Dateless and DNS Desperate! Stateless. Geoff Huston APNIC
|
|
|
- Marcia Goodwin
- 8 years ago
- Views:
Transcription
1 Dateless and DNS Desperate! Stateless Geoff Huston APNIC
2
3
4 Can I do both at once? This is definitely a Bad Idea with that intriguing possibility that it just might be made to work making it a Useless Tool at the same time!
5 IP Networking 101 There are two major transport protocols: TCP when reliable data transfer is needed UDP for simple lightweight transactions
6 IP Networking 102 Client / Server Transaction Support TCP has limitations server load, connection intensity limitations, vulnerability to TCP SYN and RST attacks UDP has limitations requires IP fragmentation handling for large UDP packets and just how does IPv6 handle UDP fragmentation when the effective path MTU is less than the interface MTU? i.e. Q: how does DNS on UDP on IPv6 work when there are path MTU constraints lower than the local MTU? A: It doesn t!
7 IP Networking 102 Coping with large responses what happens when the response size exceeds the path MTU? Use UDP with IP level fragmentation and reassembly? but firewalls often drop trailing IP fragments IPv6 UDP path MTU handling is not well suited to transaction apps Use TCP segmentation andreassembly? switching to TCP implies additional load on the server, limitations on server query capacity, and additional delay in the elapsed time for the transaction
8 IP Networking 666 Lets fire up the Bad Idea Factory! Why not combine UDP with TCP segmentation and reassembly? The client runs a conventional TCP application The server runs a stateless UDP-style application, but formats its output using TCP framing i.e. What the server wants is Stateless TCP
9 A Simple TCP Transaction client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, sackok,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.](/docs-images/45/1751107/images/page_9.jpg "], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 247 server.h3p > client.53910: Flags [P.")
10 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, sackok,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.](/docs-images/45/1751107/images/page_10.jpg "], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 247 server.h3p > client.53910: Flags [P.")
11 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 SYN+ACK server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, sackok,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], seq 3565371242, ack 1237395673, win 65535, opcons [mss 1460,nop,wscale 3, sackok,ts val 2295904142 ecr 377316681], length 0 client.53910 > server.h3p: Flags [.](/docs-images/45/1751107/images/page_11.jpg "], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.")
12 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 SYN+ACK server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val ecr ], length 0 client Request > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], seq 3565371242, ack 1237395673, win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val 2295904142 ecr 377316681], length 0 client.53910 Request > server.h3p: Flags [.](/docs-images/45/1751107/images/page_12.jpg "], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.")
13 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 SYN+ACK server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val ecr ], length 0 client Request > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 Response server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 FIN server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], seq 3565371242, ack 1237395673, win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val 2295904142 ecr 377316681], length 0 client.53910 Request > server.h3p: Flags [.](/docs-images/45/1751107/images/page_13.jpg "], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.")
14 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 SYN+ACK server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val ecr ], length 0 client Request > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 Response server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 FIN server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ACK of Response ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], ACK of FIN length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], FIN length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0
![], seq 3565371242, ack 1237395673, win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val 2295904142 ecr 377316681], length 0 client.53910 Request > server.h3p: Flags [.](/docs-images/45/1751107/images/page_14.jpg "], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.")
15 A Simple TCP Transaction Client SYN Server client > server.h3p: Flags [S], seq , win 65535, opcons [mss 1460,nop,wscale 3,nop,nop, TS val ecr 0,sackOK,eol], length 0 SYN+ACK server.h3p > client.53910: Flags [S.], seq , ack , win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val ecr ], length 0 client Request > server.h3p: Flags [.], ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 0 client > server.h3p: Flags [P.], seq 1:248, ack 1, win 65535, opcons [nop,nop,ts val ecr ], length 247 Response server.h3p > client.53910: Flags [P.], seq 1:468, ack 248, win 8326, opcons [nop,nop,ts val ecr ], length 467 FIN server.h3p > client.53910: Flags [F.], seq 468, ack 248, win 8326, opcons [nop,nop,ts val ACK of Response ecr ], length 0 client > server.h3p: Flags [.], ack 468, win 65535, opcons [nop,nop,ts val ecr ], ACK of FIN length 0 client > server.h3p: Flags [.], ack 469, win 65535, opcons [nop,nop,ts val ecr ], FIN length 0 client > server.h3p: Flags [F.], seq 248, ack 469, win 65535, opcons [nop,nop,ts val ecr ], length 0 server.h3p > client.53910: Flags [.], ack 249, win 8325, opcons [nop,nop,ts val ecr ], length 0 ACK of FIN
![], seq 3565371242, ack 1237395673, win 65535, opcons [mss 1460,nop,wscale 3, ACK sackok,ts val 2295904142 ecr 377316681], length 0 client.53910 Request > server.h3p: Flags [.](/docs-images/45/1751107/images/page_15.jpg "], ack 1, win 65535, opcons [nop,nop,ts val 377316681 ecr 2295904142], length 0 client.53910 > server.h3p: Flags [P.")
