WhoDunit 1.0

Copyright

by

MacAttack Software, 1994

I.	What is WhoDunit

WhoDunit is a DOS and Windows based VINES-integrated utility which intercepts all inbound 25th line messages and seamlessly obtains the origin of the sender. This utility is comprised of three components: a common 7,168 Byte TSR called WdCatch.com, a DOS viewer called WhoDunit.exe and a Windows Viewer called WhoDunit.exe.

1.	WdCatch.com - TSR Catcher

WdCatch will seamlessly intercept and obtain the origin of all 25th line messages received by the PC. WdCatch requires approximately 7,168 Bytes of RAM in which to load. WdCatch will store the last ten messages, the respective source addresses and time-stamps in its internal message queue. WdCatch can be completely removed from memory should it no longer be needed. WdCatch maintains a control API through Interrupt 0x2F function 0xBB.

2.	DosView.exe - DOS Command Line Viewer

WhoDunit DOS viewer will display the last ten messages, the respective sender's Streettalk address and the corresponding message time-stamps held in the TSR's internal message queue. The display will order the messages and corresponding addresses from least to most recent. This utility supports standard I/O for redirection to printers or files.

3.	Whodunit.exe - Windows Viewer

WhoDunit Windows viewer will display up to the last 50 messages, the respective sender's Streettalk address, Node type(Server/PC) and the corresponding message time-stamps. The display will sort the messages from most recent to least recent. Users will be allowed to Send 25th line messages and invoke their favorite E-mail packages directly from within WhoDunit. Clipboard support is provided to allow other Windows applications to File, Print or review the message information. The application also has several ways in which it can

alert users of new messages.

II.	Why WhoDunit?

1.	"Who Sent That Message!" WhoDunit was created since there is currently, no known product capable of determining the origin of all 25th line messages sent by the various Banyan-supplied send methods. With WhoDunit, this capability is provided and more importantly, in a seamless manner.

2.	Seamless Operation. Unlike other products, WhoDunit operates behind the scenes to seamlessly intercept all 25th line messages and obtain their originating Streettalk Address. In all instances, the user will continue to receive 25th Line messages as if they were running without WdCatch. Only when the user receives a harassing message do they need to run the WhoDunit.exe viewer utility. The viewer utility will allow the user to document the last ten time-stamped messages and the corresponding sender's Streettalk addresses.

3. Untouched Z: Drive. Leave your Z: drive as Banyan intended it to be - untouched. Requiring administrators to install software on z: drive can pave the way for viruses, introduce security problems due to improperly restored ARL's and can easily result in incomplete coverage.

4.	No Ongoing Maintenance. While there are several message identification products which require the replacement of the Banyan Send utility, their success depends largely on the ability of the often overburdened Network Administrator to remember to re-apply the modified Send after each VINES upgrade or patch. Given the often large number of patch or upgrade diskettes, coupled with, on the average, large Banyan networks, Administrators can easily overlook a small detail like replacing the Banyan Send.exe utility with a modified one. With WhoDunit, the Administrator merely copies the WdCatch.com and the Whodunit.exe files to a shared network drive and then modifies the login Batch files or postlogin statement to load WdCatch.com.

III.	Technical background on 25th Line Messages

There are currently two known methods of sending 25th line messages in a VINES environment. Each of these methods and the implications on WhoDunit and other third party solutions will be discussed.

1.	PCWho RPC

This method is currently being used by the VINES Send.exe utility for DOS and is not directly available under the VINES Toolkit. The Send program obtains the address of the recipient and then sends a RPC call to the recipient's PC-Talk port. Upon receipt of this message, the recipient's logic will display the 25th line message. Each PC is capable of retaining the text of the last four 25th line messages.

a.	Detection

1.	The WhoDunit system will immediately identify the sender regardless of message origin and save the sender's Streettalk address and message in an internal memory-based buffer. WdCatch, upon resolving the source of the message, releases control to VINES display logic which posts a normal 25th line message on the client's PC. No extra and potentially confusing 25th line messages will be displayed at this point. To review source of last 10 messages run Whodunit.exe.

2.	Other vendor solutions will be incapable of identifying the Streettalk address of the sender.

3.	Banyan VS logs do not log these specific message exchanges.

2.	VS RPC

This mechanism will allow the server-based VINES Security Service (VS) to act as a proxy sender on behalf of the real sender. The sender PC first selects a VS by issuing a VS Lookup Broadcast. All VS services within the specified Hop count will respond and the sender picks the first VS that responded. The sender then sends the message to the selected local VS. The local VS will then deflect the message operation to the sender's Controlling VS service which is located on the server containing the sender's Streettalk group. This RPC message contains information on sender, recipient's Streettalk name and message(s). The sender's controlling VS then looks up the Network Address of the recipient and using methods detailed in the above discussion on PCWho, sends a 25th line message to the recipient using the PcTalk Well Known Port. Upon receipt of this message, the recipient's logic will display the 25th line message. Each PC is capable of retaining the text of the last four 25th line messages.

