Network Intrusion Detection, Third Edition

Network Intrusion Detection, Third Edition

Released August 2002
Publisher(s): Sams
ISBN: None

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

The Chief Information Warfare Officer for the entire United States teaches you how to protect your corporate network. This book is a training aid and reference for intrusion detection analysts. While the authors refer to research and theory, they focus their attention on providing practical information. The authors are literally the most recognized names in this specialized field, with unparalleled experience in defending our country's government and military computer networks. New to this edition is coverage of packet dissection, IP datagram fields, forensics, and snort filters.

Table of contents

  1. Copyright
    1. Dedication
  2. About the Authors
  3. About the Technical Reviewers
  4. Acknowledgments
  5. Tell Us What You Think
  6. Introduction
  7. I. TCP/IP
    1. 1. IP Concepts
      1. The TCP/IP Internet Model
        1. Layers
        2. Data Flow
      2. Packaging (Beyond Paper or Plastic)
        1. Bits, Bytes, and Packets
        2. Encapsulation Revisited
        3. Interpretation of the Layers
      3. Addresses
        1. Physical Addresses, Media Access Controller Addresses
        2. Logical Addresses, IP Addresses
        3. Subnet Masks
      4. Service Ports
      5. IP Protocols
      6. Domain Name System
      7. Routing: How You Get There from Here
      8. Summary
    2. 2. Introduction to TCPdump and TCP
      1. TCPdump
        1. TCPdump Behavior
          1. Filters
          2. Binary Collection
          3. Altering the Amount of Data Collected
        2. TCPdump Output
        3. Absolute and Relative Sequence Numbers
        4. Dumping in Hexadecimal
      2. Introduction to TCP
        1. Establishing a TCP Connection
        2. Server and Client Ports
        3. Connection Termination
          1. The Graceful Method
          2. The Abrupt Method
        4. Data Transfer
        5. What’s the Bottom Line?
      3. TCP Gone Awry
        1. An ACK Scan
        2. A Telnet Scan?
        3. TCP Session Hijacking
      4. Summary
    3. 3. Fragmentation
      1. Theory of Fragmentation
        1. Visualizing Fragmentation: Seeing Is Understanding
          1. All Aboard the Fragment Train
          2. The Fragment Dining Car
          3. The Fragment Caboose
        2. Viewing Fragmentation Using TCPdump
        3. Fragmentation and Packet-Filtering Devices
        4. The Don’t Fragment Flag
      2. Malicious Fragmentation
        1. TCP Header Fragments
        2. Teardrop
      3. Summary
    4. 4. ICMP
      1. ICMP Theory
        1. Why Do You Need ICMP?
        2. Where Does ICMP Fit In?
        3. Understanding ICMP
        4. Summary of ICMP Theory
      2. Mapping Techniques
        1. Tireless Mapper
        2. Efficient Mapper
        3. Clever Mapper
        4. Cerebral Mapper
        5. Summary of Mapping
      3. Normal ICMP Activity
        1. Host Unreachable
        2. Port Unreachable
        3. Admin Prohibited
        4. Need to Frag
        5. Time Exceeded In-Transit
        6. Embedded Information in ICMP Error Messages
        7. Summary of Normal ICMP
      4. Malicious ICMP Activity
        1. Smurf Attack
        2. Tribe Flood Network
        3. WinFreeze
        4. Loki
        5. Unsolicited ICMP Echo Replies
          1. Theory 1: Spoofing
          2. Theory 2: TFN
          3. Theory 3: Loki
        6. Summary of Malicious ICMP Traffic
      5. To Block or Not to Block
        1. Unrequited ICMP Echo Requests
        2. Kiss traceroute Goodbye
        3. Silence of the LANs
        4. Broken Path MTU Discovery
      6. Summary
    5. 5. Stimulus and Response
      1. The Expected
        1. Request for Comments
        2. TCP Stimulus-Response
          1. Destination Host Listens on Requested Port
          2. Destination Host Not Listening on Requested Port
          3. Destination Host Doesn’t Exist
          4. Destination Port Blocked
          5. Destination Port Blocked, Router Doesn’t Respond
        3. UDP Stimulus-Response
          1. Destination Host Listening on Requested Port
          2. Destination Host Not Listening on Requested Port
