Latest MS Patch Disables Raw Sockets

[iago]

But they still shouldn't make it impossible to look after yourself!

[deadly7]

Question.

What in the HELL is a raw socket?

[Newby]

Well, it's obviously not a well-done socket.

[deadly7]

Oh shut UP, Newby. So childish.

What's the non-food-defintion of a raw socket?

[iago]

A socket that doesn't force you to conform to some protocol (tcp, udp), lets you build your own packets.  It can be used to detect firewalls (sending invalid checksum), send to invalid ports, send with odd TCP flags, etc.

[Joe]

So basically a TCP socket (lets forget UDP for now) that lets you send your own header?

[iago]

Not necessarely TCP or UDP or anything.  You can send whatever you want.

[iago]

One attendee criticized the move away from raw sockets as sacrificing legitimate security firms' needs in order to secure less knowledgeable users.

"We are a security company, a lot of people here sell security software -- if it's going to work under Microsoft a lot of that stuff needs raw sockets," said the attendee. "What happened with us is that it broke our customers' applications."

Microsoft currently tells companies that need raw sockets support to move their applications to Windows 2003, but will not promise that raw sockets will be available in that version of the operating system much longer. "People are either going to use Windows 2000 or, as we are considering doing, move over to Linux," he said.

Microsoft's Snyder said the company was in the midst of an internal debate over whether and how to continue support for raw sockets.

"There is a lot--a lot--a debate going on regarding raw sockets," she said. "I can't say what the resolution is going to be in the future, however."

http://www.securityfocus.com/news/11115