Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tcp]

Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

2
votes
0answers
70 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
1answer
34 views

TCP Hijacking and conflicting data handling on the OS level

Assuming I perform a TCP hijacking attack, by having access to the wire on which packets are being transmitted. In practice, the party to which I'm sending the hijack packet is going to receive the ...
0
votes
1answer
38 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
0answers
114 views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
-2
votes
2answers
131 views

Honeypot detection: How is TCP/IP implemented on honeypots?

I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol. I've been looking through the source code for a ...
0
votes
2answers
115 views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
1
vote
1answer
60 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
0answers
9 views

Any limitaion of clnt_call() in RPC communication?

I have a RPC server and RPC client. Am generating a secure key on client side using TPM1.2 chip. When i run my program for few times everything works fine. But When i run for many times then key is ...
0
votes
0answers
18 views

Confirming a tcp connection is encrypted not just encoded? [duplicate]

This is a follow up of this question. The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded. What I'm ...
1
vote
1answer
90 views

What ports are okay to be open on a macbook pro?

When I do a network scan for open ports on my MacBook Pro, I can see the following open TCP ports below. Are these 'standard' open port for a personal computer of this type? Should I be concerned? ...
0
votes
1answer
75 views

XMAS Scan vs Inverse TCP

Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing? XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
1answer
28 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
2
votes
2answers
393 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
76 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
1answer
316 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
-4
votes
1answer
110 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
0
votes
1answer
87 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
0
votes
1answer
169 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
3
votes
1answer
389 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
300 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
3
votes
0answers
137 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
1answer
287 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
1
vote
2answers
6k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
1
vote
0answers
67 views

network ports are filtered strangely?

I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server. However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
0
votes
1answer
102 views

What cipher mode is usually used for network traffic encryption?

I'm currently teaching myself about cryptography with the intentions of learning more about cryptanalysis. As of now I'm learning about cipher modes! I understand that I should be looking into CBC, ...
0
votes
1answer
1k views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
-2
votes
2answers
2k views

Hping3 doesn't work?

I was trying to perform a SYN flood attack, and I was using hping3. This is how the command looks like : sudo hping3 -S -a 192.168.100.88 --flood -p 80 192.168.100.15 Where 192.168.100.88 is a non-...
-2
votes
2answers
289 views

SYN-flood to the localhost Apache server

I've set up the apache server on localhost (127.0.0.1). I've downloaded PackETH to perform a DoS attack. So PackETH wants MAC-HEADER of the destination and source. And I don't know, where to find ...
3
votes
1answer
103 views

TCP timestamps: available to whom?

I was told that an adversary can figure out system uptime by looking at TCP timestamps. But I'm not sure who exactly can see this information. For example, if I set up a hardware Tor gateway so that ...
-1
votes
2answers
336 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
2answers
415 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
1
vote
0answers
68 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
4
votes
1answer
4k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
1
vote
2answers
457 views

What can I do to prevent BGP hijacking as an admin of some OVH's VPS?

I am an operator of some public service which is run on some OVH's VPS. Recently I was contacted by an anonymous contact, who suggested that the service was BGP-hijacked and some sensitive info of ...
0
votes
1answer
1k views

How whoer.net is able to get your TCP/IP's operation system&modem and its version

When running test on https://whoer.net/#extended On the OS section, TCP/IP column, I get Windows NT kernel [generic] (Ethernet or modem, MTU: 1500) The question would be how do they do that and is ...
3
votes
3answers
1k views

Is SSL/TLS pointless for IRC?

Assuming a network which has absolutely no support for SSL/TLS, as rationalised by this blog post, is it possible guarantee the security of privileged operator connections? There are already ...
-1
votes
1answer
587 views

Do I need SSL/TLS for TCP

It might sound stupid but I could not find the straight answer. Do I need to worry about communication security if I use only TCP socket to communicate between 2 machines? Is the byte stream can be ...
4
votes
1answer
229 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
0
votes
1answer
463 views

Web server responding to an HTTP request from a spoofed IP address

Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to ...
0
votes
0answers
310 views

Password-based client login over TCP/TLS

A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure. Is there a standard way to implement a ...
3
votes
2answers
310 views

How hard to receive a TCP packet then resend it to another IP on the local network keeping the Source IP address?

I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address. How can it be done, or how difficult is ...
5
votes
2answers
1k views

Is SYN DDoS the only type of TCP DDoS?

I have been reading up on different types of DDoS attacks recently and came upon DDoS distribution by type in 2017, by Kaspersky Labs. They list 5 different DDoS types: SYN, TCP, UDP, HTTP, ICMP In ...
-6
votes
1answer
129 views

What resources does a SYN flooding attack try to exhaust? [duplicate]

In a SYN flooding denial of service attack, what resource is the attacker trying to exhaust? RAM? CPU?
3
votes
1answer
492 views

Penetration Testing & TCP/IP Interview Question [closed]

I recently read that as a penetration tester you should be able to explain the TCP/IP protocol in depth, however these writers never say how in depth is good? Rewriting the protocols by hand type of ...
1
vote
1answer
2k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
36
votes
4answers
14k views

Why does TLS require TCP?

I have an upcoming oral network security exam and know that in past exams, the professor asked about why TLS requires TCP. I know that there is DTLS but it wasn't part of the lecture. So the question ...
2
votes
1answer
793 views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
1
vote
1answer
152 views

Protection against IP attacks [closed]

I wonder if an attacker sends a frame with an ACK flag to my boss' computer (for example) and then uses the broadcast IP to infect all the network, how could we protect against something like that? ...
-3
votes
2answers
1k views

Insecure/Obsolete TCP/UDP Ports? [closed]

I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure? This image ...