Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've asked this question on Ask Ubuntu regarding my system showing up by default in networks. The answer I've accepted says that as long as I'm not using avahi and samba components, I won't show up wherever the computers on the network are displayed. The only possible exception being zeroconf in the absence of DHCP server.

My question is, why does zeroconf make my computer vulnerable to discovery through networks? Is it applicable to wireless networks?

I've made a rough guess about zeroconf, using the answer on Ask Ubuntu as basis, that the address block used for self-configuration is the same across all systems - so in the absence of DHCP server, searching for systems on the network using the zeroconf address block as reference would make it easier to find computers on the network.

Finally, I'd like to iterate that I'm already aware that no matter what I do I'm still open to sniffing, so don't bother trolling with it.

share|improve this question
add comment

2 Answers

mDNS and DNS-SD announce the presence of services across the entire network the machine is connected to. If you do not trust the current network then you may wish to block its outbound packets.

share|improve this answer
    
Would you try explaining in layman's terms? I'm not really familar with mDNS, DNS-SD and such. What do they do, how do they relate to zeroconf? And how do I block outbound packets, how will it affect my connection? –  Oxwivi Feb 24 '11 at 20:49
1  
mDNS and DNS-SD are two thirds of Zeroconf (the third being IPv4LL, the service that gives out those 169.254/16 addresses). mDNS sends broadcast packets out on 224.0.0.251:5353 and [ff02::fb]:5353, so dropping those in ip{,6}tables's OUTPUT chain will block them, and not affect your connection. –  Ignacio Vazquez-Abrams Feb 24 '11 at 20:54
add comment

Zeroconf announces to the network "hey, I'm here, and I have these services available for you!" By default, this is announced to the local network as a broadcast, so that every computer on the local network can see it.

This can be incredibly helpful, letting you set up a home network without any administration of central servers, as resources just appear when they're connected; for example, printers suddenly pop into your list of possible destinations for a print job.

If you're on a network you don't trust, you might not want your computer to dance up and down on the network saying "look at me, look at all the things I have running!" since it's declaring the attack surface — things which might have security problems.

If your system is otherwise perfectly security, there's no problem announcing what you have. But a perfectly secure system is a fantasy. So there's a trade-off to be had, between convenience and secrecy, to try to make it a little harder.

In practice, an attacker can find out what you're running anyway. But their probing your system might set off an Intrusion Detection System on the network. (If your coffee-shop has an IDS, then look for the flying pigs outside, and switch to a different sort of coffee-shop.)

So as someone malicious, it's much easier and safer to wait for someone's computer to declare "hey, I'm here, and I have a music share for you, and shared file storage, and a login service, and ...".

share|improve this answer
    
In what kind of networks does zeroconf come into play? Is it only when I'm trying to directly connect to devices without a router/access point middleman? –  Oxwivi Feb 25 '11 at 5:48
    
By default, yes. Zeroconf can also register with a central server; then it's just DNS UPDATE operations, but at that point you now have configuration, rather than "zero configuration". By default, it's one local network. Each device on the network announces what services it offers. On Ubuntu and other systems using avahi, run avahi-browse -avt to see what's visible locally. –  Phil P Feb 25 '11 at 19:50
    
I see workstations (advertising existence), SSH daemons (can connect), iTunes music setups, iChat chat for serverless chatting; this one's great, since your messages don't leave the local network so can only be snooped upon by those on the network, and file transfers go directly between the two computers at high speed. My wife and I use Adium for this. –  Phil P Feb 25 '11 at 19:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.