Network stack (dode) - attack patterns on each layer & how to defend it

From Computing and Software Wiki

(Difference between revisions)
Jump to: navigation, search
(m)
Line 1: Line 1:
 +
What each layer does:
- Application/Presentation
- Application/Presentation
Line 7: Line 8:
- Network:  
- Network:  
 +
IP: routed
IP: routed
Line 17: Line 19:
- Physical: mcaddress
- Physical: mcaddress
 +
 +
 +
 +
----
 +
 +
 +
Examples of Attacks on each layer:
 +
 +
'''- Application/Presentation:'''
 +
 +
 +
'''- Session'''
 +
 +
 +
'''- Transport'''
 +
 +
 +
'''- Network:'''
 +
 +
 +
spoofing:
 +
 +
1. fire wall
 +
 +
2. internal
 +
 +
 +
denial of service:
 +
 +
1. IP routing defined
 +
 +
2.not defined: declare fake IPs, send Zillions, ttl
 +
 +
 +
'''- Data link:'''
 +
it is the easiest, & can only be done on local network
 +
 +
Switch's routing table looks like this:
 +
      mcaddress              ip
 +
    ..blah...blah..        ..192.168....
 +
    ....blah blah..        ....192.168.1..
 +
 
 +
the pirate will fill the routing table with mc IDs saying you are all of them. (is is called spoofing)
 +
 +
 +
'''- Physical''' : some one can physically take away your network card or unplug your internet cable.
 +
 +
 +
----
 +
 +
 +
How to defend each attack on each layer:
 +
 +
 +
- Application/Presentation
 +
 +
 +
- Session
 +
 +
 +
- Transport
 +
 +
 +
- Network
 +
 +
 +
- Data link:
 +
 +
1. read only routing table: preferred method
 +
 +
2.
 +
 +
 +
- Physical : Don't let people touch your computer :) it gets more complicated with wireless technologies

Revision as of 19:20, 22 March 2008

What each layer does:

- Application/Presentation


- Transport: transports packets to the correct protocol


- Network:


IP: routed

IPX: not routed


- Data link: Drive data to correct protocols


- Physical: mcaddress



Examples of Attacks on each layer:

- Application/Presentation:


- Session


- Transport


- Network:


spoofing:

1. fire wall

2. internal


denial of service:

1. IP routing defined

2.not defined: declare fake IPs, send Zillions, ttl


- Data link: it is the easiest, & can only be done on local network

Switch's routing table looks like this: 

      mcaddress              ip
   ..blah...blah..        ..192.168....
   ....blah blah..        ....192.168.1..

the pirate will fill the routing table with mc IDs saying you are all of them. (is is called spoofing)


- Physical : some one can physically take away your network card or unplug your internet cable.



How to defend each attack on each layer:


- Application/Presentation


- Session


- Transport


- Network


- Data link:

1. read only routing table: preferred method

2.


- Physical : Don't let people touch your computer :) it gets more complicated with wireless technologies

Retrieved from "http://wiki.cas.mcmaster.ca/index.php/Network_stack_(dode)_-_attack_patterns_on_each_layer_%26_how_to_defend_it"
Personal tools