Solution for TCP timestamp response in VAPT report

There was a vulnerability test run on our developmental server having Red Hat Enterprise Linux Server release 5.11 (Tikanga) as the OS. There is one among others of concern here; it is to do with TCP timestamp response. The solution suggested is:
Set the value of net.ipv4.tcp_timestamps to 0 by running the following command:
sysctl -w net.ipv4.tcp_timestamps=0
I did not find the parameter net.ipv4.tcp_timestamps when I did sysctl –a.
Please suggest how to go about it.
Please revert with the reply to my query.
Regards

Btw, I don't know the source, but I found the following info:
NOTE: Disabling timestamps will negatively impact performance of TCP transfers over high BDP
links if the underlying system uses that information to adjust the receive window or transmit buffer.
For typical LAN applications, timestamp removal should have no impact. For WAN data transfer speeds
using network infrastructure where packet reordering or loss is possible (load balanced lines, wireless,
routing hardware with multiple concurrent transaction paths, etc), TCP timestamps, along with the other
RFC 1323 options and a current congestion control algorhythm, should be used or performance will suffer.
TCP PAWS is also disabled if timestamps is disabled, which will negatively impact performance. Additionally,
the underlying OS should randomize the source timer at the beginning of the TCP session, rendering
the security concern moot. You will need to check your specific OS and patch level to verify that this is
functioning properly.
Don't disable timestamps unless you understand the performance impact to the applications involved. If you run into performance issues, people will most likely never find out the reason, which I think does a lot more damage than the security this setting could ever fix.
The underlying OS should randomize the source timer at the beginning of the TCP session...
Maybe an idea for the Oracle UEK kernel team.

Similar Messages

Solution for ICMP timestamp response in VAPT report

There was a vulnerability test run on our developmental server having Red Hat Enterprise Linux Server release 5.11 (Tikanga) as the OS. There is one point among others of concern here; it is to do with ICMP timestamp response. The solution suggested is:
ipchains -A input -p icmp --icmp-type timestamp-request -j DROP
ipchains -A output -p icmp --icmp-type timestamp-reply -j DROP
When I gave the command,
ipchains -A input -p icmp --icmp-type timestamp-request -j DROP
it gave the message as below
-bash: ipchains: command not found
Please suggest how to go about it.
Please revert with the reply to my query.
Regards

Thanks for your answer. The earlier question was dealing with TCP timestamp response but this is with dropping the ICMP responses. I tried this command by replacing ipchains with iptables,
iptables -A input -p icmp --icmp-type timestamp-request -j DROP
iptables -A output -p icmp --icmp-type timestamp-reply -j DROP
But the output of both the above commands is,
iptables: No chain/target/match by that name
Regards

Does any one implemented solution for httpservlet request/response object in IWSDLInterceptor implemented class?

I am trying to handle Producer not available situation in which I am using Interceptor IWSDLInterceptor in WLP 10.3.4. I am able to retrieve exception using onWSDLException but from here if I have to forward my pageURL object I need httpservlet request and response. I tried my own filter class to have its own customize request and also tried it out all other Interceptor to see if any one can handle IOException. I did manage to throw my own Customize exception but that also did not work out as Page does not have any backing file or any supportive Controller class.
Does any one implemented solution for httpservlet request/response object in IWSDLInterceptor implemented class? or do we have any specific documentation in regards to this? As I am not able to find much martial on IWSDLInterceptor except Java API from Oracle and article defining Two way SSL handshake Producer.
Any kind of help is appreciated.
Thanks
PT

