1

I've asked this question on Ask Ubuntu regarding my system showing up by default in networks. The answer I've accepted says that as long as I'm not using avahi and samba components, I won't show up wherever the computers on the network are displayed. The only possible exception being zeroconf in the absence of DHCP server.

My question is, why does zeroconf make my computer vulnerable to discovery through networks? Is it applicable to wireless networks?

I've made a rough guess about zeroconf, using the answer on Ask Ubuntu as basis, that the address block used for self-configuration is the same across all systems - so in the absence of DHCP server, searching for systems on the network using the zeroconf address block as reference would make it easier to find computers on the network.

Finally, I'd like to iterate that I'm already aware that no matter what I do I'm still open to sniffing, so don't bother trolling with it.

2 Answers 2

1

Zeroconf announces to the network "hey, I'm here, and I have these services available for you!" By default, this is announced to the local network as a broadcast, so that every computer on the local network can see it.

This can be incredibly helpful, letting you set up a home network without any administration of central servers, as resources just appear when they're connected; for example, printers suddenly pop into your list of possible destinations for a print job.

If you're on a network you don't trust, you might not want your computer to dance up and down on the network saying "look at me, look at all the things I have running!" since it's declaring the attack surface — things which might have security problems.

If your system is otherwise perfectly security, there's no problem announcing what you have. But a perfectly secure system is a fantasy. So there's a trade-off to be had, between convenience and secrecy, to try to make it a little harder.

In practice, an attacker can find out what you're running anyway. But their probing your system might set off an Intrusion Detection System on the network. (If your coffee-shop has an IDS, then look for the flying pigs outside, and switch to a different sort of coffee-shop.)

So as someone malicious, it's much easier and safer to wait for someone's computer to declare "hey, I'm here, and I have a music share for you, and shared file storage, and a login service, and ...".

3
  • In what kind of networks does zeroconf come into play? Is it only when I'm trying to directly connect to devices without a router/access point middleman?
    – Oxwivi
    Feb 25, 2011 at 5:48
  • By default, yes. Zeroconf can also register with a central server; then it's just DNS UPDATE operations, but at that point you now have configuration, rather than "zero configuration". By default, it's one local network. Each device on the network announces what services it offers. On Ubuntu and other systems using avahi, run avahi-browse -avt to see what's visible locally.
    – Phil P
    Feb 25, 2011 at 19:50
  • I see workstations (advertising existence), SSH daemons (can connect), iTunes music setups, iChat chat for serverless chatting; this one's great, since your messages don't leave the local network so can only be snooped upon by those on the network, and file transfers go directly between the two computers at high speed. My wife and I use Adium for this.
    – Phil P
    Feb 25, 2011 at 19:52
0

mDNS and DNS-SD announce the presence of services across the entire network the machine is connected to. If you do not trust the current network then you may wish to block its outbound packets.

2
  • Would you try explaining in layman's terms? I'm not really familar with mDNS, DNS-SD and such. What do they do, how do they relate to zeroconf? And how do I block outbound packets, how will it affect my connection?
    – Oxwivi
    Feb 24, 2011 at 20:49
  • 2
    mDNS and DNS-SD are two thirds of Zeroconf (the third being IPv4LL, the service that gives out those 169.254/16 addresses). mDNS sends broadcast packets out on 224.0.0.251:5353 and [ff02::fb]:5353, so dropping those in ip{,6}tables's OUTPUT chain will block them, and not affect your connection. Feb 24, 2011 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .