I'm home learning a course/certificate for pen-testing and security analysis. I came into a part in the process of pen-testing Perimeter Devices, specifically at testing the Router.

At this point I'm advised to do a Testing for Package Leakage at the Router. A little explanation in that part stats that some router may disclose its identity while connecting on certain ports.

For example 'Cisco' in the payload with a 'RST' response after connecting on port 1999 (TCP).

Unfortunately, there is no more information about this part even after I did some search. So my questions are:

What is Package Leakage?

What exactly this step and how to try it for any Router?

How this is differs from OS Scan and Ports Scan?

What tools (if any) to use in this test?

closed as too broad by Teun Vink, Steffen Ullrich, Royce Williams, ThoriumBR, kasperd Dec 2 '18 at 0:40

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Isn't this a question for the people providing the course or its forums? – schroeder Nov 19 '18 at 9:39
  • I've mentioned that I'm learning it home, so I have just the material they provided (which lacks the seeked answers) online. Maybe I'll try tell them to update their contents, and that probably will take considerable time. However your comment confuses me about for what exactly StackExchange site for. – Ahmad Abdelghany Nov 19 '18 at 13:10
  • 2
    In a course, the context, meanings, tools, and expectations can be arbitrary and limited to just what the course covers. To ask outsiders might steer you away from the path that the instructors intended and confuse you. – schroeder Nov 19 '18 at 13:15
  • @schroeder I've tried in my question to take out any dependence on the context, ..., and focus on the concepts and practical parts. In the end it's all about using it in real world with other people from different training and background, like you and me. – Ahmad Abdelghany Nov 19 '18 at 13:37

Package Leakage is a general term for packets being sent somewhere where they should not be sent. There's no exact list of every possible scenarios, but as example - packets with non-routable IP addresses that are only valid on the LAN being sent to the ISP is one concrete Package Leakage situation.

In such a case, to avoid packet leakage, you must enable a packet filtering functionality and specify that packets from the local network should not be sent outside the local network. NAT takes care of towards-outside special communications if needed.

Another example may be when you use VPN. You will want in such a case the VPN-protected content to go through the VPN and the rest of the general traffic through the normal connection. (Package Leakage like all default traffic through VPN may cause your VPN service to halt.)

The OS part is something else entirely. There, you will most likely get excessive CPU usage, which can cause you PC to run slow or freeze. Programs can cause it or abnormal network traffic can cause it.

Ports scans are completely unrelated to Package Leakage. Determining the status of open ports has nothing to do with Package Leakage, but it may help improve security of a device like a router.

AS for tools, you can use pretty much any network sniffing/monitoring tool like wireshark to determine if you have abnormal packets in your network traffic.

  • Thank you for your nice explanation. Do you know some symptoms on such packages, to be used in spotting/filtering (in a sniffed packets) them. – Ahmad Abdelghany Nov 19 '18 at 12:53
  • Software like wireshark usually highlights the lines that are under such a category, so they should be easy to spot. – Overmind Nov 20 '18 at 6:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.