Network Bug: Portable Executable Identification

   Spot  the  bug quickly.

Network PEid - see the bugs in the network stream http://www.malforge.com/npeid/npeid.zip

PEid - extract the details about the bugs packaging and more http://www.peid.info/ and http://upx.sourceforge.net/ 

Throw in a bit of cryptography, MD5 (Message-Digest algorithm 5) application use.

Now, if only this was all automated.

Have fun! 

Network Attack Signature List

Intruder Alert!

How did I learn the basics about network attack signatures?

Using the Cisco IOS Firewall IDS Signature List.

59 basic attack signatures
The signatures are categorized into four types:

(Info Atomic) -Information-gathering actions such as a port scans.
Example:
2005 ICMP Time Exceeded for a Datagram (Info, Atomic)
Triggers when an IP datagram is received with the "protocol" field in the IP header set to 1 (ICMP) and the "type" field in the ICMP header set to 11

(Info Compound)-Attacks attempted into the guarded network.
Example:
3151 FTP SYST Command Attempt (Info, Compound)
Triggers when someone tries to execute the FTP SYST command.

(Attack Atomic) - Simple intrusion patterns
Example:
1101 Unknown IP Protocol (Attack, Atomic)
Triggers when an IP datagram is received with the protocol field set to 101 or greater. These protocol types are undefined or reserved and should not be used

(Attack Compound)- Intricate patterns or series of operations divided across many host over a specific period.
Example:
3050 Half-open SYN Attack/SYN Flood (Attack, Compound)
Triggers when multiple TCP sessions have been improperly initiated

Very good article at http://ciscoarticles.com/CCSP-Cisco-Certified-Security-Professional/CIDS-Log-Files.html

Enjoy!

Network Forensics Mystery

Enjoy solving a good network  mystery? 

I enjoyed the Solving Network Mysteries Video Series with CACE Pilot and Wireshark.

http://www.cacetech.com/resources.html

Forensic Packet Contests are wonderful.

http://forensicscontest.com   "Challenge # 2"

http://ismellpackets.com  "packet challenges"

Serious Network Game Learning Trivia

When learning information about network equipment, topologies and packets. Packet-tracer trivia is a wonderful tool.

Here are some links from my network notes. 

Enjoy!

Packet-tracer Game
http://www.packettracertrivia.com/

Packet-tracer Videos's
packet-tracer-video-tutorial-part-1
http://www.youtube.com/watch?v=WRDVZpyIBpk

packet-tracer-video-tutorial-part-2
http://www.youtube.com/watch?v=nwTvscbOXQE

packet-tracer-video-tutorial-part-3
http://www.youtube.com/watch?v=nxiRZLmbEyI

packet-tracer-video-tutorial-part-4
http://www.youtube.com/watch?v=4_RkAVA7DtU

packet-tracer-video-tutorial-part-5
http://www.youtube.com/watch?v=XBRM_Mg9vIk

packet-tracer-video-tutorial-part-6
http://www.youtube.com/watch?v=z0-qrQEDXIM

Packet-tracer Home
http://www.cisco.com/web/learning/netacad/course_catalog/PacketTracer.html

Linux Kernel Networking Advanced topics & IPv6

 

Advanced Linux study notes, lectures and videos:  http://www.haifux.org/

Wonderful topics for users or programmers interested in Linux networking data structure, routing subsystems, IPsec, bridging, and IPv6.

Have fun!

Cyberciege :Can you keep the network alive?

A nicely prepared security video game tool to teach network security concepts.

http://cisr.nps.edu/cyberciege/index.htm

Linux Network Code: Big Endian and Little Endian Snack

The TCP/IP protocol is "Big Endian"processing. How does a "little endian" processor read the packets sent from "Big Endian"?

Little Endian reads CPU register value (backwards or bottom-to-top)

Big Endian reads CPU register value (forwards or top-to-botom)

This means Byte Order "functions" are needed to switch (convert) between big endian and little endian.

Linux, BSD and Solaris use the following functions:

hton = host-to-network
ntoh = network-to-host

s = short = 16 bit integer
l = long = 32 bit integer
ll= double = 64 bit integer

Function Code Sample:

htons()
htonl()
htonll()

ntohs()
ntohl()
ntohll()


This means if the routing processor is "Big endian" and the sending or receiving processing code is "Little Endian" The above byte order "functions" are required to switch (convert) between Big Endian and Little Endian. If no Byte Order "Function" is present then it will arrive as unreadable garbage to the processor.


Hope you enjoyed this Linux Network Code snack!

Security network weapon of mass instruction

Icons.apnic.net has current and legacy IPv6 information links. What makes the site special? The current updates and contributions from networking specialist are valid with substance.

For example the following link was from Icons.apnic.net.
The U.S. DEPARTMENT OF DEFENSE High Performance Computing Modernization Program
Information Assurance Awareness Course  

This course was so nicely done, I decided to give a visual summary video of less than 60 seconds.

Enjoy!

Internet Network Traffic Packet Archive

Some packets, I just wont see every day. The Internet Traffic Archive has 4 million-packet traces of LAN and WAN traffic, 30 days of wide-area TCP connections, Six months of Web client traces and more.

The traces are a very helpful review of network traffic that I do not normally see on a daily basis.

It has been interesting identifying and reading packets that are slightly irregular.

The Internet network traffic by ACM SIGCOMM is at http://ita.ee.lbl.gov/html/traces.html

Enjoy!