Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

learn more… | top users | synonyms

1
vote
1answer
17 views

What TCP-level commands affect the global configuration of the stack?

I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor. What TCP commands (for lack of a better word) affect the global TCP stack? Or that or ...
2
votes
1answer
79 views

Security over multi-streaming such as SCTP

I refer to multi-streaming as the ability to send two or more streams of some unit of data (block, byte streams) in one established association/context. SCTP is an example and the protocol I was ...
-4
votes
1answer
44 views

how can the hacker benefit from the information of checking tcp port or udp port? [closed]

I studying a scanning and I want to ask how can the hacker benefit from the information of checking tcp port or udp port?
2
votes
1answer
75 views

Does SSL or HIP solve all TCP/IP security problem?

I recently read this paper "A Look Back at Security Problems in the TCP/IP Protocol Suite" (https://www.cs.columbia.edu/~smb/papers/acsac-ipext.pdf) explaining few attacks at the TCP/IP stack. One ...
2
votes
2answers
36 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
0
votes
1answer
127 views

Which systems in a network are able to spoof a TCP handshake?

I am reviewing for my final exam tomorrow, I came across a past exam question. An attacker wants to initiate a TCP handshake with a target to make him think E initiated it, attacker knows IP ...
1
vote
1answer
39 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
7
votes
2answers
122 views

Why do ISPs allow faked source IP addresses?

Ok so apparently you can specify a source IP when doing a SYN request or something. Besides just asking why in the world that would even be allowed, I will move past that because I want to understand ...
5
votes
3answers
139 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
1
vote
0answers
68 views

Random SYN_SENT connections to Amazon EC2?

I have looked around but couldn't find anyone else with this issue. On my console (standard asus i7 laptop) running Ubuntu 14.04 LTS - I noticed in tcptrack that there are a lot of connections being ...
2
votes
3answers
230 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
1
vote
1answer
57 views

UDP-Only Linux Dedicated Server?

I am running my own small UDP linux service on a dedicated server. my service responds to single-package requests with single-package responses. I don't want this server to do anything else. I ...
4
votes
1answer
147 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
3
votes
3answers
548 views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
5
votes
1answer
140 views

Explain the last part of how Mitnick hacked Tsutomu Shimomura with an IP sequence attack

I was reading up on why TCP ISNs need to be randomized, which led me to this write up by Tsutomu Shimomura. I understood how IP address spoofing and predicting the ISN helped the attacker establish a ...
1
vote
0answers
749 views

Security risk of opening port 111 (rpcbind)?

As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program ...
1
vote
2answers
225 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
11
votes
4answers
3k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
4
votes
1answer
112 views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
1
vote
2answers
75 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
1
vote
0answers
124 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
-2
votes
2answers
55 views

TLS - Are signatures still needed?

The story: I'm currently writing a web service that allows for communications to be made remotely via TCP/IP. I first thought about signing each packet using HMAC-SHA1 with a password, appending the ...
5
votes
2answers
2k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
2
votes
1answer
81 views

Downloading operating systems vulnerable to TCP amplification

I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing. From what I have researched mostly ancient linux kernels (2.0.x and below) and ...
0
votes
1answer
227 views

Are these port secured on my AP?

I'm doing a project for my high-school and I'm trying to get the best security for my network. I've made almost everything in my access-point configuration and I have only 3 tcp/ports open on my AP: ...
6
votes
2answers
474 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
1
vote
1answer
180 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
2
votes
2answers
171 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
-4
votes
2answers
1k views

Is TCP more secure than UDP? [closed]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...
1
vote
3answers
251 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
0answers
113 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
2answers
276 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
0answers
176 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
2answers
138 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
0
votes
0answers
140 views

How to simulate an UDP / TCP / Multiple Ports via Honeyd daemon?

I am using honeyd daemon to simulate TCP port on a Linux Ubuntu machine using honeyd.conf file which was configured to do so with the following script :- 1 create default 2 set default personality ...
3
votes
1answer
105 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
3
votes
2answers
131 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
1answer
157 views

Wireshark: could “Follow TCP Stream” yield an empty window? or is it a bug?

I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow ...
0
votes
1answer
228 views

Firewall hole punching [closed]

I'm interested in doing my thesis on Firewall hole punching. Hole Punching: A way to exploit NAT to open a connection TCP or UDP between a Client and a Server. What I'm looking for is a reason this ...
0
votes
2answers
317 views

How does the TCP/IP lack security? [closed]

I already know that some concerns of lack of security in TCP/IP are that TCP/IP does not support strong authentication of packets and no encryption of packets. What other weaknesses are there in the ...
3
votes
1answer
627 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
3
votes
2answers
2k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
2
votes
2answers
169 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
0
votes
2answers
176 views

Security concerns with TCP holding onto out-of-order packets?

Consider the following... Alice and Bob are communicating over TCP. Currently, the next expected TCP sequence number is 1000. Charlie, pretending to be Alice, sends a spoofed TCP packet to Bob with ...
14
votes
3answers
1k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
23
votes
1answer
1k views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
0
votes
3answers
397 views

How source port field in firewall rule is used

Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is ...
2
votes
1answer
259 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
0
votes
2answers
203 views

Proxy traffic via MITM script

I want to log and modify outbound traffic on a Linux machine. I currently have one program that sends requests out to the internet, I would like to process these requests and their responses via ...
-2
votes
2answers
145 views

Trojan TCP and UDP ports removal solution?

After a nmap scan on my local host on my Windows 7 machine results showed a vast list of open ports. I'm using Windows Firewall. This machine was given to me by a friend. I've had my network crash ...