09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Defense Against IP Denial of Service Attacks<br />

A denial of service attack exploits <strong>the</strong> three-way handshake used by TCP <strong>to</strong> establish<br />

transport sessions. To establish a TCP session, host-a initiates <strong>the</strong> session by<br />

sending a TCP packet with <strong>the</strong> SYN bit enabled and an Initial Sequence Number<br />

(ISN), which is used <strong>to</strong> track <strong>the</strong> order of all subsequent exchanges. The destination<br />

host-b receives this packet and returns a TCP packet with its own SYN and ISN,<br />

along with an acknowledgement (ACK) of <strong>the</strong> sending host's SYN. This is commonly<br />

referred <strong>to</strong> as <strong>the</strong> SYN-ACK step. When <strong>the</strong> initializing host (host-a) receives <strong>the</strong><br />

SYN-ACK, it sends an ACK of <strong>the</strong> destination host's (host-b) ISN. An attack is<br />

launched by a third host (host-c), which impersonates host-a. Host-c sends<br />

datagrams as host-a <strong>to</strong> host-b, and host-b in turn replies <strong>to</strong> <strong>the</strong> real host-a. Host-a,<br />

meanwhile, will not respond <strong>to</strong> any of <strong>the</strong> host-b datagrams, but <strong>the</strong>y will continue<br />

<strong>to</strong> fill host-a's buffers until <strong>the</strong>y overflow and <strong>the</strong> system crashes. The trick is that<br />

host-c needs <strong>to</strong> predict host-b's ISN, but because this is a systematically increasing<br />

number, all <strong>the</strong> attacker needs <strong>to</strong> do is sniff <strong>the</strong> initial SYN-ACK from host-b. This<br />

trick is not <strong>to</strong>o hard <strong>to</strong> do with <strong>the</strong> right <strong>to</strong>ols on <strong>to</strong>day's Internet.<br />

To defend against <strong>the</strong>se attacks, <strong>the</strong> IOS (11.2 and higher) provides TCP intercept<br />

on 4000 and 7×00 series routers. When enabled, <strong>the</strong> router acts as a bridge<br />

between <strong>the</strong> source and destination hosts. If <strong>the</strong> connection is valid, <strong>the</strong> data<br />

exchange proceeds between <strong>the</strong> servers until <strong>the</strong> session ends. If <strong>the</strong> session is an<br />

attack, <strong>the</strong> router times out <strong>the</strong> connection, and <strong>the</strong> destination server is never<br />

involved with <strong>the</strong> transaction. The software can also operate passively, permitting<br />

transactions <strong>to</strong> directly occur between hosts. These transactions are moni<strong>to</strong>red,<br />

however, and in <strong>the</strong> event that <strong>the</strong>re is a connection failure or a partially open<br />

session for an excessive period, <strong>the</strong> router terminates <strong>the</strong> connection. TCP intercept<br />

is enabled as a global configuration command using and . The ACL defines <strong>the</strong><br />

<strong>network</strong> and/or hosts that TCP intercept should interact with. Here is a configuration<br />

example that configures <strong>the</strong> router <strong>to</strong> passively moni<strong>to</strong>r all TCP transactions:<br />

!<br />

ip tcp intercept 100<br />

ip tcp intercept mode watch<br />

!<br />

!<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 514<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 513<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 512<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 443<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 25<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 80

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!