Attacking the Network Time Protocol (NTP)
|
|
|
- Jeremy Dennis Garrison
- 5 years ago
- Views:
Transcription
1 NDSS, 2016 Attacking the Network Time Protocol (NTP) Aanchal Malhotra Isaac E. Cohen, Erik Brakke Sharon Goldberg
2 Outline of the talk Background How does NTP work? How does NTP take time? Our attacks Denial of Service by Spoofed Kiss-of-Death (off-path) Denial of Service by Priming the Pump (off-path) Timeshifting by IPv4 Packet Fragmentation (off-path) off-path attacker
3 Background: How does NTP work? Stratum 3 Stratum 2 Stratum 1 1 ntp.conf Sends Every host queries can at act randomized as both & adaptively-selected and the intervals Requires My laptop certain will answer number queries of self-consistent from public Internet responses to update its clock
4 We assume NTP messages are not cryptographically authenticated. (Ask me why after.) We attack the NTPv4 spec (RFC5905) and its reference implementation (ntpd v4.2.8p2 & ntpd v4.2.6p5)
5 Non-Crypto Authentication with Origin Timestamp (T 1 ) TEST2: Match T3 in Query to T1 in Response. How much entropy Off-path is in attacker Origin Timestamp (T 1 )? 32 bits! Analogous to - UDP source port randomization - TCP sequence no randomization v4 IHL=20 TOS Total length = 76 IPID x DF MF Frag Offset TTL Protocol = 17 IP Header Checksum Source IP Destination IP Source Port = 123 Destination Port = 123 Length = 76 UDP Checksum LI v4 Response Stratum Poll Precision Root Delay Root Dispersion Reference ID *ntpd does not randomize UDP source port! Reference Timestamp T 1 = Origin Timestamp T 2 = Receive Timestamp T 3 = Transmit Timestamp
6 Outline of the talk Background How does NTP work? How does NTP take time? Our attacks Denial of Service by Spoofed Kiss-of-Death (off-path) Denial of Service by Priming the Pump (off-path) Timeshifting by IPv4 packet fragmentation (off-path) Off-path attacker
7 Denial of Service via Spoofed Kiss-o-Death One packet prevents from querying its s for days or years! v4 IHL=20 TOS Total length = 76 1 TTL Protocol = 17 IP Header Checksum Source IP Destination IP Source Port = 123 Destination Port = 123 Length = 76 UDP Checksum LI v4 Response Stratum Poll 2 Kiss-o -Death (KoD) Keep quiet for 2 poll 17 sec! (36 hours!) Root Delay Root Dispersion Reference ID = RATE Reference Timestamp = Jan 1, :00:00 UTC TEST2? T 1 = Origin Timestamp = July 29, :23:45 T 2 = Receive Timestamp = July 29, :23:45 3 T 3 = Transmit Timestamp = July 29, :23:45
8 How to learn the s IP for the spoofed KoD? v4 IHL=20 TOS Total length = 76 TTL Protocol = 17 IP Header Checksum Source IP = Destination IP = attacker Source Port = 123 Destination Port = 123 Length = 76 UDP Checksum An attacker can deactivate Response Stratum Poll NTP for Root the Delay whole Internet Root Dispersion within hours / days with one Reference machine! ID = IP Reference Timestamp = Aug 18, :40:23 AM T 1 = Origin Timestamp = Aug 18, 2015, 4:59:55 AM T 2 = Receive Timestamp = Aug 18, 2015, 4:59:56 AM T 3 = Transmit Timestamp = Aug 18, 2015, 4:59:56 AM
9 Denial of Service by Priming-the-Pump 1. Denial of Service by Spoofed Kiss-of- Death (off-path) Patched! ntpd 4.2.8p4 2. Denial of Service by Priming the Pump (off-path)
10 Outline of the talk Background How does NTP work? How does NTP take time? Our attacks Denial of Service by Spoofed Kiss-of-Death (off-path) Denial of Service by Priming the Pump (off-path) Timeshifting by IPv4 packet fragmentation (off-path) Off-path attacker
11 Background: IPv4 Packet Fragmentation IPID=1 IPID=1 Frag1 X bytes network element IPID=1 Frag2 buffer
