Hot answers tagged routing
9
No, because knowledge of the method is not enough to break it. You would also need to acquire information (e.g. Decryption keys), which simply cannot be obtained by an attacker.
The attacker can't figure out the source IP, or look at the data. Each Tor node only "knows" the source and destination of a block of data that it is handling. It can't open it to ...
8
That seems to be a NetGear log entry, there are two possibilities for this:
SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...
7
I'll take a crack at explaining this without technical jargon.
Lets say you want to send a nasty letter to someone, but you'd rather not deliver the letter in person for fear that they might get angry with you.
You can ask a courier to take the letter from your house, and deliver it to the recipient, right? That works, but has the problem that the courier ...
5
It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel.
Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network ...
4
Most consumer grade routers don't have any prohibition against it, it just doesn't work.
Imagine the following scenario. This isn't hypothetical, just run tcpdump on your own computer and you'll see it happen right now. Captured from my Buffalo ddwrt moments ago just to verify.
Players: [Router: 10.0.0.1] [Computer1: 10.0.0.3] [Computer2: 10.0.0.4]
...
4
Well that's happening because it's probably using NAT for router B. It's not bad but it's not bad practice. Obviously if they can get into router A then technically they can indeed take over the network. So if router B sends traffic router A will see that flow.
Now if you want a good setup, the key is to make several subnets and restrict them accordingly. ...
3
There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB ...
3
To complete the message from @mr.spuratic: the text from RFC 791 is:
Loose Source and Record Route
+--------+--------+--------+---------//--------+
|10000011| length | pointer| route data |
+--------+--------+--------+---------//--------+
Type=131
The loose source and record route (LSRR) option provides a means
for the ...
3
Without a specific attack scenario, a well defined threat, a well defined event that is supposed to not happen ... this "security" claim has no merit whatsoever.
If you meet a guy who speaks about "security", ask him what are the possible attacks and the bad things that could happen according to him. And if he cannot answer, tell him to shut up.
Discussion ...
3
The only solution I can think of is to run two isolated networks: one for the wired ports, one for clients on the wifi AP. This allows wifi clients to talk to wifi clients and the internet, and office PCs to talk to office PCs and the internet, but no interplay between the two. In terms of addressing, you'd probably need to put them on separate subnets, e.g. ...
2
The simple answer is that it isn't. Anyone can operate a TOR exit node and it can easily be used to MiTM your traffic. TOR isn't meant to secure your transactions, TOR is meant to protect your identity, which is still not always 100% reliable. If your host is compromised (which it is still the same risk as browsing without it, if not more dangerous as ...
2
No. Though reducing your direct exposure to the Internet with NAT does reduce some risks as long as you are on an Internet connected network there are many ways for attackers to reach you.
Examples of tactics that evade or ignore NAT (not complete):
application vulnerabilities in client/server (web browser) or peer to peer software (Skype) you run.
...
2
Just in case there's a misunderstanding, it's not "lose", it's "loose", as in specified in a relaxed way. The IP header source address is unchanged by this (the destination address may be changed on the way though). I think it helps to selectively read "source-specified address" instead of just "source address" in this context.
I've read the RFC section ...
2
When used in tunnel mode IPsec treats the IP packet as a payload. Therefore, all this information is encrypted. In order to be routed correctly, the IPSec-enabled entity then build a new packet.
This IP packet is built to be send to the tunnel end, e.g. another IPSec gateway. So as to achieve this, the new IP packet will have a brand new IP-Header, with ...
1
OSPF is a routing protocol in which the various routers involved in the process periodically shout: they broadcast "Link State Advertisements" which tell the other routers how things look like in their own vicinity. The fight-back mechanism is the following: when a router observes a LSA which states falsehoods about itself, the router is allowed (and ...
1
Hash authentication of protocol packets is not on by default in OSPF, you'll only see hash digests if digest authentication is on with a pre-shared key configured. If you're looking for the encrypted digest packets you'll find the information you're looking for in RFC 2328 section D.3
'Using this authentication type, a shared secret key is configured in all ...
1
It's not exactly security through obscurity,but more like circumstantial security.
Since clients of B are internally NAT'd, they can ping A but not the other way around, similar to how you can ping only the router of another friend on the Internet since they too are prolly in a NAT.
Speaking from experience in offensive security, a network like that can be ...
1
Encryption is the short answer. Each TOR client chooses a random path across the network and encrypts the packets with nested encryptions that each node it selects can open.
So for example, say I decided to talk to B then F then Q then A then C, I'd take my information encrypt it so that only C can read it and tell it where the final destination is. ...
1
Can't find a technical basis for this NAT loopback security issue claim. =)
The only loopback isssue that I can remember in my early days was hooking both ends of a cat5e's RJ45 to the same switch and messing up the LAN's connectivity. Back then, we call it a loopback. But it's pretty more technical rather than security issue.
Only top voted, non community-wiki answers of a minimum length are eligible
