Transcript PowerPoint file

 network appliances to filter network traffic
 filter on header (largely based on layers 3-5)
Internet
Intranet
Destination IP
Source IP
Destination Port
Source Port
Flag (TCP-only)
ACK - acknowledge
FIN - final
PSH - push
RST - reset
SYN - synchronize
URG - urgent
 static packet filtering
 dynamic packet filtering
 stateful packet filtering
 proxy server
static packet filtering
 Network manager configures access control lists
 Packets are compared to access control lists
packet
 Example: block
Problems with static filtering
• Blocking FIN scanning
• Difficult to filter
• Difficult to filter
Internet Control Message Protocol
- designed for Internet testing/maintenance
- does not use ports
- has type field
0 - echo reply
3 - destination unreachable
4 - source quench (from overloaded router)
5 - redirect (indicates a better path)
6 - echo request
9 - router advertisement (fore new routers)
10 - router solicitation (host request for advertisement)
11 - time exceeded (packet header may include time)
12 - parameter problem (catch all for errors)
13 - time stamp request (checking link speed)
14 - time stamp reply
dynamic packet filtering
 Includes all capabilities of static filtering
 Maintains an Active Sessions Table
ACLs
packet
 Example: block external FIN scan
stateful packet filtering
 Includes all capabilities of dynamic filtering
 Also “understands” certain application behavior
ACLs
Active Sessions Table
packet
 Example: better control over UDP, NFS, RPC
proxy server
 Messages to destination IP are rerouted to a proxy
 The proxy communicates on behalf of the destination
 The proxy may also communicate with destination
packet
destination