CSE 127: Computer Security Network Security. Kirill Levchenko
|
|
|
- Rosemary Foster
- 5 years ago
- Views:
Transcription
1 CSE 127: Computer Security Network Security Kirill Levchenko November 28, 2017
2 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties 15 years ago: Hosts can t be trusted Anyone can connect to public Internet Untrusted insiders on internal networks Today: Network can t be trusted either Wifi has taken the last shred of trust we had in network
3 Trust that Network protocols used only as intended Packet headers filled out correctly Rate limiting of costly operations Hosts controlled by trusted administrators Control of access to network by untrusted parties Correct information reported by hosts Protocols implemented correctly
4 Attacker Models Man in the middle: can see, block, and modify traffic Attacker controls wifi access point Passive: Eavesdrop on traffic Attacker has passive tap or recorded traces Off-path: attacker can inject traffic into network Anyone with access to network
5 Secrecy Who can see the packets you send? Network (routers, switches, access points, etc.) Unprotected WiFi network: everyone WPA2 Personal (PSK): everyone on same network Non-switched Ethernet: everyone on same network Switched Ethernet: maybe everyone on same network
6 No Authentication TCP/IP offers no authentication of packets Source address in IP header set by sender Attacker with direct access to network (including MitM) can spoof source address Spoof: forge, set to arbitrary value Connectionless protocols (UDP) especially vulnerable
7 TCP Connection Spoofing A B E What prevents Eve from impersonating Alice to Bob? (Assume alice has direct network access)
8 TCP Connection Spoofing Eve needs to complete the TCP three-way handshake between Alice and Bob Eve can t see traffic between Alice and Bob TCP off-path attack
9 Three-Way Handshake source: Wikipedia
10 Three-Way Handshake Eve does not see Bob s response source: Wikipedia
11 TCP Connection Spoofing Eve needs to complete the TCP three-way handshake between Alice and Bob Eve can t see traffic between Alice and Bob TCP off-path attack Eve needs to guess initial sequence number y in order to correctly ACK Bob s SYN
12 source: nmap.org
13 TCP Connection Spoofing The sequence number field is 32 bits Early implementations just incremented a global counter used to initialize sequence numbers for TCP connections RFC 793 requires counter incrementing every 4 µs (250 khz) Early BSD kernels incremented by a large constant every second Later pseudo-random number generators were used PRNGs were still global, weaknesses allowed guessing
14 TCP Connection Spoofing Kevin Mitnick caught (in part) because of TCP spoofing attack Mitnick attacked Tsutomu Shimomura s computers in San Diego
15
16 Network Routing (Host View) Say I want to send packet to Step 1: Is host on local network? Check subnet masks of local networks
17
18 Network Routing (Host View) Say I want to send packet to Step 1: Is host on local network? Local: send directly Not local: send via default gateway
19
20 Network Routing (Host View) Say I want to send packet to Step 1: Is host on local network? Local: send directly Not local: send via default gateway Step 2: Create IP packet Step 3: Create link layer (e.g. Ethernet) packet
21 Local Network Attacks Ethernet frame: Host needs to fill in Ethernet destination address MAC address of host on local network MAC address of gateway for host not on local network
22 ARP Hosts know only IP address of hosts on local network Need a way to associate IP addresses with link-layer addresses (e.g. Ethernet MAC addresses) Address Resolution Protocol (ARP) used to query hosts on local network to get MAC address for an IP address
23 ARP Alice (looking for Bob s IP) broadcasts: What is the MAC address of ? Bob sees broadcast and replies: The MAC address of is 01:02:03:04:05:06. Alice sends IP packet for in an Ethernet frame to 01:02:03:04:05:06.
