Zines/phrack/42/6.txt

                      ==Phrack Magazine==

          Volume Four, Issue Forty-Two, File 6 of 14
          
 
                   A User's Guide to XRAY

                         By  N.O.D.


This file was made possible by a grant from a local
McDonnell Douglas Field Service Office quite some 'tyme'
ago.  This was originally written about version 4, although
we are pretty sure that BT has now souped things up to version 6.
Everything still seems the same with the exception of a few
commands, one of which we will point out in particular.

Any comments/corrections/additions/updates or subpoenas
can be relayed to us through this magazine.

XRAY is a monitoring utility that gives the user a real-time
window into a Tymnet-II node.  Used in tandem with other
utilities, XRAY can be a very powerful tool in monitoring network
activity.

In this file we will discuss key features of XRAY and give command
formats for several commands.  Some commands are omitted from this
file since they can only be used from dedicated terminals.  Several
others are likewise omitted since they deal with the utilization of
XRAY in network configuration and debugging the actual node code, and
would probably be more damaging than useful, and commands to reset
circuits and ports are similarly missing.


ACCESS

The most obvious way to access XRAY is to find the username/password
pair that either corresponds to the host number of an XRAY port, or
is otherwise in the goodguy list of a particular node.

XRAY can also be accessed through the DDT utility by typing

    ?STAT

Either will respond with the following

**X-RAY**  NODE:  XXX   HOST:  ZZZ  TIME:  DD:HH:MM:SS

If all ports are currently in use the user will only be allowed access
if his/her is of greater precedence in the goodguy list than that of
someone previously online.  In such a case, that user will be forcibly
logged out and will receive the following message:

    "xray slot overridden"

Otherwise the user will see:

    "out of xray slots"

XRAY users are limited in their power by the associated "licence" level
given them in the XRAY goodguy list.  The levels are:

    0 - normal
    1 - privileged
    2 - super-privileged


There are several user names associated with the
XRAY utility.  These exist on almost any network utilizing
the Tymnet-II style networking platform.

  PRIORITY    USERNAME

     2        XMNGR
     2        ISISTECX
     2        XNSSC
     1        TNSCMX
     1        TNSUKMX
     1        XSOFT
     1        XEXP
     1        XCOMM
     1        XSERV1
     0        XRTECH
     0        XTECH
     0        XOPPS
     0        XSERV
     0        XRAY



COMMANDS  with parameters in <brackets>

HE  Help

    Use this command to display the commands available for that
    particular node.

GP  Get power <security string>

    This command allows the user to move up to the maximum security
    level allowed by his username, as specified in the good guy
    list.

XG  Display and/or modify XRAY goodguy list <entry number> <P/M>

    This command without parameters will display the XRAY goodguy
    list.  When added with an entry number and 'P' (purge) or
    'M' (modify), the user can edit the contents of the table.
    The XGI command will allow the user to enter a new entry
    into the list.  Any use of XG or XGI to alter the list is
    a super-privileged command and is audited.

    >XG

    XRAY GOODGUY LIST

    NO.   PRIV  OVER  NAME
    ----  ----  ----  ----
    0001  0002  00FF  TIIDEV
    0002  0001  0030  RANDOMUSER
    0003  0000  0000  XRAY

    >XGI

    ENTER UP TO 12 CHARACTERS OF USERNAME

    NOD

    ENTER NEW PRIVILEGE AND OVERRIDE - 2,FF

    >XG

    XRAY GOODGUY LIST

    NO.   PRIV  OVER  NAME
    ----  ----  ----  ----
    0001  0002  00FF  TIIDEV
    0002  0001  0030  RANDOMUSER
    0003  0000  0000  XRAY
    0004  0002  00FF  NOD

BG  Display and/or modify Bad Guy List <node number> <R/I>

    This command when entered without any parameters displays the
    "bad guy" list.  When used with a node number and 'R' it will remove
    that node from the list, and 'I' will included.  The 'R' and 'I'
    features are privileged commands and usage is noted in audit trails.

    >BG

    2000 701 1012

    >BG 2022 I

    2022 2000 701 1012

HS  Display host information



ND  Display node descriptor

    This command displays information about the node and its network
    links.

NS  Display node statistics

    This command displays various statistics about the node including
    time differentiations in packet loops, which can then be used to
    determine the current job load on that particular node.

KD  Display link descriptor <linked node>

    This command displays the values of the link to the node specified.
    This is displayed with columns relating to type of node (TP), speed
    of the link (SP), number of channels on the link (NCHN), etc..

KS  Display link statistics <up to 8 node numbers>

    This command provides a report on various factors on the integrity
    of the link to the given node(s), such as bandwidth usage, packet
    overhead, characters/second transmitted, delays in milliseconds, etc.

BZ  "Zap" link to node <node number>

    This command will cause the link to the specified node to be
    reset.  This command is privileged and is audited.  If the node
    "zapped" is not currently linked a "??" error message will be
    displayed.