Thanks Emmanuel for your response but render behavior is not available for IWSDLRequestContext/IWDSLResponseContext object which IWSDLInterceptor uses for implementation.
Let me put my question in little simpler manner. May be my approach to the problem is not proper.
Problem : Handle Producer Not available (no application exists on server) on consumer side.
So far tried approach : Producer is not running then I am able to handle that TransportException at IInitCookieInterceptor/IHandleEventInterceptor onFault behaviour but in the case of Producer not even exists Consumer try to get WSDL fetch operation and failed with FileNotFoundException.
To handle this exception, I used IWSDLInterceptor which is available under IWSDLInterceptor.OnWSDLException (Oracle Fusion Middleware Java API for Oracle WebLogic Portal)
I am able to catch the exception but problem arise when application needs to forward at specific page/render portlet for this situation. For that it required request/response object but IWSDLInterceptor does not give any kind of instances to redirect request as there is no direct access to HTTPServlet request/response object.
I tried my custom request object to use there. I tried out custom filter object of IWSDLrequestContext. nothing works.
One approach works is to put producer WSDL file at consumer level. But in that, you need to handle different producer files for different environment. Which I don't think its a good approach.
eAny one Let me know if my approach to the problem/scenario is wrong. Or if I am missing out any other supporting interface which also required to handle this scenario. or I am using wrong interface for this scenario.
Thanks for your help in advance.
PT.

Need solution for dynamic pick lists in Crystal Reports

Does anyone have a good solution for creating a dynamic pick list for a Crystal Report that is based off of a BW Query without having to use a BW user input variable? In many cases it is not practical to use a BW variable to generate a dynamic pick list due to the high number of possible member values and the highly dynamic nature of the particular characteristic (customers, materials, etc.). In my understanding the LOV Server is not an option when dealing with SAP BW. Anyone else running into this issue with Crystal and SAP BW?

Hi Mike,
we once solved this by creating LOVs in BusinessView Manager. I am not sure if you can use the BW Publisher in this scenario as we did not use it. We published the reports directly to the BOE server for some reasons.
Creating a LOV in BusinessView manager is really easy. You can create cascading prompts, shedule refreshing of the lists, ...
By using the cascading prompt feature you can make prompts like this:
First enter the customer number (or pick it from a list) and then the second list, which holds the materials only has shows the ones which had been purchased by that customer. I think this is what you are looking for.
You should give it a try!
Thorsten

Automated Solution for Exporting SQL used in Crystal Reports

My company has created over 400 reports that are running on Crystal Reports XI. Due to proposed changes in our database, we occasionally need to review the SQL statements of all 400+ reports to determine if any of them would be impacted by the proposed changes. In order to review the SQL used in these 400+ reports, we have had to open each report manually. We would like to know how we can review the SQL used in the reports without having to manually look at each report. I suspect there is a way to either write a program or use a tool that will export the SQL that is used in all reports. In a similar vain, we would be interested in knowing if there is an automated way to identify table names and fields that are used in each SQL statement.

I see two directions to go:
1. Review functionalities of .rpt Inspector
[http://www.softwareforces.com/Product/ri/pro/3/rptInspector.htm]
- it allows rpt mass analyses
2. Post your question to ".Net Development - Crystal Reports" forum to see if it is possible to access required information through custom application

TCP timestamps security vulnerabilities

On my ASA 5520 with version 9.1(2)8 I am getting a warning about tcp timestamps when running the external security scan.
" It was detected that the host implements RFC1323"
Solution = Disable TCP timestamps
Please correct me if I am wrong, from what I can tell the security issues in RFC1323 have been fixed by RFC1948 and that has been obsoleted by RFC6528. But RFC1323 has been obsoleted by RFC7323, though RFC7323 was just released this September.
What should I do to eliminate my risk? Can I configure something on the ASA to use RFC1948 or 6528? Do I just have to disable tcp timestamps all together?
I found this page on clearing tcp timestamps but that disables PAWS
thanks for any advice

I have done some more reading and found a couple of things about TCP Normalization and Randomization that can be configured on the ASA. Does anyone have any experience with that? Maybe it will help?