24 ARP operation (case: destination is on the same physical network) 7-4 Link The MAC address of destination is broadcast address: 0xFFFFFFFFFFFF IP = McGraw-Hill The McGraw-Hill Companies, Inc., 2000
25 (Ethernet = 6) ARP packet (Ethernet = 1) IPv4 = 4 4 bytes IPv4 = 0x Opcode (1 = request, 2 = reply) 18 byte padding (to make frame payloads equal to 46 bytes) McGraw-Hill The McGraw-Hill Companies, Inc., 2000
26 ARP in Action % sudo tcpdump -v -n -i en0 tcpdump: listening on en0, link-type EN10MB (Ethernet), capture size bytes 10:18: ARP, Ethernet (len 6), IPv4 (len 4), Request who-has tell , length 46 10:18: ARP, Ethernet (len 6), IPv4 (len 4), Request who-has tell , length 46 10:18: IP (tos 0x0, ttl 111, id 1534, offset 0, flags [none], proto UDP ( > : UDP, length 101 % arp -a cse-hazard-gateway.ucsd.edu ( ) at 10:8c:cf:57:10:0 on en0 ifscope [ethernet] xor.ucsd.edu ( ) at 0:1b:21:42:80:20 on en0 ifscope [ethernet] cselab1.ucsd.edu ( ) at 0:22:19:58:2d:d on en0 ifscope [ethernet] 3dic.ucsd.edu ( ) at d4:be:d9:ca:a2:16 on en0 ifscope [ethernet] coke.ucsd.edu ( ) at 0:1c:c4:d:90:a8 on en0 ifscope [ethernet]
27 ARP Spoofing Anyone can send an ARP reply Attacker on the network can impersonate any other host Mitigation Fixed ARP tables: impractical for all but small fixed networks Port binding on switch: restrict MAC and IP addresses allowed on a physical port switch Higher level host authentication E.g. SSH or SSL
28 DNS Resolution Say I want to send packet to Need IP address for DNS: distributed system for resolving domain names Resolve: translate domain name to IP address
29
30 source:
31 DNS in Action % dig +qr bob.ucsd.edu ; <<>> DiG 9.6-ESV-R4-P3 <<>> +qr bob.ucsd.edu ;; global options: +cmd ;; Sending: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;bob.ucsd.edu.!!! IN! A
32 DNS in Action ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 6 ;; QUESTION SECTION: ;bob.ucsd.edu.!!! IN! A ;; ANSWER SECTION: bob.ucsd.edu.!! 3600! IN! A! ;; AUTHORITY SECTION: ucsd.edu.!! 3600! IN! NS! ns0.ucsd.edu. ucsd.edu.!! 3600! IN! NS! ns1.ucsd.edu. ucsd.edu.!! 3600! IN! NS! ns2.ucsd.edu. ;; ADDITIONAL SECTION: ns0.ucsd.edu.!! 3600! IN! A! ns0.ucsd.edu.!! 3600! IN! AAAA! 2607:f720:100:100::231 ns1.ucsd.edu.!! 3600! IN! A! ns1.ucsd.edu.!! 3600! IN! AAAA! 2607:f720:300:202::102 ns2.ucsd.edu.!! 3600! IN! A! ns2.ucsd.edu.!! 3600! IN! AAAA! 2607:f720:300:202::52 ;; Query time: 0 msec
33 DNS DNS uses UDP as transport No authentication of content Attacker can spoof a reply Off-path: need to know port and identifier