16 The Server s Perspective 1. SYN Response SYN SYN+ACK Server Flip the IP source and destination fields Flip the TCP source and destination ports Use any old sequence number Offer a reasonable MSS (1220) Offer no other TCP options
17 The Server s Perspective 2. Request Response Send an ACK Request Response FIN Server Start with a sequence number given in the Request ACK Generate the response Chop the response into 512 octet segments Send the segment train back to back Send a FIN
18 The Server s Perspective 3. FIN Response FIN ACK Server Flip the IP addrs, TCP ports and ack/sequence fields increment ack field send ACK
19 The Stateless TCP Server s Perspective 1. SYN 2. Request (payload) 3. FIN SYN SYN+ACK Request Response FIN FIN ACK Stateless Server Stateless Server Stateless Server 4. all else all else no Server response
20 Can this be coded? How can a user application see raw IP packets without the kernel getting in the way? libpcap is one option: /*associate a device to the packet capture process */ pcap_lookupnet(dev, &net, &mask, errbuff) ; /* open capture device */ handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuff); /* set the capture filter e*/ filter_exp = "dst port 80 and dst host "; pcap_compile(handle, &fp, filter_exp, 0, net) ; pcap_se`ilter(handle, &fp) ; /* and start it up, sending raw packets to got_packet() roucne */ pcap_loop(handle, - 1, got_packet, NULL) ;
21 Can this be coded? How can a user application send raw IP packets? raw sockets is useful here /* open a raw socket interface for output */ sock_fd = socket(pf_inet, SOCK_RAW, IPPROTO_TCP)) ; /* inform the kernel the IP header is already a3ached via a socket opcon */ setsockopt(sock_fd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) ; /* write a raw IP packet into the socket */ sendto(sock_fd, buffer, ip_to- >ip_len, 0, (struct sockaddr *) &dst, sizeof(dst)
22 Can this be coded? And complete the picture with crc calculator, and IP packet decoder and stateless transaction routines
23 Can this be coded? Yes! A user space implementation of a stateless HTTP TCP server that avoids kernel TCP processing Application pcap raw socket i/f device i/f
24 A Stateless HTTP Proxy in the wild! IP client > server.h3p: S : (0) win <mss 1460> IP server.h3p > client.55371: S : (0) ack win <mss 1220> IP client > server.h3p:. ack 1 win IP client > server.h3p: P 1:246(245) ack 1 win IP server.h3p > client.55371:. ack 246 win IP server > backend.h3p: S : (0) win <mss 1460> IP backend.h3p > server.56447: S : (0) ack win <mss 1460> IP server > backend.h3p:. ack 1 win 8326 IP server > backend.h3p: P 1:248(247) ack 1 win 8326> IP backend.h3p > server.56447: P 1:468(467) ack 248 win 8326 IP server.h3p > client.55371:. 1:468(467) ack 246 win IP backend.h3p > server.56447: F 468:468(0) ack 248 win 8326 IP server > backend.h3p:. ack 469 win 8326 IP server > backend.h3p: F 248:248(0) ack 469 win 8326 IP backend.h3p > server.56447:. ack 249 win 8325 IP server.h3p > client.55371: F 468:468(0) ack 246 win IP client > server.h3p:. ack 468 win IP client > server.h3p:. ack 469 win IP client > server.h3p: F 246:246(0) ack 469 win IP server.h3p > client.55371:. ack 247 win 65535
25 A Stateless HTTP Proxy 1. Sync and Request IP client > server.h3p: S : (0) win <mss 1460> IP server.h3p > client.55371: S : (0) ack win <mss 1220> IP client > server.h3p:. ack 1 win IP client > server.h3p: P 1:246(245) ack 1 win IP server.h3p > client.55371:. ack 246 win Client SYN ACK Request Server SYN+ACK ACK
26 A Stateless HTTP Proxy 2. Backend Request and Response IP server > backend.h3p: S : (0) win <mss 1460> IP backend.h3p > server.56447: S : (0) ack win <mss 1460> IP server > backend.h3p:. ack 1 win 8326 IP server > backend.h3p: P 1:248(247) ack 1 win 8326> IP backend.h3p > server.56447: P 1:468(467) ack 248 win 8326 IP server.h3p > client.55371:. 1:468(467) ack 246 win Client Server SYN ACK Request Response Back End SYN+ACK Response