12 How Our Attacker Uses IPv4 Packet Fragmentation? IPID=1 Origin Timestamp buffer 52 bytes 8 bytes 16 bytes LF1 IPID=1 LF2 68 bytes 8 bytes ICMP fragmentation needed to 68 bytes IPID=1 SF1 52 bytes IPID=1 SF2 16 bytes Off-path attacker
13 Reassembled Packet T 1 T 2 T 2 T 1 = - 10 years + 52 sec Key Challenge: Pass TEST2! Craft a stream of packets where T 2 -T 1 is consistent within 1 sec! T 3 v4 IHL=20 TOS Total length = 76 IPID x DF MF Frag Offset Protocol = 17 Source IP Destination IP IP Header Checksum Source Port = 123 Destination Port = 123 Length = 76 UDP Checksum = 0 LI v4 response Stratum Poll Precision=-29 Root Delay = Root Dispersion = Reference ID Reference Timestamp = 22 Feb 2016, 2:50:30 PM T 1 = Origin Timestamp = 22 Feb 2016, 2:50:30 PM T 2 = Receive Timestamp = 22 Feb 2006, 2:51:22 PM T 3 = Transmit Timestamp = 22 Feb 2006, 2:51:54 PM
14 Conditions for the Attack Server must fragment NTP packets to 68 bytes - Scanned 13M s - About 24K s were willing to fragment to 68-byte Client reassembles overlapping fragments according to First policy - The prefers fragments that arrive earliest (We can not safely measure because of teardrop [CA ]) Server uses incrementing IPID - attacker can infer IPID using techniques explained in [Gilad, Herzberg 2013] and [Knockell, Crandall 2014]
15 Summary, Recommendations & Impact Attack: DoS by spoofed KoD: Rec: Implement TEST2 (patched in v4.2.8p4 & NTPSec & Cisco & RedHat Linux etc.) Attack: DoS by priming the pump: Rec: Authentication in both directions (IETF Network Time Security draft updated) & Rate limit like Response Rate Limiting (RRL) in DNS (under discussion) Attack: Time shifting by IPv4 Packet Fragmentation: Rec: Server should not fragment to 68 bytes (Test your on our site) Clients should drop overlapping fragments Other recommendations: Stop my laptop from answering timing queries More work on cryptography for NTP
16 Thank You! Questions?
Complex Paths and Derelict Sentinels software engineering underpinnings of recent NTP vulnerabilities
Complex Paths and Derelict Sentinels software engineering underpinnings of recent NTP vulnerabilities Matthew Van Gundy Technical Leader, Cisco Advanced Security Initiatives Group
Impact of security vulnerabilities in timing protocols on Domain Name System (DNS)
November 12 2017 IEPG Open Meeting-IETF100 Impact of security vulnerabilities in timing protocols on Domain Name System (DNS) Aanchal Malhotra 1, Willem Toorop 2, Benno Overeinder 2, Sharon Goldberg 1
Security Evaluation of NTP
Security Evaluation of NTP Matthew Van Gundy Technical Leader, Cisco Advanced Security Initiatives Group (ASIG) Linux Collaboration Summit 2016 Who Are We? Cisco ASIG: ~70 Hardware
Packet Header Formats
A P P E N D I X C Packet Header Formats S nort rules use the protocol type field to distinguish among different protocols. Different header parts in packets are used to determine the type of protocol used
HP 6125 Blade Switch Series
HP 6125 Blade Switch Series Network Management and Monitoring Configuration Guide Part number: 5998-3162 Software version: Release 2103 Document version: 6W100-20120907 Legal and notice information Copyright
HP 6125G & 6125G/XG Blade Switches
HP 6125G & 6125G/XG Blade Switches Network Management and Monitoring Configuration Guide Part number: 5998-3162b Software version: Release 2103 and later Document version: 6W103-20151020 Legal and notice
Network Time Security
Network Time Security draft-ietf-ntp-network-time-security-11 draft-ietf-ntp-using-nts-for-ntp-02 draft-ietf-ntp-cms-for-nts-message-04 Dr. Dieter Sibold Kristof Teichel Stephen Röttger IETF 94 (Yokohama,