34 DNS Packet
35 SSL Does SSL protect against ARP poisoning attacks? Does SSL protect against DNS spoofing attacks?
36 Certificate Semantics Issuer (CA) attests: Public key belongs to subject C=US, ST=California, L=La Jolla, O=University of California, San Diego, OU=ACT Data Center, CN=*.ucsd.edu The domain listed in CN belongs to subject Certificate has expiration and limitations on use
37 Data: Version: 3 (0x2) Serial Number: 0f:77:30:d4:eb:75:d6:c4:22:1e:4b:a1:f6:16:2b:83 Signature Algorithm: sha1withrsaencryption Issuer: C=US, O=DigiCert Inc, OU= CN=DigiCert High Assurance CA-3 Validity Not Before: Sep 7 00:00: GMT Not After : Nov 11 12:00: GMT Subject: C=US, ST=California, L=La Jolla, O=University of California, San Diego, OU=ACT Data Center, CN=*.ucsd.edu Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:cf:73:a9:a0:dd:69:de:98:c5:65:2d:fa:c0:dc: 47:ed:ff:f9:0b:16:3a:ee:e4:74:6a:de:26:37:7b: ce:f7:de:3e:50:25:13:49:23:ec:c8:b3:19:5f:05: 9e:05:72:41:a9:f7:26:b3:d2:bd:88:37:51:e8:d5: c3:01:d9:c2:15:bf:eb:87:a3:4b:80:3b:6c:f6:ce: c5:78:4c:d2:b3:24:af:3d:8b:d8:ba:b9:c9:eb:16: b4:83:68:06:b6:1e:96:0e:2e:1c:78:91:41:b4:8d: 3c:fe:2a:f5:93:ac:e5:bd:98:78:e5:db:4a:c2:88: 46:3a:1f:1e:07:fd:79:8a:96:c7:e9:b7:05:4d:40: 5d:4d:52:2c:e4:bc:6b:eb:2c:3e:09:e1:27:49:1b: 46:ab:53:cf:d9:df:8f:35:74:b4:40:1f:0b:7f:c1:
38 SSL/TLS and DNSSEC Only host with private key for bob.ucsd.edu will be able to complete SSL/TLS handshake Certificate ensures that rightful owner of bob.ucsd.edu has key DNSSEC: Signed DNS records How do you authenticate the non-existence of a record?
ARP, IP, TCP, UDP. CS 166: Introduction to Computer Systems Security 4/7/18 ARP, IP, TCP, UDP 1
ARP, IP, TCP, UDP CS 166: Introduction to Computer Systems Security 4/7/18 ARP, IP, TCP, UDP 1 IP and MAC Addresses Devices on a local area network have IP addresses (network layer) MAC addresses (data
Internet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
Packet Header Formats
A P P E N D I X C Packet Header Formats S nort rules use the protocol type field to distinguish among different protocols. Different header parts in packets are used to determine the type of protocol used
NETWORK INTRUSION. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006
NETWORK INTRUSION Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Recognize different
Network Attacks. CS Computer Security Profs. Vern Paxson & David Wagner
Network Attacks CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John Bethencourt, Erika Chin, Matthew Finifter, Cynthia Sturton, Joel Weinberger http://inst.eecs.berkeley.edu/~cs161/
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
ELEC5616 COMPUTER & NETWORK SECURITY
ELEC5616 COMPUTER & NETWORK SECURITY Lecture 17: Network Protocols I IP The Internet Protocol (IP) is a stateless protocol that is used to send packets from one machine to another using 32- bit addresses
CSc 466/566. Computer Security. 18 : Network Security Introduction
1/81 CSc 466/566 Computer Security 18 : Network Security Introduction Version: 2012/05/03 13:57:28 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian Collberg
Computer Networks. Wenzhong Li. Nanjing University
Computer Networks Wenzhong Li Nanjing University 1 Chapter 7. Network Security Network Attacks Cryptographic Technologies Message Integrity and Authentication Key Distribution Firewalls Transport Layer
K2289: Using advanced tcpdump filters
K2289: Using advanced tcpdump filters Non-Diagnostic Original Publication Date: May 17, 2007 Update Date: Sep 21, 2017 Topic Introduction Filtering for packets using specific TCP flags headers Filtering
CIT 380: Securing Computer Systems. Network Security Concepts
CIT 380: Securing Computer Systems Network Security Concepts Topics 1. Protocols and Layers 2. Layer 2 Network Concepts 3. MAC Spoofing 4. ARP 5. ARP Spoofing 6. Network Sniffing Protocols A protocol defines
Introduction to Network. Topics
Introduction to Network Security Chapter 7 Transport Layer Protocols 1 TCP Layer Topics Responsible for reliable end-to-end transfer of application data. TCP vulnerabilities UDP UDP vulnerabilities DNS
CSC 574 Computer and Network Security. TCP/IP Security
CSC 574 Computer and Network Security TCP/IP Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) Network Stack, yet again Application Transport Network
IPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers
Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled
Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks
Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks In an ARP spoofing attack, the attacker associates its own MAC address with the IP address of a network device
TCP TCP/IP: TCP. TCP segment. TCP segment. TCP encapsulation. TCP encapsulation 1/25/2012. Network Security Lecture 6