27 A Stateless HTTP Proxy 3. shutdown IP backend.h3p > server.56447: F 468:468(0) ack 248 win 8326 IP server > backend.h3p:. ack 469 win 8326 IP server > backend.h3p: F 248:248(0) ack 469 win 8326 IP backend.h3p > server.56447:. ack 249 win 8325 IP server.h3p > client.55371: F 468:468(0) ack 246 win IP client > server.h3p:. ack 468 win IP client > server.h3p:. ack 469 win IP client > server.h3p: F 246:246(0) ack 469 win IP server.h3p > client.55371:. ack 247 win Client Server Back End ACK FIN FIN ACK FIN ACK ACK FIN ACK
28 So far so good.. But can we make this bad idea a little worse? What about the DNS? Can we use the same approach to create a hybrid model of a TCP DNS client speaking to a UDP DNS resolver? DNS Client DNS resolver TCP UDP
29 So far so good.. Or, more realistically, can we use the same approach to create a hybrid model of a TCP DNS client speaking to a stateless TCP DNS resolver? DNS Client DNS resolver TCP Stateless TCP
30 DNS and Stateless TCP To test if this approach could work I used a prototype config of a stateless TCP facing the client, and a UDP referral to a DNS resolver as the back end DNS Client DNS resolver TCP Stateless TCP UDP UDP
31 It Worked! $ dig rand.apnic.net in any client > server.domain: S, cksum 0x9159 (correct), : (0) win <mss 1460> server.domain > client.55998: S, cksum 0x82b9 (correct), : (0) ack win <mss 1220> client > server.domain:., cksum 0x9986 (correct), 1:1(0) ack 1 win client > server.domain: P, cksum 0x41b2 (correct), 1:35(34) ack 1 win ANY? rand.apnic.net. (32) server.domain > client.55998:., cksum 0x9964 (correct), 1:1(0) ack 35 win server > backend.domain: ANY? rand.apnic.net. (32) backend.domain > server.54054: 30304* q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998:., cksum 0x421a (correct), 1:232(231) ack 35 win * q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998: F, cksum 0x987c (correct), 232:232(0) ack 35 win client > server.domain:., cksum 0x987d (correct), 35:35(0) ack 232 win client > server.domain:., cksum 0x987c (correct), 35:35(0) ack 233 win client > server.domain: F, cksum 0x987b (correct), 35:35(0) ack 233 win server.domain > client.55998:., cksum 0x987c (correct), 232:232(0) ack 36 win 65535
32 1. TCP handshake dig rand.apnic.net in any It Worked! client > server.domain: S, cksum 0x9159 (correct), : (0) win <mss 1460> server.domain > client.55998: S, cksum 0x82b9 (correct), : (0) ack win <mss 1220> client > server.domain:., cksum 0x9986 (correct), 1:1(0) ack 1 win client > server.domain: P, cksum 0x41b2 (correct), 1:35(34) ack 1 win ANY? rand.apnic.net. (32) server.domain > client.55998:., cksum 0x9964 (correct), 1:1(0) ack 35 win server > backend.domain: ANY? rand.apnic.net. (32) backend.domain > server.54054: 30304* q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998:., cksum 0x421a (correct), 1:232(231) ack 35 win * q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998: F, cksum 0x987c (correct), 232:232(0) ack 35 win client > server.domain:., cksum 0x987d (correct), 35:35(0) ack 232 win client > server.domain:., cksum 0x987c (correct), 35:35(0) ack 233 win client > server.domain: F, cksum 0x987b (correct), 35:35(0) ack 233 win server.domain > client.55998:., cksum 0x987c (correct), 232:232(0) ack 36 win 65535
33 dig rand.apnic.net in any It Worked! 2. TCP request and referral to UDP DNS backend client > server.domain: S, cksum 0x9159 (correct), : (0) win <mss 1460> server.domain > client.55998: S, cksum 0x82b9 (correct), : (0) ack win <mss 1220> client > server.domain:., cksum 0x9986 (correct), 1:1(0) ack 1 win client > server.domain: P, cksum 0x41b2 (correct), 1:35(34) ack 1 win ANY? rand.apnic.net. (32) server.domain > client.55998:., cksum 0x9964 (correct), 1:1(0) ack 35 win server > backend.domain: ANY? rand.apnic.net. (32) backend.domain > server.54054: 30304* q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998:., cksum 0x421a (correct), 1:232(231) ack 35 win * q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998: F, cksum 0x987c (correct), 232:232(0) ack 35 win client > server.domain:., cksum 0x987d (correct), 35:35(0) ack 232 win client > server.domain:., cksum 0x987c (correct), 35:35(0) ack 233 win client > server.domain: F, cksum 0x987b (correct), 35:35(0) ack 233 win server.domain > client.55998:., cksum 0x987c (correct), 232:232(0) ack 36 win 65535