The Security of NTP s Datagram Protocol
The Security of NTP s Datagram Protocol Aanchal Malhotra, Matthew Van Gundy, Mayank Varia, Haydn Kennedy, Jonathan Gardner, Sharon Goldberg Boston University Cisco (ASIG) Abstract. For decades, the Network
CS 3516: Computer Networks
Welcome to CS 3516: Computer Networks Prof. Yanhua Li Time: 9:00am 9:50am M, T, R, and F Location: AK 219 Fall 2018 A-term 1 Some slides are originally from the course materials of the textbook Computer
Ref: A. Leon Garcia and I. Widjaja, Communication Networks, 2 nd Ed. McGraw Hill, 2006 Latest update of this lecture was on
IP Version 4 (IPv4) Header (Continued) Identification (16 bits): One of the parameters of any network is the maximum transmission unit (MTU) parameter. This parameter specifies the maximum size of the
CS 3516: Advanced Computer Networks
Welcome to CS 3516: Advanced Computer Networks Prof. Yanhua Li Time: 9:00am 9:50am M, T, R, and F Location: Fuller 320 Fall 2017 A-term 1 Some slides are originally from the course materials of the textbook
IP : Internet Protocol
1/20 IP : Internet Protocol Surasak Sanguanpong nguan@ku.ac.th http://www.cpe.ku.ac.th/~nguan Last updated: July 30, 1999 Agenda 2/20 IP functions IP header format Routing architecture IP layer 3/20 defines
Internet Networking recitation #2 IP Checksum, Fragmentation
Internet Networking recitation #2 IP Checksum, Fragmentation Winter Semester 2012, Dept. of Computer Science, Technion 1 IP Header Diagram Ver. IHL TOS Total Length Identification Flags Fragment Offset
Telecom Systems Chae Y. Lee. Contents. Overview. Issues. Addressing ARP. Adapting Datagram Size Notes
Internetworking Contents Overview Functions Issues Basic Delivery Unit Addressing Datagram Delivery ARP IPv4 Header Adapting Datagram Size Notes 2 Overview - Example 3 Direct Delivery 4 Indirect Delivery
Veryx ATTEST TM. Sample Test cases Overview. Conformance Test Suite. Internet Protocol version 4 (IPv4) Part Number: T / TCLS IPv /1.
Veryx ATTEST TM Conformance Test Suite Internet Protocol version 4 (IPv4) Sample Test cases Overview Part Number: T / TCLS IPv4 1.0-1110/1.0 This page is intentionally left blank. Introduction The Veryx
Chapter 4 Network Layer: The Data Plane. Part A. Computer Networking: A Top Down Approach
Chapter 4 Network Layer: The Data Plane Part A All material copyright 996-06 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th Edition, Global Edition Jim Kurose,
CSE/EE 461 The Network Layer. Application Presentation Session Transport Network Data Link Physical
CSE/EE 461 The Network Layer Application Presentation Session Transport Network Data Link Physical This Lecture Focus: What to do when one wire isn t big enough? Point to point link Broadcast link (Ethernet
Network Time Protocol
(NTP) is a protocol designed to time-synchronize a network of machines. NTP runs on User Datagram Protocol (UDP), which in turn runs on IP. NTP Version 3 is documented in RFC 1305. This module describes
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Chapter 5 OSI Network Layer
Chapter 5 OSI Network Layer The protocols of the OSI model Network layer specify addressing and processes that enable Transport layer data to be packaged and transported. The Network layer encapsulation
Understanding Zone and DoS Protection Event Logs and Global Counters
Understanding Zone and DoS Protection Event Logs and Global Counters Revision C 2015, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Threat Events for Zone and DoS Activity Monitoring...