Banyan's WinSend.exe and the VINES Toolkit VnsSendUserMessage() both use this mechanism to send 25th line messages.

a.	Detection

1.	In this case, the WhoDunit system will identify the sender's Controlling VS service as being the source of the message. The VS log level for the server identified by WhoDunit could be changed to level three until the sender is identified.

2.	Other vendor solutions will be incapable of identifying the Streettalk address of the sender or even the Controlling VS.

3.	VS logs at level three reflect these transactions. In general, Banyan does not recommend running logs beyond level one for extended periods of time.

IV.	Supported Platforms

This software is supported on the following platforms running VINES 4.11(5) 5.0 and 5.5X.

1.	DOS 3.3 or greater

2.	Windows 3.1 from within a DOS box or Native Windows using WhoDunit for Windows. Requires that WdCatch.com be loaded before running Windows. WhoDunit.exe can be run from a DOS box with more than 64KB of RAM. Both WhoDunit for DOS and Windows can coexist at the same time with no adverse impact on operation.

V.	Installation

To install the WhoDunit system, unzip the WhoDunit.zip file using the -d option to preserve the original directory structure. Copy the WdCatch.com and the respective DOS and Windows viewers from the distribution medium to a shared applications volume that is included in your users path. For example, copy files to N:\apps and for each user ensure that the DOS path is modified to include N:\apps.

VI. Loading WdCatch TSR

To load the WdCatch TSR you must first login to the VINES Network. Once logged in to the VINES network, type:

WdCatch<ENTER>

If the TSR installed OK, then there will be a message indicating such. Possible reasons for error messages include:

WdCatch Already installed. If you have not previously installed WdCatch and you are getting this message then there is an interrupt 0x2F function 0xBB conflict.

Softwa	re (Trial versions only) has expired. Trial versions are time-stamped for roughly a month of full-feature operation after which, they become inoperative.

Not logged in. You must first login to the network.

If Running Windows you must first load WdCatch.com prior to	starting Windows. Once this software is loaded, all 25th line	messages will be trapped.

VII.	Removing WdCatch TSR from Memory

To remove WdCatch TSR from memory type:

WdCatch /r<ENTER>

The entire TSR will be removed from memory. Please note that by doing this, the message buffer will be emptied.

Possible errors include:

1.	Mistyping /r or /R parameter.

2.	Interrupt 0x2F has since been redirected to another memory resident utility such as DOS Print.com. It would not be possible for WdCatch.com to restore original Int 0x2F state. This condition could also arise from a DOS box within Windows where in and among other things, Int 0x2F has been taken over by Windows.

VIII.Viewing in DOS

To View up to the last ten 25th line messages type:

DosView<ENTER>

The following display will result:

WhoDunit Viewer 1.0ß Copyright 1993 by Stuart J. Macdonald

===============MESSAGES================

[15:45:24 10/25/1993] FROM SERVER BigMac

MSG 'You have new mail from Brittney@QA@MacAttack'

[16:42:43 10/25/1993] FROM USER 'Brittney@QA@MacAttack'

MSG 'Dad, Can we go to dinner?... Now!'

[18:49:14 10/25/1993] FROM USER 'Pest@Sales@MacAttack'

MSG 'I bet you can't tell who sent this - Ha!'

==================END===================

IX. Viewing in Windows

WhoDunit viewer for Windows can coexist with the Banyan Message notification system. WhoDunit adds considerable value as it can help reveal the source to a given message.

With the WhoDunit for Windows product first load WdCatch.com before starting Windows.

The Whodunit Windows viewer can be automatically loaded upon starting Windows. This would provide complete coverage (last 50 messages) for the user and will do so in a transparent manner. This can be done by adding the following text to the windows section of the Win.ini file:

[windows]

load=d:\whodunit\win\whodunit.exe

Alternatively, a Program Group which contains the WhoDunit for Windows viewer could be defined. This would allow the user to run WhoDunit viewer at their leisure and always capture the last ten messages.

Upon startup, the Windows version will grab up to the last ten 25th line messages from the WdCatch buffers. While the WhoDunit for Windows product is running, it can accumulate up to 50 messages before the oldest messages are dropped from the queue.

Who Did it? To reveal the source of a given message, scroll down to the desired message and single click on it. Information on the Sender(From), message time(Received) and Node Type will be displayed for each selected message.

Making a Log If a log similar to the DOS version is required, select Edit|Copy to send a log to the Clipboard device. You could then use your favorite Windows Presentation Application to Display, File, Mail or Print the log.

Directly Invoking Mail. By configuring the Display Options, you could launch a Windows-based E-mail package by double-clicking on a selected "You Have New Mail From..." message. To enable this feature go to the Display|Options dialog and press the Launch Mail Radio button. Then, enter the complete path to your E-mail client. For instance, Q:\LsMail21\LsMail.exe. The configuration is saved in a Private Whodunit.ini file in your Windows directory.

