The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
2answers
19 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
1answer
14 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
0
votes
2answers
24 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
30 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
-1
votes
3answers
45 views

How can I extract the certificate from this pcap file?

I have a pcap file of 14 sniffed SSL packets. I uploaded it here: ssl.pcap I opened it with wireshark. I see the 14 packets. The largest of seems to contain a self signed certificate (as it is made ...
0
votes
4answers
92 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
1answer
51 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
1answer
40 views

How to modify UDP packets in checksum field?

Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity. So, I ...
0
votes
0answers
39 views

Can't see WEP networks with airodump-ng

I use airodump-ng on my RPi3 (armhf version). I've been able to properly set up the interface and turn it into monitor mode. Now, I can sniff the air traffic using airodump-ng, but I can't see my ...
2
votes
2answers
53 views

Is my computer getting attacked? [closed]

Would anyone be able to have a look at the pcap from my computer? I am thinking my computer get attacked by a process and keeps sending out packets from my computer to DoS my network. I get errors ...
2
votes
1answer
44 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
2
votes
2answers
55 views

Code injection using packet modification

Is code injection possible through packet modification? For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar? I guess a ...
5
votes
2answers
73 views

Malicious packet that attacks packet sniffers?

Is it possible to crash a packet sniffer through a specially-formed packet to stop website administrators from tracking down the source? If it is possible, has it been done before? Or is it just not ...
1
vote
2answers
120 views

Sniff network packets that don't talk to my computer?

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router? I want to be able to sniff for network traffic (even while ...
4
votes
1answer
68 views

Basic question about how an IDS works

Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a ...
-1
votes
1answer
26 views

Decrypting packets sent from a server to a client, how to figure out the key, having both decoded packets and encoded packets

I have written a packet sniffer which succesfully intercepts all the packets sent from a server to my computer. The problem is that the packets are encrypted(of course) and i need to decrypt them. An ...
1
vote
2answers
109 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
0
votes
1answer
80 views

Transfer of packets in a VPN connection

I am trying to figure out how a computer communicates with a website when using a VPN connection (specifically, how packets are transferred) as compared to a computer that's not using a VPN ...
1
vote
1answer
39 views

How can I put in relation http timestamp with country time zone of the IP?

I have a series of packets within a PCAP files, among them I'm getting packet with HTTP protocol. starting from IP address I get the timestamp in GMT format and the time zone, for example: Source ...
1
vote
1answer
76 views

Scapy WPA2 packet forging

Can I use scapy to forge custom packets on WPA2 network? Can I even pack the IEEE 802.11 headers?
1
vote
3answers
246 views

Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings?

How Deep packet inspection (DPI) tools prevent from certificates warnings through decrypt and re encrypting packets ?
12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...
1
vote
2answers
307 views

Spoofing TCP/IP stack OS Fingerprinting attacks in OSX

We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks. For Windows machines there are tools/guides for doing that, but can't find ...
8
votes
1answer
313 views

Can ICMP Redirects still be used to redirect traffic in a LAN?

I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab. hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc ...
1
vote
1answer
98 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
3
votes
2answers
71 views

Sandbox/Capture Outbound Traffic

Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a windows PC? (The aim being that you can analyse the data being sent via the ...
0
votes
1answer
39 views

Entropy on payload

How can I guess if a payload is obfuscated or encrypted? in other words can I apply Shannon Entropy algorithm to a binary payload? any advice will be appreciated, thanks in advance
2
votes
1answer
161 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
7
votes
1answer
754 views

Is Bluetooth 4.0 traffic encrypted by default/design?

I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some ...
2
votes
2answers
39 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
2
votes
1answer
91 views

Why are packets constantly being sent to international ISPs?

When using a packet sniffer, I notice a lot of packets being sent to a bunch of ISPs (such as axion.ca, wanadoo.fr/orange?, bresnan.net, zebra.lt) usually all at the same time. Here's a screenshot of ...
2
votes
1answer
2k views

Failure to capture any packets on wlan0 in monitor mode

I have read a lot of Q&As that have achieved success in packet captures of Wifi probe requests, which entails capturing IEEE802_11_RADIO (802.11 plus radiotap header) in monitor mode. But I find ...
1
vote
2answers
111 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
8
votes
3answers
4k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
4
votes
2answers
210 views

Malware / vulnerability that uses or causes malformed IP or TCP Headers

I'm curious if there are any examples of malformed IP or TCP headers (for example, checksums that don't match, reserved bits that aren't zero, or poor header length numbers) used by malware, or that ...
29
votes
4answers
6k views

What layer is TLS?

TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
1
vote
1answer
87 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
1
vote
0answers
16 views

Probabilistic packet marking content ID field

For Above image: All routers are using PPM. What will be the content ID field if 1) R1 = mark packet, R2= Mark packet, R3 = Not mark the packet. 2) R1 = Not mark packet, R2= Mark packet, R3 = Not ...
-1
votes
1answer
208 views

What would a typical packet of a DDOS attack look like? [closed]

In terms of header, size and payload? We've been learning about DDOS attacks in class and they've been telling us all of the abstract ideas, but haven't told us what the actual makeup of the packets ...
3
votes
1answer
310 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: ...
-1
votes
1answer
134 views

Slow internet - Worried about spammed packets

got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every ...
1
vote
0answers
221 views

Snort rule for outgoing attacks [closed]

I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server. alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...
0
votes
1answer
2k views

How to run a snort rule over pcap file

I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder: alert icmp any any -> any any (msg:"TCP ...
-1
votes
1answer
2k views

Interpreting anti-hacker-alliance analysis [closed]

One of security tools available for web browsing is (http://anti-hacker-alliance.com) Please find below two readings: a) Reading for IP 205.x.x.x that state among other-things "you are using proxy ...
-1
votes
2answers
3k views

How to make Reaver crack WPS faster [closed]

I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
1
vote
2answers
97 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
1
vote
2answers
1k views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
2
votes
2answers
403 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
2answers
331 views

Send fake response(?packets) to a program [closed]

So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline ...
0
votes
1answer
232 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...