Spying?

Discussion in 'LnS English Forum' started by Kentish, Jun 29, 2003.

Thread Status:
Not open for further replies.
  1. Kentish

    Kentish Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    92
    Location:
    Kent, England, UK
    I have just installed a trial version of LnS.Howerver I am rather perplexed at the attempts this software is making to connect to the net itself. I have disabled the auto update feature, simply as I like to keep a tab on things going on, and especially as its an unknown progy to me.

    Can anyone shed any light on this issue for me?

    Cheers
     
  2. Frederic

    Frederic LnS Developer

    Joined:
    Jan 9, 2003
    Posts:
    4,354
    Location:
    France
    Look 'n' Stop connects itself to Internet for DNS resolution to display names instead of IP in the log.

    You can deactivate that feature in the options.

    If you use, the Tracert or Whois features (Track Source button onthe Log page), Look 'n' Stop will also connect to internet.

    Regards,

    Frederic
     
  3. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    Kentish, if you ever want to 'watch' an app, Port Explorer offers multiple ways, including packet-sniffing (on either the entire process, or just its individual sockets), netstat monitoring so you can always see what ports are open, what they're doing, how much theyve sent/received etc, and traffic logging so you can see in realtime what is being sent, and where. It's a tool that nicely compliments Look'n'Stop :)

    You won't find anything related to spyware or phone-home in Look'n'Stop though, it's probably just DNS-related traffic (necessary for IP resolution) - nothing to worry about. Port Explorer can confirm this.

    Cheers,
    Wayne
     
  4. Plavi

    Plavi Registered Member

    Joined:
    May 1, 2003
    Posts:
    27
    Wayne,

    I run both L&S and PE. Interestingly, PE will only register L&S connecting when one uses the whois functionality in L&S. As Frederic mentions above Look 'n' Stop connects itself to Internet for DNS resolution to display names instead of IP in the log but this is not picked up by PE. Any ideas?

    Cheers
    P
     
  5. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    DNS resolving is most likely seen with SYSTEM sockets, rather than the Look'n'Stop process itself - keep an out out for port 53 :)

    > PE will only register L&S connecting when
    > one uses the whois functionality in L&S
    This is because L&S doesn't transmit to the network unless you invoke it (which is how it should be) :)
     
  6. Plavi

    Plavi Registered Member

    Joined:
    May 1, 2003
    Posts:
    27
    Wayne,

    Yes, Generic Host Process for Win32 listening on port 53. Losts of activity there. Have applied socket spy to have a look at the activity. Have other technical questions now, but will direct these to the PE board. Many thanks

    Cheers

    P
     
Thread Status:
Not open for further replies.