TCP TCP/IP: TCP Network Security Lecture 6 Based on IP Provides connection-oriented, reliable stream delivery service (handles loss, duplication, transmission errors, reordering) Provides port abstraction
Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
Internet Infrastructure
Internet Infrastructure Internet Infrastructure Local and inter-domain routing TCP/IP for routing and messaging BGP for routing announcements Domain Name System Find IP address from symbolic name (www.cc.gatech.edu)
ICS 451: Today's plan
ICS 451: Today's plan ICMP ping traceroute ARP DHCP summary of IP processing ICMP Internet Control Message Protocol, 2 functions: error reporting (never sent in response to ICMP error packets) network
Internet Protocol and Transmission Control Protocol
Internet Protocol and Transmission Control Protocol CMSC 414 November 13, 2017 Internet Protcol Recall: 4-bit version 4-bit hdr len 8-bit type of service 16-bit total length (bytes) 8-bit TTL 16-bit identification
Securing Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
TCP/IP SECURITY GRAD SEC NOV
TCP/IP SECURITY GRAD SEC NOV 14 2017 TODAY S PAPERS WHY DOES THE INTERNET WORK? 1. PROTOCOLS Agreements on how to communicate Publicly standardized, esp. via Requests for Comments (RFCs) RFC 826: ARP RFC
This time. Digging into. Networking. Protocols. Naming DNS & DHCP
This time Digging into Networking Protocols Naming DNS & DHCP Naming IP addresses allow global connectivity But they re pretty useless for humans! Can t be expected to pick their own IP address Can t be
Muhammad Farooq-i-Azam CHASE-2006 Lahore
Muhammad Farooq-i-Azam CHASE-2006 Lahore Overview Theory Existing Sniffers in action Switched Environment ARP Protocol and Exploitation Develop it yourself 2 Network Traffic Computers and network devices
Network Attacks. CS Computer Security. Once again thanks to Vern Paxson and David Wagner
Network Attacks CS 334 - Computer Security Once again thanks to Vern Paxson and David Wagner 1 Layers 1 & 2: General Threats? 7 4 3 2 1 Application Transport (Inter)Network Link Physical Framing and transmission
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN
Interconnecting Networks with TCP/IP. 2000, Cisco Systems, Inc. 8-1
Interconnecting Networks with TCP/IP 2000, Cisco Systems, Inc. 8-1 Objectives Upon completion of this chapter you will be able to perform the following tasks: Identify the IP protocol stack, its protocol
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES. Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner 1 AGENDA Objectives Attacking Impact Mitigation Summary 2 AGENDA
Network concepts introduction & wireshark
Network concepts introduction & wireshark W0RKSH0P @KirilsSolovjovs Why am I doing this? Many people attending hacker conferences are not in fact experts, but come here to learn and have fun Opportunity
Network Security. Network Vulnerabilities
Network Security Network Vulnerabilities 1 Attacks and the OSI Stack Stack layer Services Protocols Application; Presentation; Session Transport DNS SMTP TCP Network Routers IP Logic Physical Switches
IP Security IK2218/EP2120
IP Security IK2218/EP2120 Markus Hidell, mahidell@kth.se KTH School of ICT Based partly on material by Vitaly Shmatikov, Univ. of Texas Acknowledgements The presentation builds upon material from - Previous
CS 161 Computer Security
Raluca Ada Popa Spring 2018 CS 161 Computer Security Discussion 7 Week of March 5, 2018 Question 1 DHCP (5 min) Professor Raluca gets home after a tiring day writing papers and singing karaoke. She opens
Lecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005
Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks
Network concepts introduction & wireshark. workshop
Network concepts introduction & workshop @KirilsSolovjovs ISO/OSI+DoD model Topics for our workshop Network layer models Ethernet, WiFi Layer3: ARP, ICMP, IPv4, IPv6 Layer4: UDP, TCP Routing Application
Introduction to Computer Networks. CS 166: Introduction to Computer Systems Security
Introduction to Computer Networks CS 166: Introduction to Computer Systems Security Network Communication Communication in modern networks is characterized by the following fundamental principles Packet
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 20 th November 2017 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
Innovative uses as result of DNSSEC
Innovative uses as result of DNSSEC AKA: Some happenings in the DANE* WG in the IETF. * DNS-based Authentication of Named Entities Some background... When you connect to https://www.example.com you use
EITF25 Internet Techniques and Applications L7: Internet. Stefan Höst
EITF25 Internet Techniques and Applications L7: Internet Stefan Höst What is Internet? Internet consists of a number of networks that exchange data according to traffic agreements. All networks in Internet
ch02 True/False Indicate whether the statement is true or false.