        4. ICMP Stimulus-Response
          1. Windows tracert
          2. TCPdump of tracert
      2. Protocol Benders
        1. FTP
        2. Active FTP
          1. Passive FTP
        3. UNIX Traceroute
        4. Summary of Expected Behavior and Protocol Benders
      3. Abnormal Stimuli
        1. Evasion Stimulus, Lack of Response
        2. Evil Stimulus, Fatal Response
        3. No Stimulus, All Response
        4. Unconventional Stimulus, Operating System Identifying Response
          1. Bogus “Reserved” TCP Flags
        5. Anomalous TCP Flag Combinations
          1. No TCP Flags
        6. Summary of Abnormal Stimuli
      4. Summary
    6. 6. DNS
      1. Back to Basics: DNS Theory
        1. The Structure of DNS
        2. Steppin’ Out on the Internet
          1. DNS Resolution Process
          2. TCPdump Output of Resolution
          3. Strange TCPdump Notation
        3. Caching: Been There, Done That
        4. Reverse Lookups
        5. Master and Slave Name Servers
        6. Zone Transfers
        7. UDP or TCP
        8. Summary of DNS Theory
      2. Using DNS for Reconnaissance
        1. The nslookup Command
          1. Name That Name Server
        2. HINFO: Snooping for Details
        3. List Zone Map Information
        4. Dig
      3. Tainting DNS Responses
        1. A Weak Link
        2. Cache Poisoning
      4. Summary
  8. II. Traffic Analysis
    1. 7. Packet Dissection Using TCPdump
      1. Why Learn to Do Packet Dissection?
      2. Sidestep DNS Queries
        1. Normal Query
        2. Evasive Query
      3. Introduction to Packet Dissection Using TCPdump
      4. Where Does the IP Stop and the Embedded Protocol Begin?
      5. Other Length Fields
        1. The IP Datagram Length
        2. TCP Header Length
      6. Increasing the Snaplen
      7. Dissecting the Whole Packet
      8. Freeware Tools for Packet Dissection
        1. Ethereal
        2. tcpshow
        3. TCPdump –X Option
      9. Summary
    2. 8. Examining IP Header Fields
      1. Insertion and Evasion Attacks
        1. Insertion Attacks
        2. Evasion Attacks
      2. IP Header Fields
        1. IP Version Number
        2. Protocol Number
        3. Differentiated Services Byte (Formerly Known as Type of Service—The Prince of Fields)
        4. The Don’t Fragment (DF) Flag
      3. The More Fragments (MF) Flag
        1. Mapping Using Incomplete Fragments
        2. IP Numbers
        3. IP Identification Number
        4. Time to Live (TTL)
        5. IP Checksums
      4. Summary
    3. 9. Examining Embedded Protocol Header Fields
      1. TCP
        1. Ports
        2. TCP Checksums
        3. TCP Sequence Numbers
        4. Acknowledgement Numbers
        5. TCP Flags
          1. TCP Corruption
          2. ECN Flag Bits
          3. Operating System Fingerprinting
          4. Retransmissions
            1. Using Retransmissions Against a Hostile Host—LaBrea Tarpit Version 1
        6. TCP Window Size
          1. LaBrea Version 2
      2. UDP
        1. Ports
          1. UDP Port Scanning
        2. UDP Length Field
      3. ICMP
        1. Type and Code
        2. Identification and Sequence Numbers
          1. Misuse of ICMP Identification and Sequence Numbers
      4. Summary
    4. 10. Real-World Analysis
      1. You’ve Been Hacked!
        1. Three-Way Handshake:
        2. Data Exchange:
        3. Session Termination:
      2. Netbus Scan
      3. How Slow Can you Go?
      4. RingZero Worm
      5. Summary
    5. 11. Mystery Traffic
      1. The Event in a Nutshell
      2. The Traffic
      3. DDoS or Scan
        1. Source Hosts
        2. Destination Hosts
        3. Scanning Rates
      4. Fingerprinting Participant Hosts
        1. Arriving TTL Values
        2. TCP Window Size
        3. TCP Options
        4. TCP Retries
      5. Summary
  9. III. Filters/Rules for Network Monitoring
    1. 12. Writing TCPdump Filters
      1. The Mechanics of Writing TCPdump Filters
      2. Bit Masking
        1. Preserving and Discarding Individual Bits
        2. Creating the Mask
        3. Putting It All Together
      3. TCPdump IP Filters
        1. Detecting Traffic to the Broadcast Addresses
        2. Detecting Fragmentation
