思科IPS介绍.ppt

* SYN Cookie: SYN Cookies is a way to mitigate TCP spoofed SYN attacks. Attacker sends SYN packets that lies about its src address. TCP resource exhaustion bc server needs to maintain due maintaining state of embryonic connection (per SYN packets). If src replies with a SYN ACK then it will not cause the server exhaustion. SYN Cookie serves as a proxy for the TCP connection to the server. Sensor acts as an endpoint for the server from the source side, as if the sensor where the final destination. So if there is a SYN attack, the server never sees the SYN packet. So support for SYN cookies allows the security device to not keep state of the connection until it has been proven valid. Main reason traceback. Atta sends syn. Server sends SYN ACK. Underlying OS of the attacker automatically sends a rst packet to the server. When the server sees the rst packet he drops the connection state. The attacker does not send an ACK instead of a RST since most OSs a memory militiation of keeping state of embryonic (half open connections). So the rst thwarts the flooding process. RST sent from attacker to server TCP Worm detection: For every TCP flow that has seen a SYN packet and no other packet for X seconds, send an event to the AD with type TCP-non-established and data that holds the 5-tuple (sourceIP, destIP, proto=TCP, source-port, dest-port). UDP worm detection: The event definition for UDP is short, uni- directional inactive connection: UDP connection that has less than a pre-defined number of packets, all packets going only on one directional and is idle for more than a time period. Non allocated addresses: user can define 3 lists: internal, external, and un-allocated. 2 non allocated address types: Global unallocated: IP blocks that ATT owns that hasn’t been assigned Inside org, probably use use a systematic fashion to allocate 10.1, 10.2, but non allocated 10.10, so if someone is approaching 10.10 Behavioral: Therefore, for each destination port, we keep