Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

learn more… | top users | synonyms

0
votes
0answers
53 views

Need help in understanding packet analysis! [on hold]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
-5
votes
1answer
105 views

Benefit of checking TCP port or UDP port [closed]

I'm studying port scanning. How can an attacker benefit from the information of checking TCP ports or UDP ports?
1
vote
1answer
54 views

How can a server prove authenticity

I am working on a secure messaging platform and am having trouble figuring out how to protect against MITM attacks. My current setup can be summed up as follows: The server keeps a private key and ...
1
vote
3answers
84 views

Fingerprinting users based on IP addresses

Is your local IP address used to better "fingerprint" a specific user? As far as I understood TCP connections, your local IP is send to the remote server in IP packets. It could add to the overall ...
0
votes
2answers
62 views

IP leakage on Skype through VPN

Does anyone know how the traffic behaves if you configure a VPN natively through SSTP (WIN or MAC)? Because most applications use the TCP, but Skype uses UDP. I try to formulate more specific ...
18
votes
4answers
3k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
7
votes
1answer
77 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar ...
-1
votes
1answer
38 views

How does PeerBlock generate range descriptions?

How does PeerBlock generate the range that it displays? I thought it was through some DNS lookup, but when I do the lookup I get LeaseWeb Content Delivery Network for the attached screenshot. Instead ...
4
votes
1answer
201 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
4
votes
1answer
263 views

Can a Cisco ASA 5505 block this DDoS attack?

Since more than a week ago, my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load ...
8
votes
3answers
96 views

Can a TCP connection be terminated by an attacker if SSL/TLS has been used to protect data in the TCP segment?

I understand that SSL/TLS is built on top of TCP. That is after a TCP connection is established, an SSL handshake can be started. When it is completed, all communication will be encrypted and ...
1
vote
2answers
43 views

What is this weird localhost IP traffic on multiple ports in the 5400-5600 range?

I am encountering an issue I recently have seen in my Fedora 23 machine (latest updates). I am getting about 130 IP packets passed back and forth over the lo interface in one go, every 1 second (like ...
1
vote
0answers
11 views

Why is the maximum port range 65535 in the TCP/IP Suite ? [migrated]

My doubt is that - a port is just logical, so why such restriction ? Why can't I have a port of 9924593 or something like that ?
0
votes
1answer
58 views

OS fingerprinting via TCP

I have searched online about this topic and the only information I got is that TCP SYN/ACK can be used to know the type of the target OS. If that is true, I don't understand how this occurs? Does TCP ...
1
vote
1answer
26 views

How can you spoof a TCP connection to a device that uses the same initial sequence number for each run of a TCP handshake?

So supposing the TCP implementation on a device always uses the same initial sequence number how could you as an off path attacker exploit this to spoof a connection to this device? So in order to do ...
2
votes
1answer
178 views

Random SYN_SENT connections to Amazon EC2?

I have looked around but couldn't find anyone else with this issue. On my console (standard asus i7 laptop) running Ubuntu 14.04 LTS - I noticed in tcptrack that there are a lot of connections being ...
0
votes
3answers
149 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
2
votes
3answers
298 views

Security concerns with TCP holding onto out-of-order packets?

Consider the following... Alice and Bob are communicating over TCP. Currently, the next expected TCP sequence number is 1000. Charlie, pretending to be Alice, sends a spoofed TCP packet to Bob with ...
1
vote
0answers
38 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
2
votes
0answers
58 views

Mitm Proxy using c# SslStream issues when doing directly from host file [closed]

Im trying to create a local windows MITM proxy with C# to deal with a now unsupported application from a company that no longer exists. The Proxy has to only service one HTTPS domain which is being ...
9
votes
6answers
7k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
1
vote
2answers
161 views

Add SSL on top of existing TCP connection

This may sound as basic question for some but I have never done such thing. Imagine I basically have simple TCP client implemented on C# (e.g. TCPClient class) and simple TCP server implemented using ...
0
votes
0answers
116 views

Is this c# digital signature implementation secure?

The code connects multiple clients to a server using TCP sockets asynchronously. I have added code to attach a digital signature to the outgoing messages from the server, to authenticate the message ...
3
votes
3answers
7k views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
0
votes
2answers
152 views

Beginner > Medium > Advanced Books/Guides/Tutorials on TCP/IP [closed]

Long time web developer looking to get into infosec. Was hoping on guidance on material from a beginners stance on TCP/IP and hopefully "networks". I realise the massive generalisation I'm making but ...
1
vote
1answer
369 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
8
votes
1answer
86 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
4
votes
3answers
1k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
1
vote
2answers
305 views

Spoofing TCP/IP stack OS Fingerprinting attacks in OSX

We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks. For Windows machines there are tools/guides for doing that, but can't find ...
1
vote
1answer
66 views

Didn't understood what the purpose of the newly discovered TCP Faking attack

Source: http://lgms.nl/blog-2 Hey guys, I've been reading through the research paper but didn't understand the purpose of the attack. What the attacker will want to exploit here ?
-1
votes
2answers
177 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
1
vote
0answers
38 views

Snort signatures not working [closed]

I am using snort to detect signature for IDS but some rule not detected by snort which is highlighted below. Kindly, sort this out, I'm stuck here.
1
vote
1answer
96 views

FIN Scan: sneak through certain non-stateful firewalls?

Many resources stated that FIN scan can bypass non-stateful firewall: In Nmap document: The key advantage to these scan types is that they can sneak through certain non-stateful firewalls and ...
0
votes
0answers
44 views

script for analysis of tcpdump log file

I'm trying to get the following metrics from my tcpdump log file: (1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter). ...
1
vote
1answer
73 views

Open TCP port on cable modem TG1672G

TG1672G cable modem in bridge mode, the modem's built in router still gets a IPv4/IPv6 public address (and devices connected to the modem can get public IPv4/IPv6 addresses too). This modem is Intel ...
3
votes
1answer
4k views

Security risk of opening port 111 (rpcbind)?

As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program ...
2
votes
1answer
64 views

Types of risks for my router

Recently I've read about viruses and worms that attack routers and do some nasty things, incl. DNS changes etc. In the beginning, I just read that some people have issues that their DNS server address ...
1
vote
1answer
33 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
1
vote
1answer
65 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
-1
votes
2answers
53 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
7
votes
2answers
183 views

If two programs on the same machine communicate through TCP, can it be seen from the outside?

Assume there are two programs running on the same computer at the same time. The computer is connected to a LAN. The two programs communicate via a TCP socket, and the socket is opened using the IP ...
3
votes
2answers
123 views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
-4
votes
1answer
64 views

UDP Out dated and insecure [closed]

UDP has so many flaws and the "performance" benefits are small and very niche. Often times TCP is even higher performing. UDP is inherently flawed in the way in which it operates. It leaves ...
0
votes
0answers
52 views

BitTorrent: how do cracked files get blocked and why is blocking some torrents unsuccessful/inefficient?

Not sure if this is a good question for this site, but suppose someone needs to find a torrent which contains a crack (perhaps one delivered from Hong Kong where it is legal to distrubute such ...
3
votes
3answers
997 views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
9
votes
3answers
2k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
-1
votes
3answers
1k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
11
votes
4answers
8k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
7
votes
2answers
1k views

Spoof IP adress after a TCP handshake

I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address. However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully? For ...
4
votes
2answers
104 views

Is encryption possible for simplex (one-directional) TCP/IP, and if so, how?

As explained in the TCP/IP Guide, it is possible to configure TCP/IP to operate in simplex mode and this mode is utilized, among other things, in communication from satellites. One consideration with ...