Hot answers tagged

94

The OSI model, that categorizes communication protocols into successive layers, is just that: a model. It is an attempt at pushing a physical reality into neatly defined labelled boxes. Nobody ever guaranteed that it works... Historically, that model was built and published when the ISO was pushing for adoption of its own network protocols. They lost. The ...


48

It appears to be a feature called Spotify Connect. Spotify allows you to play music from you phone or computer using your Roku or smart TV, as most people will likely have better sound systems for their TVs than for their computer. Presumably your Spotify desktop app is automatically scanning your LAN and querying compatible devices to be able to offer this ...


33

TCP/IP Model Link Layer Internet (IP) Layer Transport Layer Application TLS operates between the Transport layer and the Application Layer (kind of). Really it just wraps Application Layer traffic in encryption during transport. The TLS Key Exchange happens in the in between layers. Here it's not really Transport Layer because things like port numbers, ...


29

The common, low-level attackers (i.e. people in their home) cannot efficiently spoof their IP address for TCP connection because they will not receive answers. Remember that IP routes packets based on the destination address, so if you send a packet with a fake source address, it may still reach the destination. Some routers may be offended at seeing a ...


27

With the availability of browser extensions, actually reading the traffic should be quite doable. If both the malware and web browser run as the same user (and therefore can write to the browser profile directory), then installation of browser extensions can be done relatively easily. You can also open the Web Developer Tools, typically accessible by ...


23

The network traffic out of your browser gets encrypted before the browser calls send() to put it on the network. So to intercept it before encryption, you'd have to intercept it before it's sent at all -- that is, within the browser itself. This isn't impossible, but it's a lot of work. An alternative is to set up a "Man In The Middle" proxy, such as ...


19

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no secrets/keys involved in the calculation. Checksums are intended to catch errors during the transmission of the packet: flipped bits, miscommunication, etc. ...


18

I presume you pulled this from the "capture HTTP GET requests" filter example. First, some notation: var[n] means the nth byte of var. var[n,c] means c bytes of var starting at offset n, e.g. var[3:4] would return bytes 3,4,5,6 of var. & is the bitwise AND operation. >> means bitwise shift right. So, what do we have? tcp[((tcp[12:1] & 0xf0) ...


13

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the packets. Pick the packet which contains the certificate, in this case packet 6. In the packet details expand Secure Socket Layer etc until you get to the certificate ...


11

There are many reasons why packet dropping isn't implemented. One example is that there is a technology known as jumbo frames, which allows for up to 9000 bytes of payload. These are primarily supported on LANs where large amounts of data are moved around, and where the repetitive nature of headers is unnecessary. It's also worth noting that most packets ...


11

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious downtime incident, I can safely say a few things: The marketing figures describing performance are at best a peak performance case, produced in a lab situation ...


9

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background ...


8

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


8

This answer only addresses the "TLSP" sub aspect of the question. the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". I had never heard of that protocol. It's not the protocol you use to display HTTPS pages. TLSP seems to be a very obscure protocol. And it was registered in 1994-10. This was before the protocol that ...


8

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: +1....


7

Not only can checksums be recomputed after a packet has been modified. This happens during normal operation of IP. It is not at all unusual for a router to have to update three different checksums on a packet before it will be able to forward an unmodified payload. The three checksums I am referring to are on the Ethernet, IP, and transport layers of the ...


7

These devices work as a man in the middle, that is the communication is no longer end-to-end. Because the SSL encryption is terminated at the DPI device and re-encrypted the client does not see any information of the original encryption, especially: Ciphers and protocol versions might be different, that is the client does not notice if the original server ...


6

Supposing the rule is already in a Snort .rules file and snort.conf is configured to include the .rules with the rule to test... $ snort -r foo.pcap ...or... $ snort --pcap-single=foo.pcap ...from... http://manual.snort.org/node8.html


6

Was/is there a reason for a host to receive a packet larger than 84 byte total? There are several layers involved here, and that's the first part of the problem. ICMP's 84 bytes for a ping message header (the payload can be larger... you can put whatever you'd like in the payload field) mean that the packets have to be received by the system on the wire ...


6

What is the high level view of categorizing the packet as HTTP (or any "x" protocol)? Standard port numbers are as close as you get to an an official classification of application-layer protocols. But in practice, services often don't adhere to their default ports and there is simply no universal way to detect which layer-7 protocol is being used. Therefore,...


5

Generally speaking, unless there's something specific that prevents them from doing so, then they can. Legally speaking, a contract might make this disallowed, but it's very unlikely that this would be in your contract. Similarly, local privacy laws might protect you. Either way, it's lawyer time - but how will you ever know? Technically speaking, ...


5

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


5

Good question. Let's think about it this way: You're going to take a basic maths exam and the sign on the door says "No Masters-level students. No calculators allowed." A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the ...


5

You are trying a replay attack. Those who design protocols know about replay attacks and try, usually successfully, to defeat them. Often that's done by using a timestamp or a random number (called a "nonce" by cryptographers) in a hash that's attached to a message. You can find some detail here: http://en.wikipedia.org/wiki/Replay_attack


5

In general and with a few misunderstandings, what you said is correct. The main difference being that the ciphertext (e.g. after you encrypt the message with the public key) does not always look the same, RSA introduces some random data and padding that cause the ciphertext produced to be different, even if the plaintext is the same. This probably won't ...


5

This is actually not a security question at all. The question you want to be asking is how one node on a network can see the packets that are not destined for it. For this answer, you need to understand how Ethernet networking works. Ethernet networks are broadcast networks, meaning that every node on the same segment can see every other node's traffic. No ...


4

If everything is made through HTTPS, all your application have to do is ensure the certificate is correct and valid. Man in the middle attack can only decrypt HTTPS traffic by ruining the original certificate and issuing a [generally] self-signed one to the local peer communication.


4

If you want to ensure security of your communications, in particular prevent Man-in-the-Middle attacks, you need much more than encryption. Encryption only provides confidentiality, but does not prevent alterations (e.g. replaying packets, dropping packets, reordering packets, switching bits...). You also need some integrity checks, and a way to guarantee ...


4

This is a configuration issue with the database. Most modern databases offer transport encryption, though many are not enabled by default. Here are some links for setting up SSL on popular SQL databases: 6.3.6 Using SSL for Secure Connections How to enable SSL encryption for an instance of SQL Server by using Microsoft Management Console


Only top voted, non community-wiki answers of a minimum length are eligible