Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 365 Implementation5.1 IntroductionDevelopment of networking application is closely bond to the programming languagechosen to implement the product. After a quick research of the tools available on themarket, a decision was made to use Microsoft .NET and C#. This platform, designedby Microsoft, speeds up development by freeing the programmer from low-levelissues (memory management and etc.) and provides standards Windows controls thatcan be used in .NET applications. Microsoft .NET becomes more and more popular innetworking professionals’ community.5.2 Testing NetworkThe test network was implemented in a way to reassemble a basic scenario ofinstitutional intranet. Thus, a Cisco router is employed as a border gateway. Thisrouter provides network address translation (NAT), dynamic host allocation (DHCP)and state-full firewall services to the intranet. Consequently host machines and serversconnect to a Cisco Catalyst 2950 switch attached to the intranet port of the router(Fa0/1). The router’s other FastEthernet interface (Fa0/0), is connected to InternetService Provider (ISP). Since the design phase proposed experiments requiring codemobility testing, the test network is not homogenous. Thus, variety of hosts runningdifferent Windows based operating systems is connected to the test network (Figure5-1).Host 1Windows XPProfessional SP 2Host 2Windows 2000 ServerService Pack 3Fa0/1Fa0/0ISPHost 3Windows XPStarter Edition SP 2Host 4Windows XPHome Edition SP 2CiscoCatalystSwitchCiscoRouterFigure 5-1 Test Network TopologyTo provide for the requirements of experiments based on comparison of HTTPresponses to modified and unmodified requests, Host 3 is connected to the Ciscoswitch via two identical links. Thus, two separate Proxy servers can run on thismachine at the same time, each with its own listening interface (more details willfollow with experiments implementation description). The specification of the testnetwork components can be found in Table 5-1.