      4. TCPdump UDP Filters
      5. TCPdump TCP Filters
        1. Filters for Examining TCP Flags
        2. Detecting Data on SYN Connections
      6. Summary
    2. 13. Introduction to Snort and Snort Rules
      1. An Overview of Running Snort
      2. Snort Rules
        1. Snort Rule Anatomy
          1. Rule Header Fields
            1. The Action Field
            2. The Protocol Field
            3. The Source and Destination IP Address Fields
            4. The Source and Destination Port Field
            5. Direction Indicator
      3. Summary
    3. 14. Snort Rules—Part II
      1. Format of Snort Options
      2. Rule Options
        1. Msg Option
        2. Logto Option
        3. Ttl Option
        4. Id Option
        5. Dsize Option
        6. Sequence Option
        7. Acknowledgement Option
        8. Itype and Icode Options
        9. Flags Option
        10. Content Option
          1. Offset Option
          2. Depth Option
          3. Nocase Option
          4. Regex Option
        11. Session Option
        12. Resp Option
        13. Tag Option
      3. Putting It All Together
      4. Summary
  10. IV. Intrusion Infrastructure
    1. 15. Mitnick Attack
      1. Exploiting TCP
        1. IP Weaknesses
        2. SYN Flooding
          1. Covering His Tracks
          2. Identifying Trust Relationships
          3. Examining Network Traces
        3. Setting Up the System Compromise?
      2. Detecting the Mitnick Attack
      3. Network-Based Intrusion-Detection Systems
        1. Trust Relationship
        2. Port Scan
        3. Host Scan
        4. Connections to Dangerous Ports
      4. Host-Based Intrusion-Detection Systems
        1. TCP Wrappers
        2. Tripwire
      5. Preventing the Mitnick Attack
      6. Summary
    2. 16. Architectural Issues
      1. Events of Interest
      2. Limits to Observation
      3. Low-Hanging Fruit Paradigm
      4. Human Factors Limit Detects
        1. Limitations Caused by the Analyst
        2. Limitations Caused by the CIRTs
      5. Severity
        1. Criticality
        2. Lethality
      6. Countermeasures
      7. Calculating Severity
        1. Scanning for Trojans
          1. Analysis
          2. Severity
        2. Host Scan Against FTP
          1. Analysis
          2. Severity
      8. Sensor Placement
      9. Outside Firewall
        1. Sensors Inside Firewall
        2. Both Inside and Outside Firewall
        3. Additional Sensor Locations
      10. Push/Pull
      11. Analyst Console
        1. Faster Console
        2. False Positive Management
        3. Display Filters
        4. Mark as Analyzed
        5. Drill Down
        6. Correlation
        7. Better Reporting
          1. Event-Detection Reports
          2. Weekly/Monthly Summary Reports
      12. Host- or Network-Based Intrusion Detection
      13. Summary
    3. 17. Organizational Issues
      1. Organizational Security Model
        1. Security Policy
        2. Industry Practice for Due Care
        3. Security Infrastructure
        4. Implementing Priority Countermeasures
        5. Periodic Reviews
        6. Implementing Incident Handling
      2. Defining Risk
      3. Risk
        1. Accepting the Risk
          1. Trojan Version
          2. Malicious Connections
        2. Mitigating or Reducing the Risk
          1. Network Attack
          2. Snatch and Run
        3. Transferring the Risk
      4. Defining the Threat
        1. How Bad—Impact of Threat
        2. Frequency of Threat—Annualized
        3. Recognition of Uncertainty
      5. Risk Management Is Dollar Driven
      6. How Risky Is a Risk?
        1. Quantitative Risk Assessment
        2. Qualitative Risk Assessments
        3. Why They Don’t Work
      7. Summary
    4. 18. Automated and Manual Response
      1. Automated Response
        1. Architectural Issues
          1. Response at the Internet Connection
          2. Internal Firewalls
          3. Host-Based Defenses
        2. Throttling
          1. Drop Connection
          2. Shun
        3. Islanding
        4. SYN/ACK
        5. Reset
      2. Honeypot
        1. Proxy System
        2. DTK
        3. Empty System
        4. Honeypot Summary
      3. Manual Response
        1. Containment
