0000:03:00.0 (0000 -> 0002)
    Jan 5 08:49:10 localhost kernel: ACPI: PCI Interrupt 0000:03:00.0[A] -> Link [LNKA] -> GSI 11 (level, low) -> IRQ 11
    Jan 5 08:49:10 localhost kernel: Build date: Jan 4 2007
    Jan 5 08:49:10 localhost kernel: Debugging version (IEEE80211)
    Jan 5 08:49:10 localhost kernel: ath0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
    Jan 5 08:49:10 localhost kernel: ath0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
    Jan 5 08:49:10 localhost kernel: ath0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
    Jan 5 08:49:10 localhost kernel: ath0: turboG rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
    Jan 5 08:49:10 localhost kernel: ath0: H/W encryption support: WEP AES AES_CCM TKIP
    Jan 5 08:49:10 localhost kernel: ath0: mac 5.9 phy 4.3 radio 3.6
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 1 for WME_AC_BE traffic
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 0 for WME_AC_BK traffic
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 2 for WME_AC_VI traffic
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 3 for WME_AC_VO traffic
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 8 for CAB traffic
    Jan 5 08:49:10 localhost kernel: ath0: Use hw queue 9 for beacons
    Jan 5 08:49:10 localhost kernel: Debugging version (ATH)
    Jan 5 08:49:10 localhost kernel: ath0: Atheros 5212: mem=0xd2000000, irq=11
    Jan 5 08:49:12 localhost dhclient: DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 3
    Jan 5 08:49:15 localhost dhclient: DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 3
    Jan 5 08:49:18 localhost dhclient: DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 8
    Jan 5 08:49:26 localhost dhclient: DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 8
    Jan 5 08:49:28 localhost snmpd[3498]: netsnmp_assert index == tmp failed
    if-mib/data_access/interface.c:467 _access_interface_entry_save_name()

Kernel logs are at the end of this message...

[ ... ]

[ Thread continues here (15 messages/37.53kB) ]

Talkback: Discuss this article with The Answer Gang

Copyright © 2007, . Released under the Open Publication License unless otherwise noted in the body of the article. Linux Gazette is not produced, sponsored, or endorsed by its prior host, SSC, Inc.

Published in Issue 136 of Linux Gazette, March 2007

next -->