Collaborate Disseminate
I have started working with winpcap, and i got a funny situation with tcp/udp ports.
I wrote a packet forwarder, that sniff on interface and forward packets from specified ports. I do not open the ports because i sniff directly from interf… Continue reading Open TCP/UDP with no socket [closed]
I have started working with winpcap, and i got a funny situation with tcp/udp ports.
I wrote a packet forwarder, that sniff on interface and forward packets from specified ports. I do not open the ports because i sniff directly from interf… Continue reading Open TCP/UDP with no socket [closed]
By Christian Kreibich, Principal Engineer, Corelight The past few weeks have seen several developments around Community ID, our open standard for rendering network traffic flow tuples into a concise textual representation. I’d like to summarize them in… Continue reading Community ID support for Wireshark
By Christian Kreibich, Principal Engineer, Corelight The past few weeks have seen several developments around Community ID, our open standard for rendering network traffic flow tuples into a concise textual representation. I’d like to summarize them in… Continue reading Community ID support for Wireshark
My current project contains multiple heterogeneous TCP servers, but our IT guys have clearly declared that they will give me only one 443 port, which is fair enough.
Two options are on the table now. One is VPN. We can set up a VPN serve… Continue reading Exposing different services on the same port
My current project contains multiple heterogeneous TCP servers, but our IT guys have clearly declared that they will give me only one 443 port, which is fair enough.
Two options are on the table now. One is VPN. We can set up a VPN serve… Continue reading Exposing different services on the same port
From my understanding, TCP spoofing can be carried out if the attacker can correctly guess the sequence numbers from the response packets (to mimic the real client). The attacker may even obtain this sequence of numbers via sniffing. Furth… Continue reading Does an attacker need to guess or brute-force a password for TCP spoofing?
I know TCP SYN packets can be sent using PF_PACKET raw sockets. If I put the wrong source IP address in the ethernet frame, the router doesn’t change the source IP address? and spoofing source mac address is needed?
If I send packets using… Continue reading How IP spoofed syn flood works? [closed]
By Richard Bejtlich, Principal Security Strategist, Corelight This post contains a warning and a solution for anyone using BPF syntax when filtering traffic for network security monitoring. Introduction I have been writing material for the Zeek docume… Continue reading Mixed VLAN tags and BPF syntax
I have a Python client and server communicating over a TCP socket – they send and receive a certain set of standardized string commands to each other.
How can I prevent a hacker from creating their own client that sends the same kind of st… Continue reading How Can I Prevent Hackers From Spoofing TCP messages onto my server?