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
IPv4 Lecture 10a. COMPSCI 726 Network Defence and Countermeasures. Muhammad Rizwan Asghar. August 14, 2017
IPv4 Lecture 10a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 14, 2017 Source of some slides: Princeton University Also thanks to J.F Kurose and K.W. Ross IPv4 Internet
inside: THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN
THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 inside: SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN & The Advanced Computing Systems Association & The System Administrators
Lecture 9: Internetworking
Lecture 9: Internetworking CSE 123: Computer Networks Alex C. Snoeren HW 2 due WEDNESDAY So what does IP do? Addressing Fragmentation E.g. FDDI s maximum packet is 4500 bytes while Ethernet is 1500 bytes,
OSI Network Layer. Network Fundamentals Chapter 5. Version Cisco Systems, Inc. All rights reserved. Cisco Public 1
OSI Network Layer Network Fundamentals Chapter 5 Version 4.0 1 Objectives Identify the role of the Network Layer, as it describes communication from one end device to another end device. Examine the most
Chapter 5 Network Layer
Chapter 5 Network Layer Network Layer IPv4 2 IP Header Application Header + data 3 IP IP IP IP 4 Focus on Transport Layer IP IP 5 Network Layer The Network layer (Layer 3) provides services to exchange
Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path. Review of TCP/IP Internetworking
1 Review of TCP/IP working Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path Frame Path Chapter 3 Client Host Trunk Link Server Host Panko, Corporate
DDoS Testing with XM-2G. Step by Step Guide
DDoS Testing with XM-G Step by Step Guide DDoS DEFINED Distributed Denial of Service (DDoS) Multiple compromised systems usually infected with a Trojan are used to target a single system causing a Denial
CompSci 356: Computer Network Architectures. Lecture 8: Spanning Tree Algorithm and Basic Internetworking Ch & 3.2. Xiaowei Yang
CompSci 356: Computer Network Architectures Lecture 8: Spanning Tree Algorithm and Basic Internetworking Ch 3.1.5 & 3.2 Xiaowei Yang xwy@cs.duke.edu Review Past lectures Single link networks Point-to-point,
! ' ,-. +) +))+, /+*, 2 01/)*,, 01/)*, + 01/+*, ) 054 +) +++++))+, ) 05,-. /,*+), 01/-*+) + 01/.*+)
! "#! # $ %& #! '!!!( &!)'*+' '(,-. +) /,*+), 01/-*+) + 01/.*+) ) 05,-. +))+, /+*, 2 01/)*,, 01/)*, + 01/+*, ) 054 +) +++++))+,3 4 +. 6*! ) ) ) ) 5 ) ) ) ) + 5 + + ) ) ) 5 9 + ) ) + 5 4 ) ) + ) 5, ) )
CS519: Computer Networks. Lecture 2: Feb 2, 2004 IP (Internet Protocol)
: Computer Networks Lecture 2: Feb 2, 2004 IP (Internet Protocol) A hypothetical service You want a mail delivery service You have two choices: Acme Guaranteed Mail Delivery Service We never fail Rocko
Table of Contents 1 NTP Configuration 1-1
Table of Contents 1 NTP Configuration 1-1 NTP Overview 1-1 Applications of NTP 1-1 Advantages of NTP 1-2 How NTP Works 1-2 NTP Message Format 1-3 Operation Modes of NTP 1-5 NTP Configuration Task List
Internet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
Operation Manual NTP. Table of Contents
Table of Contents Table of Contents... 1-1 1.1 NTP Overview... 1-1 1.1.1 Applications of NTP... 1-1 1.1.2 How NTP Works... 1-2 1.1.3 NTP Message Format... 1-4 1.1.4 Operation Modes of NTP... 1-5 1.1.5
Ping of death Land attack Teardrop Syn flood Smurf attack. DOS Attack Methods
Ping of death Land attack Teardrop Syn flood Smurf attack DOS Attack Methods Ping of Death A type of buffer overflow attack that exploits a design flaw in certain ICMP implementations where the assumption
CIS-331 Final Exam Spring 2016 Total of 120 Points. Version 1
Version 1 1. (25 Points) Given that a frame is formatted as follows: And given that a datagram is formatted as follows: And given that a TCP segment is formatted as follows: Assuming no options are present