34 3. TCP response to client dig rand.apnic.net in any It Worked! client > server.domain: S, cksum 0x9159 (correct), : (0) win <mss 1460> server.domain > client.55998: S, cksum 0x82b9 (correct), : (0) ack win <mss 1220> client > server.domain:., cksum 0x9986 (correct), 1:1(0) ack 1 win client > server.domain: P, cksum 0x41b2 (correct), 1:35(34) ack 1 win ANY? rand.apnic.net. (32) server.domain > client.55998:., cksum 0x9964 (correct), 1:1(0) ack 35 win server > backend.domain: ANY? rand.apnic.net. (32) backend.domain > server.54054: 30304* q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998:., cksum 0x421a (correct), 1:232(231) ack 35 win * q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998: F, cksum 0x987c (correct), 232:232(0) ack 35 win client > server.domain:., cksum 0x987d (correct), 35:35(0) ack 232 win client > server.domain:., cksum 0x987c (correct), 35:35(0) ack 233 win client > server.domain: F, cksum 0x987b (correct), 35:35(0) ack 233 win server.domain > client.55998:., cksum 0x987c (correct), 232:232(0) ack 36 win 65535
35 4. FIN close dig rand.apnic.net in any It Worked! client > server.domain: S, cksum 0x9159 (correct), : (0) win <mss 1460> server.domain > client.55998: S, cksum 0x82b9 (correct), : (0) ack win <mss 1220> client > server.domain:., cksum 0x9986 (correct), 1:1(0) ack 1 win client > server.domain: P, cksum 0x41b2 (correct), 1:35(34) ack 1 win ANY? rand.apnic.net. (32) server.domain > client.55998:., cksum 0x9964 (correct), 1:1(0) ack 35 win server > backend.domain: ANY? rand.apnic.net. (32) backend.domain > server.54054: 30304* q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998:., cksum 0x421a (correct), 1:232(231) ack 35 win * q: ANY? rand.apnic.net. 6/0/2 rand.apnic.net. SOA mirin.apnic.net. research.apnic.net , rand.apnic.net. NS mirin.apnic.net., rand.apnic.net. NS sec3.apnic.net., rand.apnic.net. MX kombu.apnic.net. 100, rand.apnic.net. MX karashi.apnic.net. 200, rand.apnic.net. MX fennel.apnic.net. 300 ar: sec3.apnic.net. A sec3.apnic.net, sec3.apnic.net. AAAA sec3.apnic.net (229) server.domain > client.55998: F, cksum 0x987c (correct), 232:232(0) ack 35 win client > server.domain:., cksum 0x987d (correct), 35:35(0) ack 232 win client > server.domain:., cksum 0x987c (correct), 35:35(0) ack 233 win client > server.domain: F, cksum 0x987b (correct), 35:35(0) ack 233 win server.domain > client.55998:., cksum 0x987c (correct), 232:232(0) ack 36 win 65535
36 What s it good for? It can get around the TCP state overhead in busy servers And by shifting up the segmentation / reassembly function from the IP layer to TCP it can circumvent firewall and difficult IPv6 PMTU/UDP issues when dealing with large responses in transaction applications for an example here think DNSSEC + DNS!
37 But Its just like UDP in almost every respect: no reliability, no flow control, and absolutely no polite manners whatsoever! And its still a Bad Idea!
38 Acknowledgements This Bad Idea was cooked up with George Michaelson The code to perform pseudo TCP in user space used ingredient ideas from: TCP/IP Illustrated, Volume 1, Stevens Unix network Programming, Stevens, Fenner & Rudoff tcpdump and the libpcap library, Van Jacobsen et al, The FreeBSD recipe used here for the Stateless HTTP and DNS proxies can be found at:
Improving DNS performance using Stateless TCP in FreeBSD 9
Improving DNS performance using Stateless TCP in FreeBSD 9 David Hayes, Mattia Rossi, Grenville Armitage Centre for Advanced Internet Architectures, Technical Report 101022A Swinburne University of Technology
How do I get to www.randomsite.com?
Networking Primer* *caveat: this is just a brief and incomplete introduction to networking to help students without a networking background learn Network Security. How do I get to www.randomsite.com? Local
CSE 127: Computer Security. Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko December 4, 2014 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
1! Network forensics
Network Forensics COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1! Network forensics Network Forensics Overview! Systematic tracking of incoming and outgoing traffic!