          1. Freeze the Scene
          2. Sample Fax Form
          3. On-Site Containment
            1. Site Survey
            2. System Containment
            3. Hot Search
        2. Eradication
        3. Recovery
        4. Lessons Learned
      4. Summary
    5. 19. Business Case for Intrusion Detection
      1. Part One: Management Issues
        1. Bang for the Buck
        2. The Expenditure Is Finite
        3. Technology Used to Destabilize
          1. Network Impacts
          2. IDS Behavioral Modification
          3. The Policy
        4. Part of a Larger Strategy
      2. Part Two: Threats and Vulnerabilities
        1. Threat Assessment and Analysis
          1. Threat Vectors
          2. Threat Determination
        2. Asset Identification
        3. Valuation
        4. Vulnerability Analysis
        5. Risk Evaluation
      3. Part Three: Tradeoffs and Recommended Solution
        1. Define an Information-Assurance Risk-Management Architecture
        2. Identify What Is in Place
        3. Identify Your Recommendations
        4. Identify Options for Countermeasures
        5. Cost-Benefit Analysis
        6. Project Schedule
        7. Follow-On Steps
      4. Repeat the Executive Summary
      5. Summary
    6. 20. Future Directions
      1. Increasing Threat
        1. Cyber-Terrorism
        2. Large-Scale Compromise
        3. Improved Targeting
        4. How the Threat Will Be Manifested
      2. Defending Against the Threat
        1. Skills Versus Tools
          1. Analysts Skill Set
          2. Improved Tools
      3. Defense in Depth
        1. Large-Scale Intrusion Detection
      4. Emerging Techniques
        1. Virus Industry Revisited
        2. Hardware-Based ID
        3. Program-Based ID
        4. Smart Auditors
      5. Summary
  11. V. Appendixes
    1. A. Exploits and Scans to Apply Exploits
      1. False Positives
        1. All Response, No Stimulus
        2. Scan or Response?
        3. SYN Floods
          1. Valid SYN Flood
          2. False Positive SYN Flood
        4. Back Orifice?
      2. IMAP Exploits
        1. 10143 Signature Source Port IMAP
        2. 111 Signature IMAP
        3. Exploit Ports with SYN/FIN Set
        4. Source Port 0, SYN and FIN Set
        5. Source Port 65535 and SYN FIN Set
        6. DNS Zone Followed by 0, SYN FIN Targeting NFS
      3. Scans to Apply Exploits
        1. mscan
        2. Son of mscan
        3. Access Builder?
      4. Single Exploit, Portmap
        1. rexec
        2. POP3
        3. Targeting SGI Systems?
        4. Discard
        5. Three-Port Scan
        6. Weird Web Scans
        7. IP-Proto-191
      5. Summary
    2. B. Denial of Service
      1. Brute-Force Denial-of-Service Traces
        1. Smurf
          1. Directed Broadcast
        2. Echo-Chargen
      2. Elegant Kills
        1. Teardrop
        2. Land Attack
        3. We’re Doomed
      3. nmap
      4. Distributed Denial-of-Service Attacks
        1. Intro to DDoS
        2. DDoS Software
          1. Trinoo
          2. TFN
          3. TFN2K
          4. Stacheldraht
      5. Summary
    3. C. Detection of Intelligence Gathering
      1. Network and Host Mapping
        1. Host Scan Using UDP Echo Requests
        2. Netmask-Based Broadcasts
        3. Port Scan
        4. Scanning for a Particular Port
        5. Complex Script, Possible Compromise
        6. “Random” Port Scan
        7. Database Correlation Report
        8. SNMP/ICMP
        9. FTP Bounce
      2. NetBIOS-Specific Traces
        1. A Visit from a Web Server
        2. Null Session
      3. Stealth Attacks
        1. Explicit Stealth Mapping Techniques
          1. FIN Scan
          2. Inverse Mapping
          3. Answers to Domain Queries
          4. Answers to Domain Queries, Part 2
          5. Fragments, Just Fragments
      4. Measuring Response Time
        1. Echo Requests
        2. Actual DNS Queries
        3. Probe on UDP Port 33434
        4. 3DNS to TCP Port 53
      5. Worms as Information Gatherers
        1. Pretty Park Worm
        2. RingZero
      6. Summary

Product information

  • Title: Network Intrusion Detection, Third Edition
  • Author(s):
  • Release date: August 2002
  • Publisher(s): Sams
  • ISBN: None