Packetization Layer Path Maximum Transmission Unit Discovery (PLPMTU) For IPsec Tunnels
Packetization Layer Path Maximum Transmission Unit Discovery (PLPMTU) For IPsec Tunnels draft-spiriyath-ipsecme-dynamic-ipsec-pmtu-01 Shibu Piriyath, Umesh Mangla, Nagavenkata Suresh Melam, Ron Bonica
Your Name: Your student ID number:
CSC 573 / ECE 573 Internet Protocols October 11, 2005 MID-TERM EXAM Your Name: Your student ID number: Instructions Allowed o A single 8 ½ x11 (front and back) study sheet, containing any info you wish
Network Layer (1) Networked Systems 3 Lecture 8
Network Layer (1) Networked Systems 3 Lecture 8 Role of the Network Layer Application Application The network layer is the first end-to-end layer in the OSI reference model Presentation Session Transport
Internet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) 1 Overview The IP (Internet Protocol) relies on several other protocols to perform necessary control and routing functions: Control functions (ICMP) Multicast signaling
Internet Protocol version 6
Internet Protocol version 6 Claudio Cicconetti International Master on Communication Networks Engineering 2006/2007 IP version 6 The Internet is growing extremely rapidly. The
Chapter 4 Network Layer: The Data Plane
Chapter 4 Network Layer: The Data Plane A note on the use of these Powerpoint slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you see
Lecture 18 Overview. Last Lecture. This Lecture. Next Lecture. Internet Protocol (1) Internet Protocol (2)
Last Lecture Internet Protocol (1) This Lecture Internet Protocol (2) Lecture 18 Overview Source: chapters 19.1, 19.2, 22,1 22.2, 26.6 Next Lecture Transport Control Protocol (1) Source: chapters 24.1,
Basic System Management Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
Basic System Management Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) Network Time Protocol 2 Finding Feature Information 2 Restrictions for Network Time Protocol 2 Information
The Internet Protocol (IP)
The Internet Protocol (IP) The Blood of the Internet (C) Herbert Haas 2005/03/11 "Information Superhighway is really an acronym for 'Interactive Network For Organizing, Retrieving, Manipulating, Accessing
(ICMP), RFC
Internet et Control o Message Protocol (ICMP), RFC 792 http://icourse.cuc.edu.cn/networkprogramming/ linwei@cuc.edu.cn Nov. 2009 Overview The IP (Internet Protocol) relies on several other protocols to
CSC 6575: Internet Security Fall Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers
CSC 6575: Internet Security Fall 2017 Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee
Quiz. Segment structure and fields Flow control (rwnd) Timeout interval. Phases transition ssthresh setting Cwnd setting
Quiz v 10/30/2013 (Wednesday), 20 mins v Midterm question (available on website) v TCP basics Segment structure and fields Flow control (rwnd) Timeout interval v TCP Congestion control Phases transition
Using ICMP to Troubleshoot TCP/IP Networks
Laura Chappell Using ICMP to Troubleshoot TCP/IP Networks Illustration: Norman Felchle Editor s Note: This article is based on Laura Chappell s upcoming book TCP/IP Analysis and Troubleshooting, which
K2289: Using advanced tcpdump filters
K2289: Using advanced tcpdump filters Non-Diagnostic Original Publication Date: May 17, 2007 Update Date: Sep 21, 2017 Topic Introduction Filtering for packets using specific TCP flags headers Filtering
Internet Control Message Protocol (ICMP), RFC 792. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC
Internet Control Message Protocol (ICMP), RFC 79 Prof Lin Weiguo Copyleft 009~07, School of Computing, CUC Oct 07 Overview } The IP (Internet Protocol) relies on several other protocols to perform necessary
Fixed Internetworking Protocols and Networks. IP mobility. Rune Hylsberg Jacobsen Aarhus School of Engineering
Fixed Internetworking Protocols and Networks IP mobility Rune Hylsberg Jacobsen Aarhus School of Engineering rhj@iha.dk 1 2011 ITIFN Mobile computing Vision Seamless, ubiquitous network access for mobile