Need solution for solving TIME_WAIT in TCP/IP ports in Windows Server 2008 Standard Service Pack 2

In one of our windows machine( OS : Windows Server 2008 Standard (Service Pack 2)-32bit), we are facing TIME_WAIT in all the TCP/IP ports and it is not getting closed.
On analyzing the issue, we found solution for this from the below link,
https://support.microsoft.com/en-us/kb/2553549
In this page, we are able to get the hotfix for Windows Server2008 R2 SP1 but i can't able to get for Windows Server 2008 Standard SP2(32bit). If we try to apply the hotfix vailable for SP1, it is showing "The update does not apply to your System".
Kindly provide us the solution for solving TIME_WAIT issue in the machine.
OS Details : Microsoft Windows Server 2008 Standard
Version : 6.0.6002 SP2 Build 6002
System Type : 32 bit(x86-based PC)
Awaiting for the response.
Thank you,
Pushpalatha.A

Download correct version from Microsoft Update Catalog. Run it with elevated rights.
M.

BW solution for ABAP Reports

Hi All,
I have a client which implemented SAP R/3 and they have certain standard reports like MB5B, VA05 and certain zreports. Now my task is to propose a BW solution for that client. What will be the steps that needs to be done to accomplish this task. help in this regards will be appreciated and awarded.
Thanks all.

Hi Pratibha,
If there are too many reports that need to be reproduced in BW then you can club similar reports or belonging to a particular module. And then built datasources for them.
If there very few reports,
1. Find out the program behind the ABAP reports
2. Build a zprogram for the output and put into an FM.
3. Create a direct update DSO in BW on the FM
Let me know if it helps or not.
-Bikas

Query for getting records max reported timestamp and 2nd max report

query for getting records in between
max reported timestamp and 2nd max reported timestamp
HERE IS ALL RESULT SET
TIME DOMAIN
30:jun:2006:20:08:45 TOMCAT
30:jun:2006:20:08:45 TOMCAT
30:jun:2006:20:07:04 TOMCAT
30:jun:2006:20:07:04 TOMCAT
30:jun:2006:20:07:24 TOMCAT
30:jun:2006:20:07:24 TOMCAT
30:jun:2006:20:07:45 TOMCAT
30:jun:2006:20:07:45 TOMCAT
30:jun:2006:20:08:05 TOMCAT
30:jun:2006:20:07:04 TOMCAT
30:jun:2006:20:08:05 TOMCAT
PD_REPORTED_TIMESTAM PD_USER
30:jun:2006:20:08:25 TOMCAT
30:jun:2006:20:08:25 TOMCAT
30:jun:2006:20:08:45 TOMCAT
30:jun:2006:20:08:45 TOMCAT
30:jun:2006:20:07:24 TOMCAT
30:jun:2006:20:07:04 TOMCAT
30:jun:2006:20:07:24 TOMCAT
30:jun:2006:20:07:45 TOMCAT
30:jun:2006:20:07:45 TOMCAT
30:jun:2006:20:08:05 TOMCAT
30:jun:2006:20:08:05 TOMCAT
PD_REPORTED_TIMESTAM PD_USER
30:jun:2006:20:08:25 TOMCAT
30:jun:2006:20:08:25 TOMCAT
QUERY RESULT TO COME
TIME DOMAIN
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45
Message was edited by:
user517983

Hi,
can we write query like this.
1 select pd_user,PD_REPORTED_TIMESTAMP
2 from sp_process_detail_current spdc
3 where host_id='DSCP02469'and pd_user='TOMCAT'
4 and exists(
5 select PD_REPORTED_TIMESTAMP from sp_process_detail_current
6* having max(PD_REPORTED_TIMESTAMP)-spdc.PD_REPORTED_TIMESTAMP=0)
SQL> /
PD_USER PD_REPORTED_TIMESTAM
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45
TOMCAT 30:jun:2006:20:08:45

Need solution for a Reporting Requirement

Hello Experts,
I need design a solution for Report, where in I need to show ageing of Invoice based of Due date of Invoice for last four weeks as explained below:
In cube i have records like this:
Industry       Invoice Number      Due Date      Amount
8111                   IV1                  13/04/2011 1000
8111                   IV2                  17/04/2011 1000
Say current week end date is 03/05/2011, now I need to show data for last 4 weeks in report, by calculting what is due at that weekend date e.g. there is no amount due on 12/04/2011, but next week on 19th amount due in 1000, then subsequent week there are 2 Inv. due, amount for 26th is 2000. Similarly there is additional invoice after 26th, so amount on 3rd remains the same i.e. 2000.
Industry    Week End date AR Amount due
8111     12/04/2010     0
8111     19/04/2010     1000
8111     26/04/2010     2000
8111     03/05/2010     2000
Please let me know what is the best solution to achive this, as data volume would be high i.e.
1. In Bex query, is this can be done, if yes how?
2. Or we need to do this in EDW, by having additonal cube, if yes how?
Please let me know if you have solution for this.
Regards,
Vipul

