Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tcp]

Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

-1
votes
0answers
35 views

Why network connections “resuming” from kernel suspend/hibernate are caught as TCP port scan attempts?

I'm learning how to properly configure iptables to fend off TCP port scans on a hosted Linux-based VPS -- I'm not particularly interested in blocking this kind of attack, but rather in understanding ...
1
vote
1answer
27 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
0
votes
0answers
68 views

A server that must only serve itself but listens on all network interfaces

Imagine a server that is only supposed to serve itself (restricted to TCP by a standard). Naturally, it would only listen on the loopback interface and never worry about attacks from outside networks. ...
2
votes
2answers
150 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
60 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
1answer
110 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
-4
votes
1answer
97 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
0
votes
1answer
44 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
0
votes
1answer
147 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
3
votes
1answer
179 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
154 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
3
votes
0answers
129 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
1answer
149 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
1
vote
2answers
2k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
1
vote
0answers
45 views

network ports are filtered strangely?

I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server. However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
0
votes
1answer
94 views

What cipher mode is usually used for network traffic encryption?

I'm currently teaching myself about cryptography with the intentions of learning more about cryptanalysis. As of now I'm learning about cipher modes! I understand that I should be looking into CBC, ...
0
votes
1answer
590 views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
-2
votes
2answers
1k views

Hping3 doesn't work?

I was trying to perform a SYN flood attack, and I was using hping3. This is how the command looks like : sudo hping3 -S -a 192.168.100.88 --flood -p 80 192.168.100.15 Where 192.168.100.88 is a non-...
-2
votes
2answers
201 views

SYN-flood to the localhost Apache server

I've set up the apache server on localhost (127.0.0.1). I've downloaded PackETH to perform a DoS attack. So PackETH wants MAC-HEADER of the destination and source. And I don't know, where to find ...
3
votes
1answer
91 views

TCP timestamps: available to whom?

I was told that an adversary can figure out system uptime by looking at TCP timestamps. But I'm not sure who exactly can see this information. For example, if I set up a hardware Tor gateway so that ...
-1
votes
1answer
221 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
2answers
252 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
0
votes
0answers
25 views

How to improve the authorization and client-server interaction scheme?

I'm creating a Qt-server which uses SSL via TCP. Clients can authorize themselves on the server using login and password and become users. Only users can perform any actions with their accounts. ...
1
vote
0answers
66 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
3
votes
1answer
2k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
1
vote
2answers
361 views

What can I do to prevent BGP hijacking as an admin of some OVH's VPS?

I am an operator of some public service which is run on some OVH's VPS. Recently I was contacted by an anonymous contact, who suggested that the service was BGP-hijacked and some sensitive info of ...
0
votes
0answers
366 views

How to perform TCP replay attacks?

I have a device A which is connected to a wireless router and I have my PC which is also connected to the wireless router. So using the TCPDUMP on the wireless router I captured the communication ...
0
votes
1answer
843 views

How whoer.net is able to get your TCP/IP's operation system&modem and its version

When running test on https://whoer.net/#extended On the OS section, TCP/IP column, I get Windows NT kernel [generic] (Ethernet or modem, MTU: 1500) The question would be how do they do that and is ...
3
votes
3answers
908 views

Is SSL/TLS pointless for IRC?

Assuming a network which has absolutely no support for SSL/TLS, as rationalised by this blog post, is it possible guarantee the security of privileged operator connections? There are already ...
-1
votes
1answer
177 views

Do I need SSL/TLS for TCP

It might sound stupid but I could not find the straight answer. Do I need to worry about communication security if I use only TCP socket to communicate between 2 machines? Is the byte stream can be ...
4
votes
1answer
175 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
0
votes
1answer
397 views

Web server responding to an HTTP request from a spoofed IP address

Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to ...
0
votes
0answers
255 views

Password-based client login over TCP/TLS

A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure. Is there a standard way to implement a ...
3
votes
2answers
184 views

How hard to receive a TCP packet then resend it to another IP on the local network keeping the Source IP address?

I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address. How can it be done, or how difficult is ...
5
votes
2answers
860 views

Is SYN DDoS the only type of TCP DDoS?

I have been reading up on different types of DDoS attacks recently and came upon DDoS distribution by type in 2017, by Kaspersky Labs. They list 5 different DDoS types: SYN, TCP, UDP, HTTP, ICMP In ...
-6
votes
1answer
94 views

What resources does a SYN flooding attack try to exhaust? [duplicate]

In a SYN flooding denial of service attack, what resource is the attacker trying to exhaust? RAM? CPU?
3
votes
1answer
413 views

Penetration Testing & TCP/IP Interview Question [closed]

I recently read that as a penetration tester you should be able to explain the TCP/IP protocol in depth, however these writers never say how in depth is good? Rewriting the protocols by hand type of ...
1
vote
1answer
1k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
33
votes
4answers
11k views

Why does TLS require TCP?

I have an upcoming oral network security exam and know that in past exams, the professor asked about why TLS requires TCP. I know that there is DTLS but it wasn't part of the lecture. So the question ...
2
votes
1answer
567 views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
1
vote
1answer
151 views

Protection against IP attacks [closed]

I wonder if an attacker sends a frame with an ACK flag to my boss' computer (for example) and then uses the broadcast IP to infect all the network, how could we protect against something like that? ...
-3
votes
2answers
879 views

Insecure/Obsolete TCP/UDP Ports? [closed]

I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure? This image ...
3
votes
1answer
422 views

How to determine if a google photos file transfer is really encrypted

Inspecting packets during a file transfer with an iOS application such as Google Photos. How would one know from packet inspecting if uploading a file is done securely despite being on a public ...
0
votes
1answer
189 views

If TCP is more “secure” than UDP, how would a practical UDP “attack” look, for example during the initiation of a MS RDP connection?

In accordance to the recent question Why is TCP more secure than UDP?. How would an "attack" look when it comes to the practical aspect? A great example would be the use of TCP or UDP for Microsoft ...
54
votes
11answers
25k views

Why is TCP more secure than UDP?

During reading MS SDL presentations I found a recommendation to replace UDP by TCP in applications because TCP is more secure than UDP. But both of them are only transport layers, nothing more. So ...
1
vote
1answer
396 views

Can a device accidentally transmit a Teardrop attack?

On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from ...
0
votes
2answers
876 views

Trying to examine URL redirection in Wireshark

I clicked on a link (indistannews.com) and was redirected to a different website (sexiniowa.com). [Warning - the latter site is a pornography website]. I looked at the transaction in Wireshark to try ...
0
votes
1answer
3k views

Good Default TCP Connection Timeout Time

I am trying to configure the firewall at our company and I was wondering what a good default TCP connection timeout would be. We currently have it set for 10 minutes but I feel like this is too long ...
2
votes
0answers
126 views

Any Known countermeasures against clock skew fingerprinting?

I know lots of websites that do clock skew fingerprinting using tcp timestamps. I know how to disable timestamps but i want to know techniques that can be used to counter clock skew fingerprinting. I ...