Linux Firewalls: Attack Detection and Response with iptables, psad, and fwsnort by Michael Rash

Author:Michael Rash
Language: eng
Format: mobi, pdf
Tags: Linux, Networking, Access control, Reference:Computers, Computers - Access control, Computers, Firewalls (Computer security), General, Internet, Security, Operating Systems
ISBN: 9781593271411
Publisher: No Starch Press
Published: 2007-01-15T21:40:03.607000+00:00

[ext_scanner]# nmap -sF -P0 -p 80 -n 71.157.X.X

Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2007-03-05 20:50 EST

Interesting ports on 71.157.X.X:

PORT STATE SERVICE

80/tcp open|filtered http

Nmap finished: 1 IP address (1 host up) scanned in 0.812 seconds

In this case, Nmap receives zero packets from the targeted TCP stack, and it has to accept this as evidence that the port is either open (an open port does not respond with any packet upon receiving an orphaned FIN packet, as discussed in Chapter 3) or filtered (because a firewall or similar mechanism prevented the stack from responding). iptables does indeed filter this blind FIN packet and, in the process, psad adds the blocking rules against the attacker.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.