Hot answers tagged

113 votes
Accepted

What layer is TLS?

The OSI model, that categorizes communication protocols into successive layers, is just that: a model. It is an attempt at pushing a physical reality into neatly defined labelled boxes. Nobody ever ...
user avatar
  • 168k
48 votes
Accepted

Why is my computer making requests to my Roku about spotify?

It appears to be a feature called Spotify Connect. Spotify allows you to play music from you phone or computer using your Roku or smart TV, as most people will likely have better sound systems for ...
user avatar
36 votes

What layer is TLS?

TCP/IP Model Link Layer Internet (IP) Layer Transport Layer Application TLS operates between the Transport layer and the Application Layer (kind of). Really it just wraps Application Layer traffic ...
user avatar
  • 12.3k
29 votes
Accepted

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

The common, low-level attackers (i.e. people in their home) cannot efficiently spoof their IP address for TCP connection because they will not receive answers. Remember that IP routes packets based on ...
user avatar
  • 168k
27 votes
Accepted

Is it possible to see a packet before encryption?

With the availability of browser extensions, actually reading the traffic should be quite doable. If both the malware and web browser run as the same user (and therefore can write to the browser ...
user avatar
  • 5,898
24 votes
Accepted

Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]

I presume you pulled this from the "capture HTTP GET requests" filter example. First, some notation: var[n] means the nth byte of var. var[n,c] means c bytes of var starting at offset n, e.g. var[3:...
user avatar
  • 132k
23 votes

Is it possible to see a packet before encryption?

The network traffic out of your browser gets encrypted before the browser calls send() to put it on the network. So to intercept it before encryption, you'd have to intercept it before it's sent at ...
user avatar
  • 82k
19 votes
Accepted

Packet Checksums

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no ...
user avatar
  • 15.7k
19 votes
Accepted

How can I extract the certificate from this pcap file?

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the ...
user avatar
11 votes

How was (is?) the ping of death attack possible with IPv4?

There are many reasons why packet dropping isn't implemented. One example is that there is a technology known as jumbo frames, which allows for up to 9000 bytes of payload. These are primarily ...
user avatar
  • 1,068
11 votes

How much traffic can a firewall node handle? Any real examples?

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
user avatar
  • 132k
9 votes
Accepted

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited ...
user avatar
8 votes

What layer is TLS?

This answer only addresses the "TLSP" sub aspect of the question. the list of IP protocol numbers includes "TLSP" as "Transport Layer Security Protocol". I had never heard of that protocol. It's ...
user avatar
8 votes

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View ...
user avatar
  • 2,184
7 votes

How to run a snort rule over pcap file

Supposing the rule is already in a Snort .rules file and snort.conf is configured to include the .rules with the rule to test... $ snort -r foo.pcap ...or... $ snort --pcap-single=foo.pcap ...from....
user avatar
7 votes

Packet Checksums

Not only can checksums be recomputed after a packet has been modified. This happens during normal operation of IP. It is not at all unusual for a router to have to update three different checksums on ...
user avatar
  • 5,392
7 votes
Accepted

Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings?

These devices work as a man in the middle, that is the communication is no longer end-to-end. Because the SSL encryption is terminated at the DPI device and re-encrypted the client does not see any ...
user avatar
7 votes
Accepted

When should I generate new public & private keys using RSA?

In general and with a few misunderstandings, what you said is correct. The main difference being that the ciphertext (e.g. after you encrypt the message with the public key) does not always look the ...
user avatar
  • 249
7 votes

Proxying MetaSploit through BurpSuite

Use the PROXIES environment variable (while in msfconsole) : set PROXIES HTTP:127.0.0.1:8080 Or run Metalsploit with proxychains (config at /etc/proxychains.conf) http://proxychains.sourceforge.net ...
user avatar
7 votes
Accepted

Why do I need root privileges to send a raw packet from a UNIX machine?

The security model in UNIX is traditionally centered around having hardware and network controlled by the network administrators and then having unprivileged users separate from these administrators ...
user avatar
6 votes

How was (is?) the ping of death attack possible with IPv4?

Was/is there a reason for a host to receive a packet larger than 84 byte total? There are several layers involved here, and that's the first part of the problem. ICMP's 84 bytes for a ping message ...
user avatar
  • 38.1k
6 votes
Accepted

How does ndpi actually detect the HTTP protocol?

What is the high level view of categorizing the packet as HTTP (or any "x" protocol)? Standard port numbers are as close as you get to an an official classification of application-layer ...
user avatar
  • 43.7k
5 votes

Send fake response(?packets) to a program

You are trying a replay attack. Those who design protocols know about replay attacks and try, usually successfully, to defeat them. Often that's done by using a timestamp or a random number (called ...
user avatar
  • 5,270
5 votes

How wireshark capture packets in LAN without arpspoof?

This is actually not a security question at all. The question you want to be asking is how one node on a network can see the packets that are not destined for it. For this answer, you need to ...
user avatar
  • 123k
5 votes
Accepted

Does HSTS prevent packet capturing in Wireshark

Let's back up a bit because you are asking about details on the extreme ends of a technology stack and your question misses the mark and doesn't make sense. Wireshark just captures packets, so you ...
user avatar
  • 123k
4 votes

What would a typical packet of a DDOS attack look like?

DDoS is devastating because it can use perfectly valid traffic, thereby bypassing defences looking for anomalies. It does it's damage due to the volume alone. There are DDoS attacks that can take ...
user avatar
  • 123k
4 votes
Accepted

RSnake's Slow Loris tool

This second part of data sent is actually part of a loop on order to artificially keep some activity on the line. If your script was only opening the connection to the server, send the first header, ...
user avatar
4 votes

Slow internet - Worried about spammed packets

That first IP at least is owned by a Russian telecom: Address lookup canonical name broadband-46-18-200-212.clients.kubtel.ru. aliases addresses 46.18.200.212 Queried whois.ripn.net ...
user avatar
  • 2,658
4 votes
Accepted

Wireshark displays sql calls - Prevention

This is a configuration issue with the database. Most modern databases offer transport encryption, though many are not enabled by default. Here are some links for setting up SSL on popular SQL ...
user avatar
  • 5,454

Only top scored, non community-wiki answers of a minimum length are eligible