Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

learn more… | top users | synonyms

4
votes
2answers
82 views

Is encryption possible for simplex (one-directional) TCP/IP, and if so, how?

As explained in the TCP/IP Guide, it is possible to configure TCP/IP to operate in simplex mode and this mode is utilized, among other things, in communication from satellites. One consideration with ...
-3
votes
1answer
59 views

How to see all incoming and outgoing traffic of other nodes while on a LAN?

I've got two computers. A & B. While sitting on the computer A how can I see the incoming and outgoing traffic of computer B? Or can I? Note: Please try to answer in a non-technical language as ...
1
vote
1answer
24 views

Using a Firewall to Trigger Truncation in DNS UDP Response

Assume I am a firewall between client and server. If the client sends a DNS query with UDP, I should response this query with set the truncated flag=1. As a result, the client will be forced to use ...
3
votes
1answer
90 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
-2
votes
1answer
70 views

Random scanning or potential attack/recon? [duplicate]

If the purpose of a SYN Flood attack would be to make the target unresponsive to normal traffic, same as any other DoS, wouldn't this attack generally have been directed at a public server rather than ...
4
votes
1answer
77 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
3
votes
2answers
48 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
4
votes
2answers
81 views

Malware / vulnerability that uses or causes malformed IP or TCP Headers

I'm curious if there are any examples of malformed IP or TCP headers (for example, checksums that don't match, reserved bits that aren't zero, or poor header length numbers) used by malware, or that ...
1
vote
1answer
17 views

What TCP-level commands affect the global configuration of the stack?

I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor. What TCP commands (for lack of a better word) affect the global TCP stack? Or that or ...
2
votes
1answer
81 views

Security over multi-streaming such as SCTP

I refer to multi-streaming as the ability to send two or more streams of some unit of data (block, byte streams) in one established association/context. SCTP is an example and the protocol I was ...
-4
votes
1answer
53 views

how can the hacker benefit from the information of checking tcp port or udp port? [closed]

I studying a scanning and I want to ask how can the hacker benefit from the information of checking tcp port or udp port?
2
votes
1answer
59 views

Abnormal SYN traffic from Blackhole DNS servers

I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers. I hadn't had any experience with Blackhole servers prior ...
2
votes
1answer
91 views

Does SSL or HIP solve all TCP/IP security problem?

I recently read this paper "A Look Back at Security Problems in the TCP/IP Protocol Suite" (https://www.cs.columbia.edu/~smb/papers/acsac-ipext.pdf) explaining few attacks at the TCP/IP stack. One ...
2
votes
2answers
38 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
0
votes
1answer
131 views

Which systems in a network are able to spoof a TCP handshake?

I am reviewing for my final exam tomorrow, I came across a past exam question. An attacker wants to initiate a TCP handshake with a target to make him think E initiated it, attacker knows IP ...
1
vote
1answer
42 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
7
votes
2answers
125 views

Why do ISPs allow faked source IP addresses?

Ok so apparently you can specify a source IP when doing a SYN request or something. Besides just asking why in the world that would even be allowed, I will move past that because I want to understand ...
5
votes
3answers
189 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
1
vote
0answers
87 views

Random SYN_SENT connections to Amazon EC2?

I have looked around but couldn't find anyone else with this issue. On my console (standard asus i7 laptop) running Ubuntu 14.04 LTS - I noticed in tcptrack that there are a lot of connections being ...
2
votes
3answers
330 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
1
vote
1answer
61 views

UDP-Only Linux Dedicated Server?

I am running my own small UDP linux service on a dedicated server. my service responds to single-package requests with single-package responses. I don't want this server to do anything else. I ...
4
votes
1answer
159 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
3
votes
3answers
1k views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
5
votes
1answer
163 views

Explain the last part of how Mitnick hacked Tsutomu Shimomura with an IP sequence attack

I was reading up on why TCP ISNs need to be randomized, which led me to this write up by Tsutomu Shimomura. I understood how IP address spoofing and predicting the ISN helped the attacker establish a ...
1
vote
0answers
1k views

Security risk of opening port 111 (rpcbind)?

As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program ...
1
vote
2answers
325 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
11
votes
4answers
3k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
4
votes
1answer
135 views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
1
vote
2answers
77 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
1
vote
0answers
152 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
-2
votes
2answers
60 views

TLS - Are signatures still needed?

The story: I'm currently writing a web service that allows for communications to be made remotely via TCP/IP. I first thought about signing each packet using HMAC-SHA1 with a password, appending the ...
5
votes
2answers
2k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
2
votes
1answer
84 views

Downloading operating systems vulnerable to TCP amplification

I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing. From what I have researched mostly ancient linux kernels (2.0.x and below) and ...
0
votes
1answer
338 views

Are these port secured on my AP?

I'm doing a project for my high-school and I'm trying to get the best security for my network. I've made almost everything in my access-point configuration and I have only 3 tcp/ports open on my AP: ...
6
votes
2answers
636 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
1
vote
1answer
212 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
2
votes
2answers
176 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
-5
votes
2answers
1k views

Is TCP more secure than UDP? [closed]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...
1
vote
3answers
296 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
0answers
121 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
2answers
342 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
0answers
191 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
2answers
147 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
3
votes
1answer
110 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
3
votes
2answers
145 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
1answer
180 views

Wireshark: could “Follow TCP Stream” yield an empty window? or is it a bug?

I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow ...
0
votes
1answer
251 views

Firewall hole punching [closed]

I'm interested in doing my thesis on Firewall hole punching. Hole Punching: A way to exploit NAT to open a connection TCP or UDP between a Client and a Server. What I'm looking for is a reason this ...
0
votes
2answers
350 views

How does the TCP/IP lack security? [closed]

I already know that some concerns of lack of security in TCP/IP are that TCP/IP does not support strong authentication of packets and no encryption of packets. What other weaknesses are there in the ...
3
votes
1answer
680 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
3
votes
2answers
2k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...