Operational Security Capabilities for IP Network Infrastructure
Operational Security Capabilities F. Gont for IP Network Infrastructure G. Gont (opsec) UTN/FRH Internet-Draft September 1, 2008 Intended status: Informational Expires: March 5, 2009 Status of this Memo
CIS-331 Final Exam Fall 2015 Total of 120 Points. Version 1
Version 1 1. (25 Points) Given that a frame is formatted as follows: And given that a datagram is formatted as follows: And given that a TCP segment is formatted as follows: Assuming no options are present
IP - The Internet Protocol. Based on the slides of Dr. Jorg Liebeherr, University of Virginia
IP - The Internet Protocol Based on the slides of Dr. Jorg Liebeherr, University of Virginia Orientation IP (Internet Protocol) is a Network Layer Protocol. IP: The waist of the hourglass IP is the waist
Networks. an overview. dr. C. P. J. Koymans. Informatics Institute University of Amsterdam. February 4, 2008
Networks an overview dr. C. P. J. Koymans Informatics Institute University of Amsterdam February 4, 2008 dr. C. P. J. Koymans (UvA) Networks February 4, 2008 1 / 53 1 Network modeling Layered networks
EE 610 Part 2: Encapsulation and network utilities
EE 610 Part 2: Encapsulation and network utilities Objective: After this experiment, the students should be able to: i. Understand the format of standard frames and packet headers. Overview: The Open Systems
EP2120 Internetworking/Internetteknik IK2218 Internets Protokoll och Principer
EP2120 Internetworking/Internetteknik IK2218 Internets Protokoll och Principer Homework Assignment 1 (Solutions due 20:00, Mon., 10 Sept. 2018) (Review due 20:00, Wed., 12 Sept. 2018) 1. IPv4 Addressing
ICS 451: Today's plan
ICS 451: Today's plan ICMP ping traceroute ARP DHCP summary of IP processing ICMP Internet Control Message Protocol, 2 functions: error reporting (never sent in response to ICMP error packets) network
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 12 2/28/08 CIS/TCOM 551 1 Announcements Reminder: Project 2 is due Friday, March 7th at 11:59 pm 2/28/08 CIS/TCOM 551 2 Internet Protocol
Lecture 17 Overview. Last Lecture. Wide Area Networking (2) This Lecture. Internet Protocol (1) Source: chapters 2.2, 2.3,18.4, 19.1, 9.
Lecture 17 Overview Last Lecture Wide Area Networking (2) This Lecture Internet Protocol (1) Source: chapters 2.2, 2.3,18.4, 19.1, 9.2 Next Lecture Internet Protocol (2) Source: chapters 19.1, 19.2, 22,1
IPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
Computer Networks Security: intro. CS Computer Systems Security
Computer Networks Security: intro CS 166 - Computer Systems Security A very easy network 3/14/16 Computer Networks: Intro 2 Two philosophers example Translator Language Translator Engineer Communication
Covert channels in TCP/IP: attack and defence
Covert channels in TCP/IP: attack and defence The creation and detection of TCP/IP steganography for covert channels and device fingerprinting Steven J. Murdoch and Stephen Lewis http://www.cl.cam.ac.uk/users/{sjm217,
Network Layer (4): ICMP
1 Network Layer (4): ICMP Required reading: Kurose 4.4.3, 4.4.4 CSE 4213, Fall 2006 Instructor: N. Vlajic 2 1. Introduction 2. Network Service Models 3. Architecture 4. Network Layer Protocols in the Internet
Administrivia CSC458 Lecture 4 Bridging LANs and IP. Last Time. This Time -- Switching (a.k.a. Bridging)
Administrivia CSC458 Lecture 4 Bridging LANs and IP Homework: # 1 due today # 2 out today and due in two weeks Readings: Chapters 3 and 4 Project: # 2 due next week Tutorial today: Joe Lim on project 2
REVEALING MIDDLEBOXES INTERFERENCE WITH TRACEBOX
REVEALING MIDDLEBOXES INTERFERENCE WITH TRACEBOX Gregory Detal*, Benjamin Hesmans*, Olivier Bonaventure*, Yves Vanaubel and Benoit Donnet. *Université catholique de Louvain Université de Liège http://www.tracebox.org
