Agreed to stop the current trend of the conversation.

One thing I take from this discussion is that if Cisco made a client available for Windows, Mac, and Linux, this type of os detection spoofing would not be possible.  Then you get into the debate of "well, how are you going to distribute it on GNU/Linux?".  If you said source so that the user compiles it, well that's obviously bad because the source can be modified.  If you said "we'll distribute a binary", that's all well and good, but an obvious support nightmare.  If you said "a java or flash plugin", well, I might buy that.  Has it's pitfalls (no flash on x86_64 comes to mind), but it would prevent issues like os fingerprinting spoofing.  

Regards,

Alex Lanstein
Senior Software Engineer, Transitional Data Services
Help Desk/Network Junkie, Connecticut College
Chief Coffee Drinker, LBCCHosting
860-625-4277
[log in to unmask]



-----Original Message-----
From: Cisco Clean Access Users and Administrators on behalf of Ryan Dorman
Sent: Fri 10/20/2006 8:40 AM
To: [log in to unmask]
Subject: Re: Possible Agent bypass...
 
> 
> This is fun and all, but lets get back on track here.
> 

Agreed.
-- 
Ryan Dorman, CCNP
Network Engineering Specialist
Millersville University
717.871.5883