TL  Set/Reset trace on link  <node number>
TN  Set/Reset trace on line  <node number>
TM  Display trace events     <B(ackground) / F(oreground)>

    These commands are used to display activity between two active
    nodes.


AC  Display active channels <starting channel> <range of channels>

    This command will display all active channel numbers for the given
    range starting at the given channel number.  Range is in hex.

QC  Query channel status <channel number>

    This command displays information about the given channel,
    including throughput speed, source and output buffer size and
    address location.


TC  Enable/disable data trace on channel <channel number> <0/1>

    This command with no arguments displays the channels
    that are being diagnosed by the trace.  The command with
    a channel number and a '1' will enable data trace for that
    channel, and a '0' will disable trace on that channel.  Enabling
    or disabling trace is a privileged command.

TD  Display channel trace data in hex  <count> <I/O>
TE  Display channel trace data in hex including escapes <count> <I/O>
TA  Display channel trace data as ASCII  <count> <I/O>

    With these commands trace data is displayed for a specified
    time count.  A prefixed 'I' or 'O' will show input or output
    data.  The default is both.

    >ta 5

    I/O   CHN   TIME
    OUT  0040   ECC5  \86\86\0F\00\8A\80h\80\8CS\83valinfo;
    IN   0040   EC87  \00\09\86\86\0D\08\00\00h
    OUT  0040   0F67  \86\86\0E\00\880\8D
    IN   0040   1029  \00,\86\86\09\86\00\00\90\1B\19\80 \06\86\00\00h
                      \15\1B\08J\04\0B\04\0F\04=\0DR\80JS\80\80
                      \8CVALINFO\8D
    OUT  0040   102F  \86\86\14\89p\90\1B\19\86\86\14\89j\18\15\13

**Note:  Although this will allow one to follow the network connections
         on specific channels, password data is filtered out.  As you
         can see from the above example, usernames are not.  Many
         usernames do not have passwords, as you all know.  **

On more recent versions of XRAY a similar command "DR" performs a
similar function to the trace commands, but shows both hex and
ascii of the data in memory registers of the node.

    >DR

    I NOS 0001 A0  *
    I SND 0001 A1  *  !
    I DTA 4920 616D 2061 6E20 6964 696F 7420 6265  *I am an idiot be*
          0002 9D63 6175 7365 2049 206C 6566 7420  *   cause I left *
          6D79 7365 6C66 206C 6F67 6765 6420 696E  *myself logged in*
          2061 6E64 2077 656E 7420 686F 6D65 2E0D  * and went home. *
          6F70 7573 2520 0D0A 0D0A 0D0A 0D0A 0D0A  *opus%           *

BS  Display bufferlet use statistics

    This command shows the current and past usage of the memory
    allocated to data buffering.  This shows total usage, total peak
    usage, and available buffer size.

RB  Read buffer <buffer index>

    This command displays the entire contents of the given buffer.
    This is a privileged command and its use is not primarily for user
    circuits.  Primarily.

    >RB 69

    50 61 72 74 79 20 6F 6E 20 64 75 64 65 21 21 21

WB  Write buffer <buffer index>

    This command writes up to seven bytes into the specified buffer.
    The buffer must greater than 4.  This is also a privileged command.

CD  Set/reset CRYPTO auto display mode <Y/N>
CL  Display CRYPTO log <number of minutes>
CM  Display CRYPTO messages by type
SM  Enable/Disable CRYPTO messages by type

    CRYPTO messages are informational messages about the activity of
    the node.  Up to 256 such entries are stored in a circular buffer
    to record this activity.  You can turn on automatic reporting
    of these messages with the CD command prefixed with a 'Y' for
    on and 'N' for off.  Certain message types that become bothersome
    can be disabled with the SM command and the message type.

DB  Begin delay measurement
DD  Display delay measurement statistics
DE  Terminate delay measurement
DL  Begin data loopback circuit

    These commands are used to build circuits for testing the speed and
    integrity of data flow between two nodes.  The DL command is
    super privileged and only one such circuit can be built on
    a node at a given time.  The data traffic generated by the DL is for
    diagnostic use only and can be monitored by viewing node and link
    statistics.

PM  Measure performance on a channel <channel number>

    This command measures the performance of a given channel by
    inserting a timing sequence into the packet stream.  Once it has
    reached the given channel it is returned and a value corresponding
    to the total time elapsed in milliseconds is displayed.  If the
    channel is not active, or no response is returned in 8 seconds the
    message "BAD CHANNEL OR TIMEOUT" is displayed.

LE  Set local echo mode
RE  Set remote echo mode

    One would use the set local echo command if the XRAY terminal
    is not echoing commands typed by the user.  By default, XRAY does
    not echo output.


SUMMARY

    XRAY is pretty confusing.  Be careful with what you are doing
    since you are essentially prodding around in the memory of the
    node.  Think of it in terms of using a utility to poke and prod
    the memory of your own computer.  Think of how disastrous a
    command written to the wrong portion of memory can be.  Don't
    do anything stupid, or you might bring down a whole network,
    or at minimum lose your access.