Firewall Implementation
CS425: Computer Networks Firewall Implementation Ankit Kumar Y8088 Akshay Mittal Y8056 Ashish Gupta Y8410 Sayandeep Ghosh Y8465 October 31, 2010 under the guidance of Prof. Dheeraj Sanghi Department of
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik
Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS Eric Vyncke (@evyncke) Cisco Session ID: ARCH W01 Session Classification: Advanced Agenda Status of WorldWide IPv6 Deployment IPv6 refresher:
Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm,
Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm, Network IDS devices use passive network monitoring extensively to detect possible threats. Through passive
Chapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
What is a DoS attack?
CprE 592-YG Computer and Network Forensics Log-based Signature Analysis Denial of Service Attacks - from analyst s point of view Yong Guan 3216 Coover Tel: (515) 294-8378 Email: guan@ee.iastate.edu October
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Port Scanning and Vulnerability Assessment. ECE4893 Internetwork Security Georgia Institute of Technology
Port Scanning and Vulnerability Assessment ECE4893 Internetwork Security Georgia Institute of Technology Agenda Reconnaissance Scanning Network Mapping OS detection Vulnerability assessment Reconnaissance
ELEN 689: Topics in Network Security: Firewalls. Ellen Mitchell Computing and Information Services 20 April 2006
ELEN 689: Topics in Network Security: Firewalls Ellen Mitchell Computing and Information Services 20 April 2006 Firewall Historically: a wall constructed to prevent the spread of fire Firewall Function
Unix System Administration
Unix System Administration Chris Schenk Lecture 08 Tuesday Feb 13 CSCI 4113, Spring 2007 ARP Review Host A 128.138.202.50 00:0B:DB:A6:76:18 Host B 128.138.202.53 00:11:43:70:45:81 Switch Host C 128.138.202.71
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Computer Networks. Chapter 5 Transport Protocols
Computer Networks Chapter 5 Transport Protocols Transport Protocol Provides end-to-end transport Hides the network details Transport protocol or service (TS) offers: Different types of services QoS Data
Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP
Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe
Session Hijacking Exploiting TCP, UDP and HTTP Sessions
Session Hijacking Exploiting TCP, UDP and HTTP Sessions Shray Kapoor shray.kapoor@gmail.com Preface With the emerging fields in e-commerce, financial and identity information are at a higher risk of being
CYBER ATTACKS EXPLAINED: PACKET CRAFTING
CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure
Chapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4)
Chapter 3 TCP/IP Networks 3.1 Internet Protocol version 4 (IPv4) Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
CS155 - Firewalls. Simon Cooper <sc@sgi.com> CS155 Firewalls 22 May 2003
CS155 - Firewalls Simon Cooper CS155 Firewalls 22 May 2003 1 Why Firewalls? Need for the exchange of information; education, business, recreation, social and political Need to do something
IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31
IP address format: 7 24 Class A 0 Network ID Host ID 14 16 Class B 1 0 Network ID Host ID 21 8 Class C 1 1 0 Network ID Host ID 28 Class D 1 1 1 0 Multicast Address Dotted decimal notation: 10000000 00001011
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
IP addressing and forwarding Network layer
The Internet Network layer Host, router network layer functions: IP addressing and forwarding Network layer Routing protocols path selection RIP, OSPF, BGP Transport layer: TCP, UDP forwarding table IP
Voice over IP. Demonstration 1: VoIP Protocols. Network Environment
Voice over IP Demonstration 1: VoIP Protocols Network Environment We use two Windows workstations from the production network, both with OpenPhone application (figure 1). The OpenH.323 project has developed
COMP 3331/9331: Computer Networks and Applications. Lab Exercise 3: TCP and UDP (Solutions)
COMP 3331/9331: Computer Networks and Applications Lab Exercise 3: TCP and UDP (Solutions) AIM To investigate the behaviour of TCP and UDP in greater detail. EXPERIMENT 1: Understanding TCP Basics Tools
Network Traffic Evolution. Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig
Network Traffic Evolution Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig 1 Example trace Name port % bytes % packets bytes per packet world-wide-web 80???????????? netnews 119???????????? pop-3 mail 110????????????...
