Questions tagged [tcp]

Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

Whether the `resets received for embryonic SYN_RECV sockets` and `invalid SYN cookies received` shows attacks there?

In my CentOS, I use netstat -s to check my CDN node server network summary. [root@hkk10 ~]# netstat -s Ip: 26529370 total packets received 6121 with invalid addresses 0 forwarded 0 ...
0
votes
0answers
69 views

Intercept TCP traffic using Python

Situation: I am trying to intercept TCP (not HTTP) traffic on a Windows machine using Python. I am posting this question as most answers I was able to find teaches how to sniff traffic. Normal ...
3
votes
2answers
290 views

Can I blindly trust 127.0.0.1?

On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
-1
votes
1answer
84 views

Tor relay on port 9001 TCP

I executed netstat -t on my linux terminal and noticied a tor relay running on port 9001. I've search about the IP address of relay on shodan and got a result that address is from Russia, after that i ...
7
votes
1answer
924 views

TCP Sack panic proof of concept?

For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies? [1] ...
0
votes
1answer
40 views

Connection changes after waking from sleep

On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID). I like to ...
34
votes
1answer
6k views

I have found ports on my Samsung smart tv running a display service. What can I do with it? [closed]

I have a Samsung Smart TV running Tizen OS, and out of curiosity I scanned it with Nmap. I found multiple open ports. One of those ports is running a "display" service. Does this mean it can cast its ...
2
votes
0answers
105 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
1answer
37 views

TCP Hijacking and conflicting data handling on the OS level

Assuming I perform a TCP hijacking attack, by having access to the wire on which packets are being transmitted. In practice, the party to which I'm sending the hijack packet is going to receive the ...
1
vote
1answer
62 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
788 views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
-2
votes
2answers
181 views

Honeypot detection: How is TCP/IP implemented on honeypots?

I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol. I've been looking through the source code for a ...
0
votes
2answers
212 views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
1
vote
1answer
116 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
0answers
12 views

Any limitaion of clnt_call() in RPC communication?

I have a RPC server and RPC client. Am generating a secure key on client side using TPM1.2 chip. When i run my program for few times everything works fine. But When i run for many times then key is ...
0
votes
0answers
19 views

Confirming a tcp connection is encrypted not just encoded? [duplicate]

This is a follow up of this question. The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded. What I'm ...
1
vote
1answer
164 views

What ports are okay to be open on a macbook pro?

When I do a network scan for open ports on my MacBook Pro, I can see the following open TCP ports below. Are these 'standard' open port for a personal computer of this type? Should I be concerned? ...
0
votes
1answer
211 views

XMAS Scan vs Inverse TCP

Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing? XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
1answer
28 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
2
votes
2answers
628 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
100 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
1answer
547 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
-4
votes
1answer
125 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
0
votes
1answer
105 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
0
votes
1answer
177 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
3
votes
1answer
585 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
408 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
4
votes
1answer
228 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
1answer
418 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
1
vote
2answers
10k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
0
votes
1answer
110 views

What cipher mode is usually used for network traffic encryption?

I'm currently teaching myself about cryptography with the intentions of learning more about cryptanalysis. As of now I'm learning about cipher modes! I understand that I should be looking into CBC, ...
0
votes
1answer
1k views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
-2
votes
2answers
2k views

Hping3 doesn't work?

I was trying to perform a SYN flood attack, and I was using hping3. This is how the command looks like : sudo hping3 -S -a 192.168.100.88 --flood -p 80 192.168.100.15 Where 192.168.100.88 is a non-...
-2
votes
2answers
334 views

SYN-flood to the localhost Apache server

I've set up the apache server on localhost (127.0.0.1). I've downloaded PackETH to perform a DoS attack. So PackETH wants MAC-HEADER of the destination and source. And I don't know, where to find ...
3
votes
1answer
109 views

TCP timestamps: available to whom?

I was told that an adversary can figure out system uptime by looking at TCP timestamps. But I'm not sure who exactly can see this information. For example, if I set up a hardware Tor gateway so that ...
-1
votes
2answers
381 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
3answers
583 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
1
vote
0answers
70 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
4
votes
2answers
6k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
1
vote
2answers
529 views

What can I do to prevent BGP hijacking as an admin of some OVH's VPS?

I am an operator of some public service which is run on some OVH's VPS. Recently I was contacted by an anonymous contact, who suggested that the service was BGP-hijacked and some sensitive info of ...
0
votes
1answer
1k views

How whoer.net is able to get your TCP/IP's operation system&modem and its version

When running test on https://whoer.net/#extended On the OS section, TCP/IP column, I get Windows NT kernel [generic] (Ethernet or modem, MTU: 1500) The question would be how do they do that and is ...
3
votes
3answers
1k views

Is SSL/TLS pointless for IRC?

Assuming a network which has absolutely no support for SSL/TLS, as rationalised by this blog post, is it possible guarantee the security of privileged operator connections? There are already ...
-1
votes
1answer
1k views

Do I need SSL/TLS for TCP

It might sound stupid but I could not find the straight answer. Do I need to worry about communication security if I use only TCP socket to communicate between 2 machines? Is the byte stream can be ...
4
votes
1answer
302 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
0
votes
1answer
560 views

Web server responding to an HTTP request from a spoofed IP address

Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to ...
0
votes
0answers
346 views

Password-based client login over TCP/TLS

A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure. Is there a standard way to implement a ...
3
votes
2answers
418 views

How hard to receive a TCP packet then resend it to another IP on the local network keeping the Source IP address?

I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address. How can it be done, or how difficult is ...
5
votes
2answers
1k views

Is SYN DDoS the only type of TCP DDoS?

I have been reading up on different types of DDoS attacks recently and came upon DDoS distribution by type in 2017, by Kaspersky Labs. They list 5 different DDoS types: SYN, TCP, UDP, HTTP, ICMP In ...
-5
votes
1answer
144 views

What resources does a SYN flooding attack try to exhaust? [duplicate]

In a SYN flooding denial of service attack, what resource is the attacker trying to exhaust? RAM? CPU?