Questions tagged [tcp]

Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

Filter by
Sorted by
Tagged with
54
votes
11answers
31k views

Why is TCP more secure than UDP?

During reading MS SDL presentations I found a recommendation to replace UDP by TCP in applications because TCP is more secure than UDP. But both of them are only transport layers, nothing more. So ...
37
votes
4answers
16k views

Why does TLS require TCP?

I have an upcoming oral network security exam and know that in past exams, the professor asked about why TLS requires TCP. I know that there is DTLS but it wasn't part of the lecture. So the question ...
34
votes
1answer
6k views

I have found ports on my Samsung smart tv running a display service. What can I do with it? [closed]

I have a Samsung Smart TV running Tizen OS, and out of curiosity I scanned it with Nmap. I found multiple open ports. One of those ports is running a "display" service. Does this mean it can cast its ...
29
votes
2answers
5k views

How is this “captive portal” intercepting and manipulating my HTTP requests?

I sometimes use a free Wifi service to get access to the internet. Like most/all providers of services like this, this service employs a captive portal. So if you try to make a HTTP request (request a ...
27
votes
4answers
21k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP numbers. Can anyone connect that web ...
27
votes
4answers
7k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
23
votes
1answer
2k views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
22
votes
3answers
53k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve traceroute ...
18
votes
3answers
8k views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
17
votes
1answer
42k views

Security risk of opening port 111 (rpcbind)?

As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
12
votes
3answers
3k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
12
votes
2answers
15k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
11
votes
4answers
4k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
10
votes
3answers
12k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
10
votes
1answer
5k views

TCP “off-path” Attack (CVE-2016-5696)

Today I read that a flaw in a recent TCP specification leads to the injection of malicious content between the two communicating parties. How does the attack vector work? I have also read a post in ...
10
votes
1answer
660 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
10
votes
2answers
1k views

Can a TCP connection be terminated by an attacker if SSL/TLS has been used to protect data in the TCP segment?

I understand that SSL/TLS is built on top of TCP. That is after a TCP connection is established, an SSL handshake can be started, when it is completed, all communication will be encrypted and ...
9
votes
2answers
2k views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
9
votes
6answers
18k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
9
votes
2answers
7k views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
8
votes
2answers
2k views

Spoof IP address after a TCP handshake

I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address. However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully? For ...
8
votes
3answers
6k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
8
votes
3answers
2k views

Ensuring security of deserializing data using Protobuf-net

I am interested in using protobuf-net to serialize/deserialize data sent across my TCP applications. I learnt of protobuf-net a few weeks ago and downloaded it from here and plan to use it in my ...
8
votes
1answer
355 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
7
votes
3answers
17k views

Why no support for TCP Sockets in JavaScript

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
7
votes
3answers
47k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
7
votes
4answers
2k views

implications of incomplete TCP handshake session

In network security, why do we care about knowing incomplete TCP handshake sessions? Is there a security implication behind this?
7
votes
2answers
173 views

Why do ISPs allow faked source IP addresses?

Ok so apparently you can specify a source IP when doing a SYN request or something. Besides just asking why in the world that would even be allowed, I will move past that because I want to understand ...
7
votes
1answer
256 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
7
votes
2answers
2k views

If two programs on the same machine communicate through TCP, can it be seen from the outside?

Assume there are two programs running on the same computer at the same time. The computer is connected to a LAN. The two programs communicate via a TCP socket, and the socket is opened using the IP ...
6
votes
1answer
8k views

Why is the server returning 3 SYN + ACK packets during a SYN scan?

When you do a SYN scan against a opened TCP port (not filtered by Firewall), the server normally returns 3 SYN + ACK packets. So, why 3 of that? The target server is a Linux machine if relevanted ...
6
votes
2answers
9k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
6
votes
3answers
3k views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
6
votes
0answers
730 views

TCP Sack panic proof of concept?

For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies? [1] ...
5
votes
1answer
6k views

How are ACK storms created and what's a good mitigation strategy for them?

The context is network based load balancers. It would be nice if someone could explain how TCP ACK storms are generated in real life and practical mitigation strategies for them. Edit: Clarification ...
5
votes
2answers
1k views

Is SYN DDoS the only type of TCP DDoS?

I have been reading up on different types of DDoS attacks recently and came upon DDoS distribution by type in 2017, by Kaspersky Labs. They list 5 different DDoS types: SYN, TCP, UDP, HTTP, ICMP In ...
5
votes
2answers
2k views

Encrypt and Authenticate localhost-traffic?

I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential. ...
5
votes
3answers
30k views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
5
votes
1answer
2k views

Can a Cisco ASA 5505 block this DDoS attack?

Since more than a week ago, my dedicated server (located in ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load (...
5
votes
1answer
1k views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
5
votes
1answer
811 views

Security implications for two applications communicating with TCP/IP on localhost

Considering this for the local loopback connection: - It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller. If two ...
5
votes
1answer
3k views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
5
votes
1answer
249 views

Any Known countermeasures against clock skew fingerprinting?

I know lots of websites that do clock skew fingerprinting using tcp timestamps. I know how to disable timestamps but i want to know techniques that can be used to counter clock skew fingerprinting. I ...
4
votes
4answers
10k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
4
votes
3answers
10k views

Is it possible to send HTTP packet via spoofed IP?

I have the following PHP code that writes accepted to a file named text.txt only if the IP is equal to 127.0.0.1 (loopback). If the IP doesn't match it writes denied. <?php $file = fopen('text.txt'...
4
votes
3answers
2k views

Why aren't TCP sockets encrypted by default?

I've been wondering this for as long as I've been programming, Why aren't TCP sockets encrypted by default? Everyone always says that using raw sockets is dangerous as all packets sent are susceptible ...
4
votes
3answers
274 views

Is it possible to have a protocol that sits on top of TCP/IP that encrypts packets?

I was wondering if it is possible to make a new protocol which sits on top of TCP/IP and encrypts the packet which is going to be sent. One of the issues I can see is the metadata being available ...
4
votes
2answers
5k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
4
votes
1answer
271 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...