ch02 True/False Indicate whether the statement is true or false. 1. No matter what medium connects computers on a network copper wires, fiber-optic cables, or a wireless setup the same protocol must be
Computer Networks Security: intro. CS Computer Systems Security
Computer Networks Security: intro CS 166 - Computer Systems Security A very easy network 3/14/16 Computer Networks: Intro 2 Two philosophers example Translator Language Translator Engineer Communication
DDoS Testing with XM-2G. Step by Step Guide
DDoS Testing with XM-G Step by Step Guide DDoS DEFINED Distributed Denial of Service (DDoS) Multiple compromised systems usually infected with a Trojan are used to target a single system causing a Denial
TCP /IP Fundamentals Mr. Cantu
TCP /IP Fundamentals Mr. Cantu OSI Model and TCP/IP Model Comparison TCP / IP Protocols (Application Layer) The TCP/IP subprotocols listed in this layer are services that support a number of network functions:
Introduction to Computer Security
Introduction to Computer Security Instructor: Mahadevan Gomathisankaran mgomathi@unt.edu CSCE 4550/5550, Fall 2009 Lecture 9 1 Announcements Assignment 1 Graded (out of 100) Max: 95 Min: 50 Mean: 77.33
RSA and ECDSA. Geoff Huston APNIC. #apricot2017
RSA and ECDSA Geoff Huston APNIC It s all about Cryptography Why use Cryptography? Public key cryptography can be used in a number of ways: protecting a session from third party eavesdroppers Encryption
Attacks on DNS: Risks of Caching
Attacks on DNS: Risks of Caching CS 161: Computer Security Prof. David Wagner March 30, 2016 Today Midterm 2 grades available Reminder: Start Project 2, Part 2! Today, DNS: protocol for mapping hostnames
Man In The Middle Project completed by: John Ouimet and Kyle Newman
Man In The Middle Project completed by: John Ouimet and Kyle Newman What is MITM? Man in the middle attacks are a form of eves dropping where the attacker relays messages that are sent between victims
McGraw-Hill The McGraw-Hill Companies, Inc., 2000
!! McGraw-Hill The McGraw-Hill Companies, Inc., 2000 "#$% & '$# )1 ) ) )6 ) )* )- ). )0 )1! )11 )1 )1 )16 )1 3'' 4", ( ( $ ( $ $$+, $$, /+ & 23,4 )/+ &4 $ 53" Network Layer Position of network layer Figure
NETWORK PACKET ANALYSIS PROGRAM
NETWORK PACKET ANALYSIS PROGRAM Duration: 3 days (21 hours) Mode: 1. Instructor Led Class room Training and Labs 2. Online In this hands-on course, you will receive in-depth training on Protocol analysis
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
Introduction to TCP/IP networking
Introduction to TCP/IP networking TCP/IP protocol family IP : Internet Protocol UDP : User Datagram Protocol RTP, traceroute TCP : Transmission Control Protocol HTTP, FTP, ssh What is an internet? A set
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 12 2/28/08 CIS/TCOM 551 1 Announcements Reminder: Project 2 is due Friday, March 7th at 11:59 pm 2/28/08 CIS/TCOM 551 2 Internet Protocol
Securing Internet Communication
Securing Internet Communication CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John Bethencourt, Erika Chin, Matthew Finifter, Cynthia Sturton, Joel Weinberger http://inst.eecs.berkeley.edu/~cs161/
Network layer: Overview. Network layer functions IP Routing and forwarding NAT ARP IPv6 Routing
Network layer: Overview Network layer functions IP Routing and forwarding NAT ARP IPv6 Routing 1 Network Layer Functions Transport packet from sending to receiving hosts Network layer protocols in every
Packet Capturing with TCPDUMP command in Linux
Packet Capturing with TCPDUMP command in Linux In this tutorial we will be looking into a very well known tool in Linux system administrators tool box. Some times during troubleshooting this tool proves
Network layer: Overview. Network Layer Functions