CIT 480: Securing Computer Systems. Firewalls
CIT 480: Securing Computer Systems Firewalls Topics 1. What is a firewall? 2. Types of Firewalls 1. Packet filters (stateless) 2. Stateful firewalls 3. Proxy servers 4. Application layer firewalls 3. Configuring
Hands-on Network Traffic Analysis. 2015 Cyber Defense Boot Camp
Hands-on Network Traffic Analysis 2015 Cyber Defense Boot Camp What is this about? Prerequisite: network packet & packet analyzer: (header, data) Enveloped letters inside another envelope Exercises Basic
Host Fingerprinting and Firewalking With hping
Host Fingerprinting and Firewalking With hping Naveed Afzal National University Of Computer and Emerging Sciences, Lahore, Pakistan Email: 1608@nu.edu.pk Naveedafzal gmail.com Abstract: The purpose
Exam 1 Review Questions
CSE 473 Introduction to Computer Networks Exam 1 Review Questions Jon Turner 10/2013 1. A user in St. Louis, connected to the internet via a 20 Mb/s (b=bits) connection retrieves a 250 KB (B=bytes) web
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol
Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol 1 TCP/IP protocol suite A suite of protocols for networking for the Internet Transmission control protocol (TCP) or User Datagram protocol
Single Pass Load Balancing with Session Persistence in IPv6 Network. C. J. (Charlie) Liu Network Operations Charter Communications
Single Pass Load Balancing with Session Persistence in IPv6 Network C. J. (Charlie) Liu Network Operations Charter Communications Load Balancer Today o Load balancing is still in use today. It is now considered
Network Security TCP/IP Refresher
Network Security TCP/IP Refresher What you (at least) need to know about networking! Dr. David Barrera Network Security HS 2014 Outline Network Reference Models Local Area Networks Internet Protocol (IP)
CIT 480: Securing Computer Systems. Firewalls
CIT 480: Securing Computer Systems Firewalls Topics 1. What is a firewall? 2. Types of Firewalls 1. Packet filters (stateless) 2. Stateful firewalls 3. Proxy servers 4. Application layer firewalls 3. Configuring
Chapter 4 Network Layer
Chapter 4 Network Layer A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you can add, modify, and delete
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
DNS Caching Krytyczna infrastruktura operatora i ostatni element układanki
DNS Caching Krytyczna infrastruktura operatora i ostatni element układanki Adam Obszyński, CISSP, CCIE #8557 Regional Sales Engineer Eastern Europe aobszynski@infoblox.com 1 Dawno temu AD 2000 2 Two kind
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
A1.1.1.11.1.1.2 1.1.1.3S B
CS Computer 640: Network AdityaAkella Lecture Introduction Networks Security 25 to Security DoS Firewalls and The D-DoS Vulnerabilities Road Ahead Security Attacks Protocol IP ICMP Routing TCP Security
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
Access Control: Firewalls (1)
Access Control: Firewalls (1) World is divided in good and bad guys ---> access control (security checks) at a single point of entry/exit: in medieval castles: drawbridge in corporate buildings: security/reception
IP Network Layer. Datagram ID FLAG Fragment Offset. IP Datagrams. IP Addresses. IP Addresses. CSCE 515: Computer Network Programming TCP/IP
CSCE 515: Computer Network Programming TCP/IP IP Network Layer Wenyuan Xu Department of Computer Science and Engineering University of South Carolina IP Datagrams IP is the network layer packet delivery
Content Distribution Networks (CDN)
229 Content Distribution Networks (CDNs) A content distribution network can be viewed as a global web replication. main idea: each replica is located in a different geographic area, rather then in the
Port Scanning. Objectives. Introduction: Port Scanning. 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap.
Port Scanning Objectives 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap. Introduction: All machines connected to a LAN or connected to Internet via a modem
Lecture 2-ter. 2. A communication example Managing a HTTP v1.0 connection. G.Bianchi, G.Neglia, V.Mancuso
Lecture 2-ter. 2 A communication example Managing a HTTP v1.0 connection Managing a HTTP request User digits URL and press return (or clicks ). What happens (HTTP 1.0): 1. Browser opens a TCP transport
Post-Class Quiz: Telecommunication & Network Security Domain
1. What type of network is more likely to include Frame Relay, Switched Multi-megabit Data Services (SMDS), and X.25? A. Local area network (LAN) B. Wide area network (WAN) C. Intranet D. Internet 2. Which
Packet Capture, Filtering and Analysis
Today s Challenges with 20 Years Old Issues alexandre.dulaunoy@circl.lu January 20, 2012 Promiscuous mode Introduction Promiscuous mode BPF BPF - Filter Syntax BPF - Filter Syntax 2 BPF - Filter Syntax
Network layer" 1DT066! Distributed Information Systems!! Chapter 4" Network Layer!! goals: "
1DT066! Distributed Information Systems!! Chapter 4" Network Layer!! Network layer" goals: "! understand principles behind layer services:" " layer service models" " forwarding versus routing" " how a