Implementing NTP. Release 3.8.0
Network Time Protocol (NTP) is a protocol designed to time-synchronize devices within a network. Cisco IOS XR software implements NTPv4. NTPv4 retains backwards compatibility with the older versions of
Internet. 1) Internet basic technology (overview) 3) Quality of Service (QoS) aspects
Internet 1) Internet basic technology (overview) 2) Mobility aspects 3) Quality of Service (QoS) aspects Relevant information: these slides (overview) course textbook (Part H) www.ietf.org (details) IP
Announcements. Designing IP. Our Story So Far (Context) Goals of Today s Lecture. Our Story So Far (Context), Con t. The Internet Hourglass
Announcements Designing IP EE 122: Intro to Communication Networks Fall 200 (MW -:30 in Donner 1) Homework #2 out Wednesday rather than today And due Oct 11 instead of Oct We will likely shift the remaining
Network Time Protocol
Network Time Protocol Last Updated: December 7, 2012 NTP is a protocol designed to time-synchronize a network of machines. NTP runs on UDP, which in turn runs on IP. NTP Version 3 is documented in RFC
µtasker Document µtasker SNTP (Simple Network Time Protocol)
Embedding it better... µtasker Document µtasker SNTP (Simple Network Time Protocol) utaskersntp.doc/v1.00 Copyright 2009 M.J.Butcher Consulting Table of Contents 1. Introduction...3 2. Activating SNTP
Implementing NTPv4 in IPv6
Implementing NTPv4 in IPv6 Last Updated: July 31, 2012 The Network Time Protocol (NTP) is a protocol designed to time-synchronize a network of machines. NTP runs over UDP, which in turn runs over IPv4.
CS Lecture 1 Review of Basic Protocols
CS 557 - Lecture 1 Review of Basic Protocols IP - RFC 791, 1981 TCP - RFC 793, 1981 Spring 2013 These slides are a combination of two great sources: Kurose and Ross Textbook slides Steve Deering IETF Plenary
Module 28 Mobile IP: Discovery, Registration and Tunneling
Module 28 Mobile IP: Discovery, and Tunneling Learning Objectives Introduction to different phases of Mobile IP Understanding how a mobile node search the agents using Discovery process Understand how
Internetworking Terms. Internet Structure. Internet Structure. Chapter 15&16 Internetworking. Internetwork Structure & Terms
Chapter 15&16 Internetworking Internetwork Structure & Terms Internetworking Architecture Features Connection/Connectionless Architecture Fragmentation & Reassembly Internet Protocol & Services Addressing
Communication Systems DHCP
Communication Systems DHCP Computer Science Copyright Warning This lecture is already stolen If you copy it please ask the author Prof. Dr. Gerhard Schneider like I did 2 Internet Protocol the Universal
HP 5920 & 5900 Switch Series
HP 5920 & 5900 Switch Series Network Management and Monitoring Command Reference Part number: 5998-2889 Software version: Release 2210 Document version: 6W100-20131105 Legal and notice information Copyright
EC441 Fall 2018 Introduction to Computer Networking Chapter4: Network Layer Data Plane
EC441 Fall 2018 Introduction to Computer Networking Chapter4: Network Layer Data Plane This presentation is adapted from slides produced by Jim Kurose and Keith Ross for their book, Computer Networking:
HP 6125G & 6125G/XG Blade Switches
HP 6125G & 6125G/XG Blade Switches Network Management and Monitoring Command Reference Part number: 5998-3173b Software version: Release 2103 and later Document version: 6W103-20151020 Legal and notice
The Internet Protocol. IP Addresses Address Resolution Protocol: IP datagram format and forwarding: IP fragmentation and reassembly
The Internet Protocol IP Addresses Address Resolution Protocol: IP datagram format and forwarding: IP fragmentation and reassembly IP Addresses IP Addresses are 32 bit. Written in dotted decimal format:
Each ICMP message contains three fields that define its purpose and provide a checksum. They are TYPE, CODE, and CHECKSUM fields.