Network layer: Overview Network layer functions IP Routing and forwarding NAT ARP IPv6 Routing 1 Network Layer Functions Transport packet from sending to receiving hosts Network layer protocols in every
The Netwok Layer IPv4 and IPv6 Part 2
ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE The Netwok Layer IPv4 and IPv6 Part 2 Jean Yves Le Boudec 2014 1 Contents 6. ARP 7. Host configuration 8. IP packet format Textbook Chapter 5: The Network Layer
CSC 574 Computer and Network Security. DNS Security
CSC 574 Computer and Network Security DNS Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) A primer on routing Routing Problem: How do Alice s messages
Transport: How Applications Communicate
Transport: How Applications Communicate Week 2 Philip Levis 1 7 Layers (or 4) 7. 6. 5. 4. 3. 2. 1. Application Presentation Session Transport Network Link Physical segments packets frames bits/bytes Application
Defeating All Man-in-the-Middle Attacks
Defeating All Man-in-the-Middle Attacks PrecisionAccess Vidder, Inc. Defeating All Man-in-the-Middle Attacks 1 Executive Summary The man-in-the-middle attack is a widely used and highly preferred type
ECE 435 Network Engineering Lecture 7
ECE 435 Network Engineering Lecture 7 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 25 September 2018 HW#3 was Posted Announcements 1 HW#2 Review C code will be discussed next
ECE4110 Internetwork Programming. Introduction and Overview
ECE4110 Internetwork Programming Introduction and Overview 1 EXAMPLE GENERAL NETWORK ALGORITHM Listen to wire Are signals detected Detect a preamble Yes Read Destination Address No data carrying or noise?
CSCI 680: Computer & Network Security
CSCI 680: Computer & Network Security Lecture 15 Prof. Adwait Nadkarni Fall 2017 Derived from slides by William Enck and Micah Sherr 1 Grading Class Participat ion and Quizzes 10% Grade Breakdown Homewo
Chapter 8 roadmap. Network Security
Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing
AN INTRODUCTION TO ARP SPOOFING
AN INTRODUCTION TO ARP SPOOFING April, 2001 Sean Whalen Sophie Engle Dominic Romeo GENERAL INFORMATION Introduction to ARP Spoofing (April 2001) Current Revision: 1.8 Available: http://chocobospore.org
Closed book. Closed notes. No electronic device.
414-S17 (Shankar) Exam 3 PRACTICE PROBLEMS Page 1/6 Closed book. Closed notes. No electronic device. 1. Anonymity Sender k-anonymity Receiver k-anonymity Authoritative nameserver Autonomous system BGP
CS164 Final Exam Winter 2013
CS164 Final Exam Winter 2013 Name: Last 4 digits of Student ID: Problem 1. State whether each of the following statements is true or false. (Two points for each correct answer, 1 point for each incorrect
Interconnecting Networks with TCP/IP
Chapter 8 Interconnecting s with TCP/IP 1999, Cisco Systems, Inc. 8-1 Introduction to TCP/IP Internet TCP/IP Early protocol suite Universal 1999, Cisco Systems, Inc. www.cisco.com ICND 8-2 TCP/IP Protocol
Network Model. Why a Layered Model? All People Seem To Need Data Processing
Network Model Why a Layered Model? All People Seem To Need Data Processing Layers with Functions Packet Propagation Each router provides its services to support upper-layer functions. Headers (Encapsulation
IPv6 Traffic Hijack Test System and Defense Tools Using DNSSEC
IPv6 Traffic Hijack Test System and Defense Tools Using DNSSEC Lin Tao lintao850711@sina.com Liu Wu liuwu@cernet.edu.cn Duan Haixin dhx@cernet.edu.cn Sun Donghong sdh@cernet.edu.cn Abstract IPv6 is widely
Introduction to Computer Security
Introduction to Computer Security Instructor: Mahadevan Gomathisankaran mgomathi@unt.edu CSCE 4550/5550, Fall 2009 Lecture 7 1 Projects Groups Max 3 persons Topics Cryptography Network Security Program
Lecture 17 Overview. Last Lecture. Wide Area Networking (2) This Lecture. Internet Protocol (1) Source: chapters 2.2, 2.3,18.4, 19.1, 9.
