The tag has no usage guidance.

learn more… | top users | synonyms

29
votes
4answers
8k views

What layer is TLS?

TLS stands for "transport layer security". And the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". These two things would leave me to believe that TLS is a ...
23
votes
1answer
1k views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...
12
votes
5answers
19k views

Can Skype chat be protected from snooping? Are there safe alternatives?

I use Skype a lot. With all of my clients, staff, contractors and friends, however, the acquisition by Microsoft worries me, as two of my clients are direct MS competitors, and I often work on long ...
9
votes
1answer
1k views

Is Bluetooth 4.0 traffic encrypted by default/design?

I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some ...
8
votes
3answers
6k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
8
votes
1answer
403 views

Can ICMP Redirects still be used to redirect traffic in a LAN?

I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab. hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc 192....
7
votes
1answer
1k views

Reconstructing bittorrent data from PCAP

I am doing a CTF flag for my school project with a PCAP flag based on this CTF write-up: eindbazen.net - Plaid CTF 2012 - Torrent I setup a local torrent file containing an .mp3 (the audio is my flag'...
5
votes
2answers
77 views

Malicious packet that attacks packet sniffers?

Is it possible to crash a packet sniffer through a specially-formed packet to stop website administrators from tracking down the source? If it is possible, has it been done before? Or is it just not ...
4
votes
2answers
853 views

Packet Checksums

I recently learned that every packet includes checksum bytes and that the computer will request the packet again if the checksums don't match. How do the following attacks defeat such a safeguard? ...
4
votes
2answers
5k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
4
votes
1answer
69 views

Basic question about how an IDS works

Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?...
4
votes
2answers
246 views

Malware / vulnerability that uses or causes malformed IP or TCP Headers

I'm curious if there are any examples of malformed IP or TCP headers (for example, checksums that don't match, reserved bits that aren't zero, or poor header length numbers) used by malware, or that ...
3
votes
3answers
4k views

How to capture wireless data from an intruder using a home router

After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data ...
3
votes
1answer
328 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: David-...
2
votes
3answers
120 views

Receiving packets from Amazon

I ran a Wireshark packet capture on my home Windows PC, as there was some suspicion that I was infected (although I notice nothing out of the ordinary and both Avast and Malwarebytes detect nothing). ...
2
votes
2answers
452 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
2
votes
1answer
744 views

Protect an application that uses internet from packet sniffing

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
2
votes
1answer
490 views

isaac random number generator and the type of encryption it is used for (game packet encryption)?

I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption ...
2
votes
2answers
54 views

Is my computer getting attacked? [closed]

Would anyone be able to have a look at the pcap from my computer? I am thinking my computer get attacked by a process and keeps sending out packets from my computer to DoS my network. I get errors ...
2
votes
1answer
207 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
2
votes
1answer
2k views

Failure to capture any packets on wlan0 in monitor mode

I have read a lot of Q&As that have achieved success in packet captures of Wifi probe requests, which entails capturing IEEE802_11_RADIO (802.11 plus radiotap header) in monitor mode. But I find ...
2
votes
1answer
1k views

Reassemble sniffed packets [closed]

I am attempting to analyse my WiFi network with on Mac OS X, is there a tool to reassemble TCP stream from Wireshark capture. I would like to see the entire HTML pages that are passing through the ...
2
votes
2answers
68 views

Code injection using packet modification

Is code injection possible through packet modification? For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar? I guess a ...
2
votes
2answers
40 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
2
votes
1answer
93 views

Why are packets constantly being sent to international ISPs?

When using a packet sniffer, I notice a lot of packets being sent to a bunch of ISPs (such as axion.ca, wanadoo.fr/orange?, bresnan.net, zebra.lt) usually all at the same time. Here's a screenshot of ...
2
votes
1answer
313 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
2
votes
1answer
55 views

Man-in-the-middle packet injection

I'm currently studying the possibility of a man-in-the-middle attack in a network consisting of a switch and 3 computers: Server/Host Client Man In The Middle The server and the client will change ...
2
votes
1answer
81 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
2
votes
1answer
972 views

snort ignores packets with matching src/dest IP address

This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
2
votes
0answers
386 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, unknown)...
1
vote
3answers
282 views

Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings?

How Deep packet inspection (DPI) tools prevent from certificates warnings through decrypt and re encrypting packets ?
1
vote
3answers
324 views

Is there a way to get information out of the router [closed]

Is there any way (directly from a computer or device) to see the packets that pass the router from the different devices. Thanks.
1
vote
2answers
361 views

Send fake response(?packets) to a program [closed]

So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline ...
1
vote
3answers
4k views

How to encrypt packets in network?

I have a simple wireless router to share the internet with single access username/password. I was wondering if it is possible somehow to set packet encryption so that other people on the LAN cannot ...
1
vote
2answers
139 views

Sniff network packets that don't talk to my computer?

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router? I want to be able to sniff for network traffic (even while ...
1
vote
2answers
98 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
1
vote
2answers
464 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
1
vote
4answers
1k views

Can Your ISP use a Packet Sniffer? [closed]

Can ISPs presumably use packet sniffing applications such as wireshark and monitor my unencrypted data? Are they "allowed" to do so?
1
vote
1answer
122 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
1
vote
2answers
126 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
1answer
48 views

How to modify UDP packets in checksum field?

Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity. So, I ...
1
vote
1answer
94 views

Scapy WPA2 packet forging

Can I use scapy to forge custom packets on WPA2 network? Can I even pack the IEEE 802.11 headers?
1
vote
2answers
47 views

Several processes are listening to the same interface: any problem?

I wonder if some processes may get less packets than others if they are all listening to the same wireless interface. I'm running for example the basic mitm schema using arpspoof, sniffing packets ...
1
vote
2answers
46 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
1
vote
1answer
58 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
1answer
44 views

How can I put in relation http timestamp with country time zone of the IP?

I have a series of packets within a PCAP files, among them I'm getting packet with HTTP protocol. starting from IP address I get the timestamp in GMT format and the time zone, for example: Source IP:...
1
vote
2answers
355 views

Spoofing TCP/IP stack OS Fingerprinting attacks in OSX

We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks. For Windows machines there are tools/guides for doing that, but can't find ...
1
vote
2answers
2k views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
1
vote
1answer
505 views

Configure Wireshark to capture preformatted data from pseudo-device

So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...