Sending 25th Line Messages. By selecting Send|Message option, the Banyan-supplied z:\WinSend.exe file will be run to allow for the sending of multiple 25th line messages. Please consult Banyan documentation or on-line help on use of this utility.

Setting Display Options.

The user can select how WhoDunit is to convey the arrival of a new message by entering the Display|Options Dialog. There are four modes of Message Notification:

1.	Beep and Flash Icon

If a message is received while WhoDunit is Iconized, a short beep will sound each second and the Icon will change color states.

2.	Flash Icon

If a message is received while WhoDunit is Iconized, the Icon will change color states.

3.	Pop Up

If a message is received while WhoDunit is Iconized, the WhoDunit application will become the active window.

4.	Nothing

Do nothing upon receipt of a new 25th line message.

Required Files

The following two files are required for DOS operation.

WdCatch.com This file contains the message resolution logic necessary for proper operation. It must be run to catch messages.

DosView.exe This file will allow a DOS User to view last ten messages.

In addition to the WdCatch.com file, two additional files are required for Windows operation.

WhoDunit.Hlp This file is a Help file for the Whodunit application. It must reside in the Working Directory specified in the Program Manager Item Properties Dialog.

Whodunit.Exe This is the Windows WhoDunit viewing agent.

Files Created by WhoDunit for Windows

Whodunit.ini This private profile file, located in the Windows Directory, contains all saved configuration information on New Message actions and Mail Client.

[WhoDunit]

Display Options=203

Mail Client=Z:\MAIL

Enable Mail Client=1

X.	Catching a Sender of unwanted messages

After installing WdCatch, if a user receives unwanted messages, have them run DosView or WinView and note the sender. If the message is from a Client then the sender of your messages has been positively identified by Whodunit and no further steps are required. The exact network time and date that each message was received will be displayed along with each message and the corresponding sender's Streettalk name.

If the sender is identified as a server then your administrator must be notified so that they could set the VS log level on the indicated server to level three. When you receive another harassing 25th line message and the same server is referenced by WhoDunit, refer to the server's VS logs and the source of the message will be positively identified. You can use the time and date of the WhoDunit.exe output to look for the specific VS log entry as the times should be within seconds of each other. In a large network which spans multiple time zones, the difference in time must be accounted for as both whodunit.exe and VS logs are relative to their respective time zones.

Sample VS Log at level three.

18:49:14 [1677216] Sent Message to Stuart@Devel@MacAttack

from Pest@Sales@MacAttack

@00 03 00 30 99 b0 80 5d 02 4a 00 00 00 00 00 00

XI.	Disclaimer

MacAttack Software, has taken all possible steps to ensure that this software is of the highest quality and functions as advertised.

It is the developer's intent to place fully functional time dated copies of this software on Compuserve-based forums and the Internet. The developer encourages all interested parties to evaluate and freely distribute these fully functional and free demonstration copies before purchasing the product as all sales will be final and the product is sold on an "as is" basis.

By using this product, it is agreed that the developer of this product is to assume no liability for direct or indirect damages resulting from its use. As with any product, the licensee is encouraged to test and certify proper operation before relying on the product.

XII.	Warrantee

Developer-supplied diskette-based media is warranted for a period of sixty days. Warrantee is limited to actual replacement of defective media. Developer will not be responsible for Media damaged by licensee as a result of physical abuse and or neglect.

XIII.Support

All support will be through Compuserve or Internet Mail. For post-sales support, please provide your customer number supplied in your purchase documentation.

Please direct all questions to

Stuart Macdonald

MacAttack Software

CIS 73523,660.

sjmacdonald@Delphi.com

XIV. License

One copy of WhoDunit must be purchased for each server whose Streettalk contai	ns users who will be using the WhoDunit product.

Multiple copies of actual release media can be made for backup or internal distribution purposes as long as the terms in the previous license paragraph are not violated.

Clarification:

For example, in corporation X, there are ten servers and all users will be using WhoDunit. Of these ten servers, four are strictly application servers and their Streettalk's contain no users. For licensing purposes, six copies of the WhoDunit software will need to be purchased by corporation X.

XV. Pricing

Purchase Quantity

Price ($ US)	1..10

90	11..25

70	26..50

60	51..100

50	> 101

40

Check or Money orders should be issued to:

MacAttack Software

5707 Flagler Drive

Centreville, VA 22020-2960

Please specify Distribution medium (5 1/4", 3.5", Compuserve) when ordering. Compuserve medium will be in the form of a self-extracting ZIP file which contains all product documentation in RTF format.

Please add an additional $5.00 for shipping and handling for all non-Compuserve Orders.

* VINES and Streettalk are registered trademarks of Banyan Systems Inc.

* OS/2 is a registered trademark of IBM

* Windows is a registered trademark of Microsoft