Hi All,
Thanks for the replies.
Please tell me if I can call a file sender communication channel from an UDF and pass the dinamic configuration values at runtime.
If this is possible, I think the above requirement is addressed.
Please tell me in case of any more solutions too.
Thanks once again.
Regards.

Webcast-OBIEE Analytics/Reporting Solutions for E-Business Ste, Sep 9 12EDT

TODAY: I invite you all to an Oracle BI Applications related Techcast, let's use this for interactive Q&A as well. We can follow up on the question here.
See more details at http://OracleBIWA.org
Wednesday, September 9, 12 noon Eastern
OBIEE Analytics/Reporting Solutions for E-Business Suite
Audio Dial-In: 888 967 2253 Audio Meeting ID: 572994 Audio Meeting Passcode: 334451
Web Conference: https://conference.oracle.com/imtapp/app/cmn_jm_hub.uix?mID=150764532
BIWA Wednesday TechCast Series - Sixth Event!
This presentation will showcase different options for OBIEE-based Analytical Reporting such as:
1) Oracle BI Applications for supported Oracle E-Business Suite Modules and other Oracle Applications.
It will include real world experiences for implementing BI Apps Version 7.9.6
2) Custom OBIEE Development against E-Business Suite (when no BI apps are available)
3) Migration of Discoverer EUL to OBIEE RPD using Migration Utility
While OBIEE and BI Apps are clearly the strategic analytics reporting direction from Oracle, only certain Analytics applications are available. Sometimes all customer needs for BI reporting may not be met by these pre-built analytics. For instance, JD Edwards has pre-built ETL connectors only for Financial Analytics. While more BI Apps and ETL connectors are in the pipeline, how can users meet their reporting needs today as they go live in near future? In this session, we will look at several short and medium term solutions without deviating from the long term strategic goal of using pre-built BI applications to reduce the overall risk.
Several real life situations will be evaluated with demonstration of the steps involved such as how to Migrate Discoverer reports to OBIEE with the highest degree of automation. Likewise, we will cover how DBI views be used for custom OBIEE reporting.
Presenter: Shyam Varan Nath is an OBIEE Architect for IBM Global Business Services with extensive experience in implementing OBIEE and BI Apps. He has worked on several Oracle Data Warehousing Projects for customers including Citigroup, Air Force, Land O'Lakes, and Blue Cross Blue Shield Association. Shyam has been a Certified Oracle DBA since 1998 and has 18 years of industry experience. He is a regular speaker at BIWA Summit, IOUG/Collaborate, Regional User Groups and Oracle Openworld since 2003. Shyam has also worked at Oracle (BI Consulting Practice) and Deloitte Consulting. Currently, he is the top expert in Oracle OBI apps Forum, in terms of user awarded points. Shyam is also the Founder and President of BIWA SIG.
Audio Dial-In: 888 967 2253 Audio Meeting ID: 572994 Audio Meeting Passcode: 334451
Web Conference: https://conference.oracle.com/imtapp/app/cmn_jm_hub.uix?mID=150764532
Compatibility Check: If you have not used Oracle's web conference system before, please ensure your system compatibility by going to https://conference.oracle.com/imtapp/app/nuf_sys.uix.
Edited by: shyamvaran on Sep 9, 2009 5:21 AM

If you would like to share your OBIEE and OBIA knowledge and experiences, please submit your proposals below:
http://submissions.miracd.com/ioug2010/login.asp
Collaborate 2010 (april 18-22) will have a special focus on BI => "Get Analytical with BIWA Training Days"

