Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

learn more… | top users | synonyms

4
votes
2answers
207 views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
2
votes
1answer
53 views

Downloading operating systems vulnerable to TCP amplification

I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing. From what I have researched mostly ancient linux kernels (2.0.x and below) and ...
0
votes
1answer
51 views

Are these port secured on my AP?

I'm doing a project for my high-school and I'm trying to get the best security for my network. I've made almost everything in my access-point configuration and I have only 3 tcp/ports open on my AP: ...
4
votes
0answers
107 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
1
vote
1answer
64 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
2
votes
2answers
107 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
-4
votes
2answers
116 views

Is TCP more secure than UDP? [closed]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...
1
vote
3answers
66 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
0answers
70 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
2answers
99 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
0answers
73 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
1
vote
2answers
80 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
0
votes
0answers
85 views

How to simulate an UDP / TCP / Multiple Ports via Honeyd daemon?

I am using honeyd daemon to simulate TCP port on a Linux Ubuntu machine using honeyd.conf file which was configured to do so with the following script :- 1 create default 2 set default personality ...
3
votes
1answer
75 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
0
votes
0answers
40 views

Is it possible to covertly tunnel data using L3DSR? (or any other TCP or IP layer hack)

I asked this question on ServerFault regarding how a Netscaler embeds low level data in a TCP packet, round-trips it, and then uses that data to loadbalance the user. Similar to DNS Tunneling, I ...
3
votes
2answers
72 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
1answer
89 views

Wireshark: could “Follow TCP Stream” yield an empty window? or is it a bug?

I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow ...
0
votes
1answer
147 views

Firewall hole punching [closed]

I'm interested in doing my thesis on Firewall hole punching. Hole Punching: A way to exploit NAT to open a connection TCP or UDP between a Client and a Server. What I'm looking for is a reason this ...
0
votes
0answers
24 views

How to route RST injections

Lots of security appliances and software support RST injection. Plenty of material exists on the algorithmics of the RST packet(s) (making them fit the context of the targeted TCP connection, ...
0
votes
2answers
194 views

How does the TCP/IP lack security? [closed]

I already know that some concerns of lack of security in TCP/IP are that TCP/IP does not support strong authentication of packets and no encryption of packets. What other weaknesses are there in the ...
2
votes
1answer
326 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
3
votes
2answers
1k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
2
votes
2answers
114 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
0
votes
2answers
117 views

Security concerns with TCP holding onto out-of-order packets?

Consider the following... Alice and Bob are communicating over TCP. Currently, the next expected TCP sequence number is 1000. Charlie, pretending to be Alice, sends a spoofed TCP packet to Bob with ...
14
votes
3answers
611 views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
23
votes
1answer
1k views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
0
votes
3answers
134 views

How source port field in firewall rule is used

Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is ...
2
votes
1answer
129 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
0
votes
2answers
146 views

Proxy traffic via MITM script

I want to log and modify outbound traffic on a Linux machine. I currently have one program that sends requests out to the internet, I would like to process these requests and their responses via ...
-2
votes
2answers
101 views

Trojan TCP and UDP ports removal solution?

After a nmap scan on my local host on my Windows 7 machine results showed a vast list of open ports. I'm using Windows Firewall. This machine was given to me by a friend. I've had my network crash ...
1
vote
1answer
404 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when i write this is allowed: alert icmp any any -> any any (msg:"HTTP ...
2
votes
1answer
393 views

How are ACK storms created and what's a good mitigation strategy for them?

The context is network based load balancers. It would be nice if someone could explain how TCP ACK storms are generated in real life and practical mitigation strategies for them. Edit: Clarification ...
1
vote
1answer
580 views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
1
vote
2answers
556 views

Identify HTTPS vs Application SSL Traffic

Scenario A: A user points his web browser to https://users.server.com. The website completes the SSL handshake and continues with the HTTP protocol inside SSL. Scenario B: (server-side) Now, let's ...
2
votes
2answers
396 views

What are good approaches to modify TLS/SSL trafic in order to make a HTTP bot?

If I wanted to make a bot that plays/issues automatic actions/moves in a online browser game, whose communication is realized over HTTP1/1 and WebSocket (https and wws respectively), all TLS ...
1
vote
1answer
2k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
2answers
202 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
7
votes
4answers
2k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
9
votes
2answers
921 views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
2
votes
1answer
156 views

Security implications for two applications communicating with TCP/IP on localhost

Considering this for the local loopback connection: - It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller. If ...
2
votes
1answer
839 views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
0
votes
1answer
138 views

TCP IN connection from another user in my home network. Is it safe?

I'm using Comodo Firewall and I noticed that sometimes I'm getting TCP IN connection from another IP address in my home network (only one router and few wireless users): TCP IN | 192.168.1.50 | ...
0
votes
1answer
176 views

Corrupt password being pulled from wireshark data?

Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note ...
1
vote
2answers
1k views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
0
votes
1answer
189 views

Is it safe not to encrypt ping packets them?

I am running encrypted communication with ping tacked on after decryption and deserialization is complete. I.e. incoming data -> split into packets -> decrypt -> deserializer -> actual message or ...
5
votes
1answer
573 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
7
votes
3answers
10k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
2
votes
3answers
2k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
2
votes
2answers
384 views

Firewall & TCP Traffic

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial ...
6
votes
3answers
2k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...