Lecture 17 Overview Last Lecture Wide Area Networking (2) This Lecture Internet Protocol (1) Source: chapters 2.2, 2.3,18.4, 19.1, 9.2 Next Lecture Internet Protocol (2) Source: chapters 19.1, 19.2, 22,1
Int ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
ARP SPOOFING Attack in Real Time Environment
ARP SPOOFING Attack in Real Time Environment Ronak Sharma 1, Dr. Rashmi Popli 2 1 Deptt. of Computer Engineering, YMCA University of Science and Technology, Haryana (INDIA) 2 Deptt. of Computer Engineering,
Testing IPv6 address records in the DNS root
Testing IPv6 address records in the DNS root February 2007 Geoff Huston Chief Scientist APNIC Priming a DNS name server 1. Take the provided root hints file 2. Generate a DNS query for resource records
TCP/IP Protocol Suite
TCP/IP Protocol Suite Computer Networks Lecture 5 http://goo.gl/pze5o8 TCP/IP Network protocols used in the Internet also used in today's intranets TCP layer 4 protocol Together with UDP IP - layer 3 protocol
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. 2.1 Install and configure the DNS server. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006-2015 Wenliang Du, Syracuse University. The development of this document is partially funded by the National Science Foundation s Course,
Lecture Nov. 21 st 2006 Dan Wendlandt ISP D ISP B ISP C ISP A. Bob. Alice. Denial-of-Service. Password Cracking. Traffic.
15-441 Lecture Nov. 21 st 2006 Dan Wendlandt Worms & Viruses Phishing End-host impersonation Denial-of-Service Route Hijacks Traffic modification Spyware Trojan Horse Password Cracking IP Spoofing DNS
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
Detecting Sniffers on Your Network
Detecting Sniffers on Your Network Sniffers are typically passive programs They put the network interface in promiscuous mode and listen for traffic They can be detected by programs such as: ifconfig eth0
Grandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide
Grandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide Table of Contents INTRODUCTION... 4 SCENARIO OVERVIEW... 5 CONFIGURATION STEPS... 6 Core Site Configuration... 6 Generate Self-Issued Certificate
CSCI 1800 Cybersecurity and Interna4onal Rela4ons. Design and Opera-on of the Internet John E. Savage Brown University
CSCI 1800 Cybersecurity and Interna4onal Rela4ons Design and Opera-on of the Internet John E. Savage Brown University Outline Network security The link layer The network layer The transport layer Denial
CS61C Machine Structures Lecture 37 Networks. No Machine is an Island!
