how to detect fake hop1?

[uttnls]

Re: how to detect fake hop1?

@gianni253, in the configuration presented by you the first ECM request will almost always be a NOK, it's just that simple .

[SatWaveDude]

Re: how to detect fake hop1?

So we have to watch ECM times and Ping times.
The ECM times we can see but the Ping times we have to reslove the ping by command or tool but if the remote have a advanced SPI Firewall router "Block Anonymous WAN Requests (ping)"
That way you can not ping to that router as it does not respont.

[gianni253]

Re: how to detect fake hop1?

At the end, ecm time is the only thing that counts.
If we can, we also check ping times, but it's only to find a justification for slow ecms (the server is supposed to be fast, but network is slow ...)

[aplok]

Re: how to detect fake hop1?

hi guys,

i see you're talking about ecm and ping response time.

i know ping,
can you tell me please what ecm is about ?

thx

[bakfitty]

Re: how to detect fake hop1?

hi guys,

i see you're talking about ecm and ping response time.

i know ping,
can you tell me please what ecm is about ?

thx

ECM time basically is showing you how long it is taking to clear the channel.

If my post was useful to you, please push 'Thanks' button.

[aplok]

Re: how to detect fake hop1?

i try to sketch this problem, so here is my schema v.0.0.0.1 :

ping:


ip1 ---<>--- ip2


ecm:


ip1 ---<>--- srv1 --<>-- srv2 --<>-- srv3
...................hop1.........hop2


so,

if srv1 is fake -> no way to reach srv2 and srv3
if srv2 is fake -> no way to srv3

and we need extended ping command such as a pingecm, for ecm packet, able to jump sup to srv3 ?
and the command should be


pingecm ipsrv3


but how to know the ip of srv3, hidden behind srv1 ?

[gianni253]

Re: how to detect fake hop1?

With "fake" we mean a server that is supposed to share a local card but it's only a reshared one.
So a fake server will not break the chain but will delay it a lot.
There is no way to back trace reshare hops because it's not tcp ip.
Only cs server's admin knows where is the card he is (re)sharing.

[aplok]

Re: how to detect fake hop1?

ok, a so called 'fake' is like a 'relay'


so, my schema looks better as


ip1 ---<>--- srv1
^............^
cl...........genuine
.
......hop0.......
......hop1....... ( ? )
.


if srv1 acts as a relay of srv2, himself of as a relay of srv3, the genuine server, i have


ip1 ---<>--- srv1 --<>-- srv2 --<>-- srv3
^....hop0....^.....hop1..^.....hop2..^
cl...........fake........fake.......genuine



if ip1, wants to act as a server, it comes as



ip2 ---<>--- ip1 ---<>--- srv1 --<>-- srv2 --<>-- srv3
^ ....hop0....^.....hop1..^.....hop2..^.....hop3..^
cl...........fake....... fake........fake........genuine



if all this is correct, each relay should know the distance ( nb of hps) far from the genuine-source server
i state this from my (basic) knowledge the cccam.cfg syntax, must define such a max distance up and down:

#C: <hostname> <port> <username> <password> <wantemus> ( { caid:id(:uphops), caid:id(:uphops), ... } )
#
.................................................. .......^- ? max distance in hops ??


if so, each node of the chain should know the distance far away from the source-genuine srvr !

and therefore, written somewhere and somehow into the cam-protocol data .

do you think this might be correct ?

[skytec]

Re: how to detect fake hop1?

hi guys,

i see you're talking about ecm and ping response time.

i know ping,
can you tell me please what ecm is about ?

thx

ECM is short for Entitlement Control Message. These are commands which are used to control the working of your card. ECM's are always sent as packets. Such a packet is called a Control Word(CW) and it contains coded keys, ID's etc. needed to decode the signal.

[aplok]

Re: how to detect fake hop1?

should this ecm packets sent via vpn from the rcvr to the srvr ?
or crypted via internet ?
or in clear ?

is there any RFC about this ecm ?

thx

[gianni253]

Re: how to detect fake hop1?

should this ecm packets sent via vpn from the rcvr to the srvr ?
or crypted via internet ?
or in clear ?

is there any RFC about this ecm ?

thx

yes, you can use vpn for your "private" cs network.
If using normal internet, encryption depends on protocol used, but tcp/ip headers are not encrypted (only data)

No RFC.

[aplok]

Re: how to detect fake hop1?

may be this should help

cat /tmp/ecm.info

system: Viaccess
caid: 0x500
provider: Unknown
provid: 0x1234
pid: 0x567
using: CCcam-s2s
address: aa.bb.org:12345
hops: 2
share: 1223344556677_12
ecm time: 1.765

all that tell us the current srvr aa.bb.org:12345 chosen by the cam have a hop 2 at ecm time 1.765