IP address ICMP Each ICMP message contains three fields that define its purpose and provide a checksum. They are TYPE, CODE, and CHECKSUM fields. The TYPE field identifies the ICMP message, the CODE field
Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University
Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University Why ICMP? UDP and TDP are not designed to report errors Provide a simple way to report errors between
ECE 158A: Lecture 7. Fall 2015
ECE 158A: Lecture 7 Fall 2015 Outline We have discussed IP shortest path routing Now we have a closer look at the IP addressing mechanism We are still at the networking layer, we will examine: IP Headers
Network Layer: Control/data plane, addressing, routers
Network Layer: Control/data plane, addressing, routers CS 352, Lecture 10 http://www.cs.rutgers.edu/~sn624/352-s19 Srinivas Narayana (heavily adapted from slides by Prof. Badri Nath and the textbook authors)
Synchronization of Network Devices Time by GPS Based Network Time Protocol Output
Synchronization of Network Devices Time by GPS Based Network Time Protocol Output Ajay Rajput Department of Electronics & Communication Engineering Lord Krishna College of Technology, Indore, Madhya Pradesh,
TCP /IP Fundamentals Mr. Cantu
TCP /IP Fundamentals Mr. Cantu OSI Model and TCP/IP Model Comparison TCP / IP Protocols (Application Layer) The TCP/IP subprotocols listed in this layer are services that support a number of network functions:
Concept Questions Demonstrate your knowledge of these concepts by answering the following questions in the space that is provided.
223 Chapter 19 Inter mediate TCP The Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols was developed as part of the research that the Defense Advanced Research Projects Agency
Scribe Notes -- October 31st, 2017
Scribe Notes -- October 31st, 2017 TCP/IP Protocol Suite Most popular protocol but was designed with fault tolerance in mind, not security. Consequences of this: People realized that errors in transmission
The Internet. 9.1 Introduction. The Internet is a global network that supports a variety of interpersonal and interactive multimedia applications.
The Internet 9.1 Introduction The Internet is a global network that supports a variety of interpersonal and interactive multimedia applications. Associated with each access network - ISP network, intranet,
CSE/EE 461 Lecture 13 Connections and Fragmentation. TCP Connection Management
CSE/EE 461 Lecture 13 Connections and Fragmentation Tom Anderson tom@cs.washington.edu Peterson, Chapter 5.2 TCP Connection Management Setup assymetric 3-way handshake Transfer sliding window; data and
CE 443: Computer Networks
CE 443: Computer Networks Acknowledgments: Lecture slides are from Computer networks course thought by Jennifer Rexford at Princeton University. When slides are obtained from other sources, a a reference
Business Data Networks and Security 10th Edition by Panko Test Bank
Business Data Networks and Security 10th Edition by Panko Test Bank Chapter 2 Network Standards 1) Internet standards are published as. A) RFCs B) IETFs C) TCP/IPs D) Internet Protocols Question: 1a Objective:
QUIZ: Longest Matching Prefix
QUIZ: Longest Matching Prefix A router has the following routing table: 10.50.42.0 /24 Send out on interface Z 10.50.20.0 /24 Send out on interface A 10.50.24.0 /22 Send out on interface B 10.50.20.0 /22
precise rules that govern communication between two parties TCP/IP: the basic Internet protocols IP: Internet protocol (bottom level)
Protocols precise rules that govern communication between two parties TCP/IP: the basic Internet protocols IP: Internet protocol (bottom level) all packets shipped from network to network as IP packets
IPv4. Christian Grothoff.
IPv4 christian@grothoff.org http://grothoff.org/christian/ Sites need to be able to interact in one single, universal space. Tim Berners-Lee 1 The Network Layer Transports datagrams from sending to receiving
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
Network and Security: Introduction
Network and Security: Introduction Seungwon Shin KAIST Some slides are from Dr. Srinivasan Seshan Some slides are from Dr. Nick Mckeown Network Overview Computer Network Definition A computer network or
This talk will cover the basics of IP addressing and subnetting. Topics covered will include:
This talk will cover the basics of IP addressing and subnetting. Topics covered will include: What is an IP Address? What are Classes? What is a Network Address? What are Subnet Masks and Subnet Addresses?