CS61C Machine Structures Lecture 37 Networks April 24, 2006 John Wawrzynek Page 1 No Machine is an Island! Computer Processor (active) Control ( brain ) Datapath ( brawn ) Memory (passive) (where programs,
CS Paul Krzyzanowski
The Internet Packet switching: store-and-forward routing across multiple physical networks... across multiple organizations Computer Security 11. Network Security ISP Paul Krzyzanowski Rutgers University
OSI Session / presentation / application Layer. Dr. Luca Allodi - Network Security - University of Trento, DISI (AA 2015/2016)
OSI Session / presentation / application Layer Dr. Luca Allodi - Network Security - University of Trento, DISI (AA 2015/2016) 1 Higher level protocols On top of IP, TCP, UDP, etc. there are a plethora
Guide To TCP/IP, Second Edition UDP Header Source Port Number (16 bits) IP HEADER Protocol Field = 17 Destination Port Number (16 bit) 15 16
Guide To TCP/IP, Second Edition Chapter 5 Transport Layer TCP/IP Protocols Objectives Understand the key features and functions of the User Datagram Protocol (UDP) Explain the mechanisms that drive segmentation,
Security by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
Session Overview. ! Introduction! Layer 2 and 3 attack scenarios! CDP, STP & IEEE 802.1q! ARP attacks & ICMP abuse! Discovering & attacking IGPs
Session Overview! Introduction! Layer 2 and 3 attack scenarios! CDP, STP & IEEE 802.1q! ARP attacks & ICMP abuse! Discovering & attacking IGPs! RIP, IGRP, EIGRP and OSPF! Attacking tunnels! GRE intrusion
Redesde Computadores(RCOMP)
Redesde Computadores(RCOMP) Lecture 05 2016/2017 The TCP/IP protocol stack. IPv4, ARP, UDP, BOOTP/DHCP, ICMP, TCP, and IGMP. Instituto Superior de Engenharia do Porto Departamento de Engenharia Informática
ICS 351: Today's plan. IPv6 routing protocols (summary) HTML HTTP web scripting languages certificates (review) cookies
ICS 351: Today's plan IPv6 routing protocols (summary) HTML HTTP web scripting languages certificates (review) cookies IPv6 routing almost the same routing protocols as for IPv4: RIPng, OSPFv6, BGP with
Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
Network Basic v0.1. Network Basic v0.1. Chapter 3 Internet Protocol. Chapter 3. Internet Protocol
Network Basic v0.1 Chapter 3. Internet Protocol 1 Network Basic v0.1 Chapter 3 Internet Protocol 1. The Role of Network Layer 2. IP Protocol Feature 3. IP Packet Routing 5. DHCP 6. NAT 2 1 네트워크 ICONs 3
Telecom Systems Chae Y. Lee. Contents. Overview. Issues. Addressing ARP. Adapting Datagram Size Notes
Internetworking Contents Overview Functions Issues Basic Delivery Unit Addressing Datagram Delivery ARP IPv4 Header Adapting Datagram Size Notes 2 Overview - Example 3 Direct Delivery 4 Indirect Delivery
Lecture 9: Network Level Security IPSec
Lecture 9: Network Level Security IPSec CS 336/536: Computer Network Security Fall 2015 Nitesh Saxena Adopted from previous lecture by Keith Ross, and Tony Barnard HW3 being graded Course Admin HW4 will
Network Protocols - Revision
Network Protocols - Revision Luke Anderson luke@lukeanderson.com.au 18 th May 2018 University Of Sydney Overview 1. The Layers 1.1 OSI Model 1.2 Layer 1: Physical 1.3 Layer 2: Data Link MAC Addresses 1.4
network security s642 computer security adam everspaugh
network security s642 adam everspaugh ace@cs.wisc.edu computer security today Announcement: HW3 to be released WiFi IP, TCP DoS, DDoS, prevention 802.11 (wifi) STA = station AP = access point BSS = basic
Introduction to IPsec. Charlie Kaufman
Introduction to IPsec Charlie Kaufman charliek@microsoft.com 1 IP Security (IPsec) IETF standard for Network Layer security Popular for creating trusted link (VPN), either firewall-firewall, or machine
Network Security Issues, Part 1
Network Security Issues, Part 1 EE 122 - Networking Prof. Vern Paxson November 18, 2013 Game Plan Two network security lectures Today: threats at different Internet layers Next Monday: building secure
ICS 351: Networking Protocols
ICS 351: Networking Protocols IP packet forwarding application layer: DNS, HTTP transport layer: TCP and UDP network layer: IP, ICMP, ARP data-link layer: Ethernet, WiFi 1 Networking concepts each protocol
Lab - Using Wireshark to Examine a UDP DNS Capture
Topology Objectives Part 1: Record a PC s IP Configuration Information Part 2: Use Wireshark to Capture DNS Queries and Responses Part 3: Analyze Captured DNS or UDP Packets Background / Scenario If you