Introduction to IP networking
DD2395 p2 2011 Introduction to IP networking Olof Hagsand KTH CSC 1 Example: Packet transfer www.server.org An end host requests a web-page from a server via a local-area network The aim of this lecture
Overview of TCP/IP. TCP/IP and Internet
Overview of TCP/IP System Administrators and network administrators Why networking - communication Why TCP/IP Provides interoperable communications between all types of hardware and all kinds of operating
Denial Of Service. Types of attacks
Denial Of Service The goal of a denial of service attack is to deny legitimate users access to a particular resource. An incident is considered an attack if a malicious user intentionally disrupts service
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
Cryptography and network security
Cryptography and network security Firewalls slide 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
Host Discovery with nmap
Host Discovery with nmap By: Mark Wolfgang moonpie@moonpie.org November 2002 Table of Contents Host Discovery with nmap... 1 1. Introduction... 3 1.1 What is Host Discovery?... 4 2. Exploring nmap s Default
Firewalls. configuring a sophisticated GNU/Linux firewall involves understanding
Firewalls slide 1 configuring a sophisticated GNU/Linux firewall involves understanding iptables iptables is a package which interfaces to the Linux kernel and configures various rules for allowing packets
Outline. CSc 466/566. Computer Security. 18 : Network Security Introduction. Network Topology. Network Topology. Christian Collberg
Outline Network Topology CSc 466/566 Computer Security 18 : Network Security Introduction Version: 2012/05/03 13:59:29 Department of Computer Science University of Arizona collberg@gmail.com Copyright
15-441 Project 3, Fall 2001 Stateful Functionality in IP Layer Out: Thursday, November 1, 2001 Due: Tuesday, December 4, 2001
15-441 Project 3, Fall 2001 Stateful Functionality in IP Layer Out: Thursday, November 1, 2001 Due: Tuesday, December 4, 2001 1. Introduction In Project 2 we asked you to implement the IP layer of the
Network Security. Chapter 9. Attack prevention, detection and response. Attack Prevention. Part I: Attack Prevention
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Part I: Attack Prevention Network Security Chapter 9 Attack prevention, detection and response Part Part I:
Firewalls. Basic Firewall Concept. Why firewalls? Firewall goals. Two Separable Topics. Firewall Design & Architecture Issues
CS 155 May 20, 2004 Firewalls Basic Firewall Concept Separate local area net from internet Firewall John Mitchell Credit: some text, illustrations from Simon Cooper Router All packets between LAN and internet
Transport Layer Protocols
Transport Layer Protocols Version. Transport layer performs two main tasks for the application layer by using the network layer. It provides end to end communication between two applications, and implements
Network and Services Discovery
A quick theorical introduction to network scanning January 8, 2016 Disclaimer/Intro Disclaimer/Intro Network scanning is not exact science When an information system is able to interact over the network
Remote Network Analysis
Remote Network Analysis Torsten Hoefler htor@cs.tu-chemnitz.de (DMZ), mostly between two packet filters and application gateways. The different possibilities to connect DMZ-hosts are also shown in Figure
Network Security. Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT)
Network Security ICMP, TCP, DNS, Scanning Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT) Agenda A couple of examples of network protocols that
Why use Scapy? Blue Team. Red Team. Test IDS/IPS Test Firewall Learn more about TCP/IP (down and dirty) Application response(fuzzing)
Scapy What is Scapy Why use Scapy? Important concepts to keep in mind Crafting your first packet Sending and Receiving Packets/Frames Basic examples and dealing with the OS's TCP/IP stack using iptables
A Very Incomplete Diagram of Network Attacks
A Very Incomplete Diagram of Network Attacks TCP/IP Stack Reconnaissance Spoofing Tamper DoS Internet Transport Application HTTP SMTP DNS TCP UDP IP ICMP Network/Link 1) HTML/JS files 2)Banner Grabbing
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,
Ethernet. Ethernet. Network Devices
Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking
Application. Transport. Network. Data Link. Physical. Network Layers. Goal
Layers Goal Understand how application processes set up a connection and exchange messages. Understand how addresses are determined 1 2 Data Exchange Between Processes TCP Connection-Setup Between Processes
IPV6 FRAGMENTATION. The Case For Deprecation. Ron Bonica NANOG58
IPV6 FRAGMENTATION The Case For Deprecation Ron Bonica NANOG58 BACKGROUND 2 Copyright 2013 Juniper Networks, Inc. www.juniper.net STATUS QUO In order to send a packet larger than the PMTU, an IPv6 node
Network Traffic Analysis
2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing
Troubleshooting Tips and Tricks
Troubleshooting Tips and Tricks for TCP/IP Networks June 16, 2011 Laura Chappell Founder Chappell University/Wireshark University laura@chappellu.com SHARKFEST 11 Stanford University June 13 16, 2011 The
Network Security: Workshop. Dr. Anat Bremler-Barr. Assignment #2 Analyze dump files Solution Taken from www.chrissanders.org
1.pcap - File download Network Security: Workshop Dr. Anat Bremler-Barr Assignment #2 Analyze dump files Solution Taken from www.chrissanders.org Downloading a file is a pretty basic function when described
1. Firewall Configuration
1. Firewall Configuration A firewall is a method of implementing common as well as user defined security policies in an effort to keep intruders out. Firewalls work by analyzing and filtering out IP packets
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
Sting: a TCP-based network measurement tool
Sting: a TCP-based network measurement tool Stefan Savage Department of Computer Science and Engineering University of Washington Simple problem Can we measure one-way packet loss rates to and from unmodified
TCP Performance Management for Dummies
TCP Performance Management for Dummies Nalini Elkins Inside Products, Inc. Monday, August 8, 2011 Session Number 9285 Our SHARE Sessions Orlando 9285: TCP/IP Performance Management for Dummies Monday,
Introduction to Cisco IOS Flexible NetFlow
Introduction to Cisco IOS Flexible NetFlow Last updated: September 2008 The next-generation in flow technology allowing optimization of the network infrastructure, reducing operation costs, improving capacity
Load Balancing and Sessions. C. Kopparapu, Load Balancing Servers, Firewalls and Caches. Wiley, 2002.
Load Balancing and Sessions C. Kopparapu, Load Balancing Servers, Firewalls and Caches. Wiley, 2002. Scalability multiple servers Availability server fails Manageability Goals do not route to it take servers
Networking Test 4 Study Guide
Networking Test 4 Study Guide True/False Indicate whether the statement is true or false. 1. IPX/SPX is considered the protocol suite of the Internet, and it is the most widely used protocol suite in LANs.
CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
Transport Layer. Chapter 3.4. Think about
Chapter 3.4 La 4 Transport La 1 Think about 2 How do MAC addresses differ from that of the network la? What is flat and what is hierarchical addressing? Who defines the IP Address of a device? What is
Introduction to Firewalls Open Source Security Tools for Information Technology Professionals
Introduction to Firewalls Open Source Security Tools for Information Technology Professionals School of Professional Studies (SPS) The City University of New York (CUNY) Aron Trauring Adjunct Professor
Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets)
Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets) The diagram below illustrates four routers on the Internet backbone along with two companies that have gateways for their internal
Lecture 5: Network Attacks I. Course Admin
Lecture 5: Network Attacks I CS 336/536: Computer Network Security Fall 2013 Nitesh Saxena Adopted from previous lectures by Keith Ross Course Admin HW/Lab 1 Due Coming Monday 11am Lab sessions are active
La couche transport dans l'internet (la suite TCP/IP)
La couche transport dans l'internet (la suite TCP/IP) C. Pham RESO-LIP/INRIA Université Lyon 1 http://www.ens-lyon.fr/~cpham Basé sur les transparent de Shivkumar Kalyanaraman La couche transport dans
FIREWALLS & CBAC. philip.heimer@hh.se
FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning
IP network tools & troubleshooting. AFCHIX 2010 Nairobi, Kenya October 2010
IP network tools & troubleshooting AFCHIX 2010 Nairobi, Kenya October 2010 Network configuration Reminder, configure your network in /etc/ rc.conf ( x = your IP, from.10 to...) ifconfig_bge0= 41.215.76.x/24
Ignoring the Great Firewall of China
An Overview of Ignoring the Great Firewall of China By: Matt Landau Original Paper: Ignoring the Great Firewall of China Richard Clayton, Steven J. Murdoch, and Robert N. M. Watson University of Cambridge,
ICOM 5026-090: Computer Networks Chapter 6: The Transport Layer. By Dr Yi Qian Department of Electronic and Computer Engineering Fall 2006 UPRM
ICOM 5026-090: Computer Networks Chapter 6: The Transport Layer By Dr Yi Qian Department of Electronic and Computer Engineering Fall 2006 Outline The transport service Elements of transport protocols A
La couche transport dans l'internet (la suite TCP/IP)
La couche transport dans l'internet (la suite TCP/IP) C. Pham Université de Pau et des Pays de l Adour Département Informatique http://www.univ-pau.fr/~cpham Congduc.Pham@univ-pau.fr Cours de C. Pham,
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Stateful Firewalls. Hank and Foo
Stateful Firewalls Hank and Foo 1 Types of firewalls Packet filter (stateless) Proxy firewalls Stateful inspection Deep packet inspection 2 Packet filter (Access Control Lists) Treats each packet in isolation