Reporting & Audit Compliance Solutions for Cisco Secure ACS

The Cisco Secure ACS Access Control Server is probably the worlds best selling remote access security solutions and its quite likely that you're already using it! Wouldn't it be great to know exactly what it was doing? Further still, when you have to provide audit documentation regarding your policies and how effective they are, how long does this take and what valuable data remains locked inside the ACS database and logs?
extraxi offer a range of products that deliver a complete solution for harvesting, managing and analyzing your ACS/SBR log data to meet the increasing demands for regulatory compliance (SOX, COBIT) and overall enterprise monitoring and security.
We are proud to supply customers including Intel, Ford, Lego, T-Mobile, US Dept of State, US Army, British Telecom, First Energy, TNT Express, Kodak and JP Morgan and many more so why not take a look at our industry leading solutions and evaluate the benefits for your organization...
Featured Products:
* aaa-reports! enterprise edition - Automated Reporting
The best reporting system for Cisco Secure ACS and Funk SBR just got a whole lot better! Improved reports, enhanced filtering and query builder and now with up to 48GB internal storage based on SQL Server technology makes this the ideal solution for large or complex AAA deployments and those that need the additional functionality from the standard aaa-reports! tool.
With aaa-reports! enterprise you have a complete application for reporting including many canned reports (each with flexible filtering options) and a point-n-click query builder for designing custom reports.
For historic trending, forensics and audit compliance there simply is no better reporting application for Cisco Secure ACS or Funk/Juniper SBR.
* csvsync - Automated ACS Database & Log File Collection
csvsync allows you to download CSV log data (RADIUS, TACACS+, Passed/Failed Attempts etc) directly from any number of Cisco Secure ACS servers (Windows & Appliance) via http(s). Version 3.0 now supports the collection of ACS database itself for import into aaa-reports and detailed reporting based on the ACS security policies. Simple, secure and efficient, csvsync is the best solution for harvesting log data from your Cisco Secure ACS servers.
Download fully working 60 day trial versions at http://www.extraxi.com/rq.asp?utm_source=technet&utm_medium=forum
Fore more information please visit http://www.extraxi.com/?utm_source=technet&utm_medium=forum

bump

Does BEA have a solution for report

Hi, everyone,
I am new for BEA's solution.
Recently, I am surveying some JAVA reports in order substitute the crystal report
in VB.
It seems that BEA has good reputation in AP server.
Could you tell me if BEA provide the solution for generating reports?
Thaknx in advance

NukeShim,
Could confirm that you're seeing the scanner, that is the LiDE-80 specifcally, under Image Capture in Mavericks, and that you can scan? Not showing up for me on a 2012 MBP running the latest 10.8.5 .
I'd actually really be surprised if it would, since the LiDe-80 specifically was internally different from the rest of the LiDE series. Canon didn't write the original drivers for them, some 3d-party did. The drivers were weak MacOS 9 updates (filename limited to 32 chars, no unicode support). They were never updated for the Intel Macs, unlike most of the LiDE line. I know this because I corresponded with Canon on this in 2008. The last driver is a PowerPC one from 2005, which officially supports up to 10.4 only, although IIRC it did work for me on 10.5 for a while after doing some manual installing.

Reporting solution for a very long report

Hi All,
We have requirement to print a very long report ( about 150.000 pages folio size, something like account statement ). Database server is in remote location, connected to report's client via 64 kbps VPN.
What is the best solution for such requirement ?
Some thoughts are :
- using Crystal Report / Oracle Report , display the report on browser and print it
- Query the data from client side, save the data locally and create report from it
or is there any best solution for this ?
Thank you for any help,
xtanto

Create an output file on the location where the database is located, zip it, and transfer it to the client. 150000 pages is an awful lot, but usually mostly spaces.

Need solution for Report

HI
In report i want to find frame(heading the columns ) is displaying in how many pages please give me a solution
Regards
Yashavanth

yeshavanth, pls ask this in reports forum

Solution for TCP timestamp response in VAPT report

Similar Messages

Maybe you are looking for