I am planning to make a web application deployed on a port more secure by detecting the pattern of the request an then comparing it with the patern next time that IP tries to connect.Any ways to move forward.
10
-
Something like this en.wikipedia.org/wiki/Port_knocking? Or are you trying to fingerprint browsers, a la detectright.com ?– randomdudeCommented Mar 26, 2014 at 12:40
-
regex matching against the request is at the application layer; ports are a transport layer artifact. I'm not sure that I understand your request.– MCWCommented Mar 26, 2014 at 12:52
-
What threat, exactly, are you trying to mitigate?– Stephen TousetCommented Mar 26, 2014 at 22:01
-
Would be interesting to know more details as to what the goal is. Without more details though, and thinking creatively, I suppose Snort or a WAF could be employed (as well as a Proxy like @user2675345 suggested. A WAF or Proxy are most obvious to me, then Snort. Care to share any more specifics so we can better answer??– user1801810Commented Mar 26, 2014 at 23:08
-
@StephenTouset,I am employing a security system that is based on storing the IP address of the suspected source IP's and the port with which they are connecting.If the person spoofs his IP,then that security system will be foiled so that is the solution I am employing to check IP spoofing by checking the pattern of the request.– user1369975Commented Mar 29, 2014 at 10:25
|
Show 5 more comments
2 Answers
Sounds a lot like SYN Cookies. This is a method to prevent TCP SYN DoS attacks. Basically, when the server receives a TCP SYN packet, it creates a "cookie" with a hash of the values (specifically the source and sequence number), and then sends the ACK but does not create a "half open" connection. When the server receives a SYNC ACK, it uses the information to look for a corresponding "cookie", if found the connection is legit, if not the connection is not legit.
There are some interesting technical limitations on this method.
-
,thanks a lot but how to go about starting to implement this? Commented Apr 18, 2014 at 18:14
-
I believe this is already a implemented in Linux Systems. You need to configure and enable it: cyberciti.biz/faq/enable-tcp-syn-cookie-protection. Commented Apr 21, 2014 at 16:13
I'm not convinced of the advantages of such a system but with regards to implementing it:
You want a proxy application listening on the mentioned port so when requests for your web application come in, they go to the proxy first.
The proxy analyses the request and employs your pattern matching logic.
The proxy then forwards the request to the webapp (or not if it is deemed a "bad" request).
I'm cannot really recommend any existing tools but I'm pretty sure squid can do this (maybe not efficiently though).
