Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

learn more… | top users | synonyms

23
votes
1answer
1k views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
14
votes
3answers
1k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
12
votes
2answers
2k views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
11
votes
4answers
3k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
10
votes
3answers
3k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
9
votes
3answers
18k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
7
votes
4answers
4k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
7
votes
2answers
124 views

Why do ISPs allow faked source IP addresses?

Ok so apparently you can specify a source IP when doing a SYN request or something. Besides just asking why in the world that would even be allowed, I will move past that because I want to understand ...
6
votes
3answers
2k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
2answers
559 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
6
votes
1answer
159 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
5
votes
2answers
2k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
5
votes
3answers
154 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
5
votes
1answer
148 views

Explain the last part of how Mitnick hacked Tsutomu Shimomura with an IP sequence attack

I was reading up on why TCP ISNs need to be randomized, which led me to this write up by Tsutomu Shimomura. I understood how IP address spoofing and predicting the ISN helped the attacker establish a ...
5
votes
1answer
919 views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
4
votes
1answer
3k views

Why is the server returning 3 SYN + ACK packets during a SYN scan?

When you do a SYN scan against a opened TCP port (not filtered by Firewall), the server normally returns 3 SYN + ACK packets. So, why 3 of that? The target server is a Linux machine if relevanted ...
4
votes
1answer
970 views

How are ACK storms created and what's a good mitigation strategy for them?

The context is network based load balancers. It would be nice if someone could explain how TCP ACK storms are generated in real life and practical mitigation strategies for them. Edit: Clarification ...
4
votes
1answer
127 views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
4
votes
3answers
2k views

Multiple SSL connections in a single HTTPS web request

I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS]. The Chrome developer tool shows that only one HTTP connection is established, ...
4
votes
1answer
153 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
4
votes
0answers
53 views

Malware / vulnerability that uses or causes malformed IP or TCP Headers

I'm curious if there are any examples of malformed IP or TCP headers (for example, checksums that don't match, reserved bits that aren't zero, or poor header length numbers) used by malware, or that ...
3
votes
2answers
2k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
3
votes
3answers
21k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
3
votes
3answers
869 views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
3
votes
1answer
107 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
3
votes
2answers
141 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
3
votes
2answers
41 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
3
votes
1answer
298 views

How is the TLS protected against length field of the header being modified?

I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes.. Packets in the TLS protocol consist of a 5 ...
3
votes
1answer
656 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
2
votes
3answers
3k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
2
votes
2answers
673 views

Firewall & TCP Traffic

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial ...
2
votes
2answers
37 views

Any way to circumvent a 'filtered' response on NMap?

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this? Is it possible that the ...
2
votes
2answers
173 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
2
votes
2answers
141 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
2
votes
1answer
83 views

Downloading operating systems vulnerable to TCP amplification

I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing. From what I have researched mostly ancient linux kernels (2.0.x and below) and ...
2
votes
1answer
270 views

IPSec sequence number

I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication. Is it not an ...
2
votes
2answers
1k views

Identify HTTPS vs Application SSL Traffic

Scenario A: A user points his web browser to https://users.server.com. The website completes the SSL handshake and continues with the HTTP protocol inside SSL. Scenario B: (server-side) Now, let's ...
2
votes
3answers
918 views

Filtering In Iran

Since many of you already know the Iranian government aggressively uses internet censorship to block sites such as facebook, flicker, bbc, etc. The Iranian people use various methods to bypass ...
2
votes
1answer
81 views

Security over multi-streaming such as SCTP

I refer to multi-streaming as the ability to send two or more streams of some unit of data (block, byte streams) in one established association/context. SCTP is an example and the protocol I was ...
2
votes
3answers
268 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
2
votes
2answers
562 views

What are good approaches to modify TLS/SSL trafic in order to make a HTTP bot?

If I wanted to make a bot that plays/issues automatic actions/moves in a online browser game, whose communication is realized over HTTP1/1 and WebSocket (https and wws respectively), all TLS ...
2
votes
1answer
255 views

Security implications for two applications communicating with TCP/IP on localhost

Considering this for the local loopback connection: - It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller. If ...
2
votes
1answer
2k views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
2
votes
1answer
80 views

Does SSL or HIP solve all TCP/IP security problem?

I recently read this paper "A Look Back at Security Problems in the TCP/IP Protocol Suite" (https://www.cs.columbia.edu/~smb/papers/acsac-ipext.pdf) explaining few attacks at the TCP/IP stack. One ...
2
votes
2answers
186 views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
1
vote
2answers
269 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
1
vote
2answers
77 views

Is it secure to split information into multiple packets?

I just stumbled upon this SO question. I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately. Could ...
1
vote
1answer
835 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when I write this is allowed: alert icmp any any -> any any ...
1
vote
2answers
2k views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
1
vote
1answer
41 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...