tanasi.it » Networking

Must have useful cheatsheets

jekil — Sun, 07 Dec 2008 17:08:18 +0000

Random Posts

Kaminsky DNS Vulnerability for dummies

jekil — Sun, 10 Aug 2008 18:12:37 +0000

The easiest and best explanation of Dan Kaminsky DNS Vulnerability that i found on the Net:
An Illustrated Guide to the Kaminsky DNS Vulnerability by Steve Friedl

Random Posts

Come Skype oltrepassa i firewall

jekil — Mon, 28 Apr 2008 22:09:51 +0000

Tutti abbiamo scoperto che Skype e` un software che funziona in ambienti di rete variagati e dove la sopravvivenza e` difficile, ad esempio funziona se posto dietro la gran parte dei firewall, in una rete che il cui router effetua NAT o addirittura riesce a funzionare anche senza aver un server DNS funzionante.

Segnalo l’articolo “The hole trick – How Skype & Co. get round firewalls“ di Jürgen Schmidt che illustra alcune delle tecniche usate da Skype per avere connettivita` in “reti difficili”.

Video about YouTube IP Hijacking

jekil — Wed, 19 Mar 2008 01:50:25 +0000

An interesting video about recently YouTube IP Hijacking showing BGP announcement propagation.

YouTube IP Hijacking

Una nuova Cisco era

jekil — Sat, 15 Mar 2008 15:30:16 +0000

Sembra che Cisco si stia mettendo in linea con le tendenze costruttive e di sviluppo degli altri produttori di network device ovvero utilizzando CPU comuni e un sistema operativo derivato da kernel open source.

Sono rimasto abbastanza stupito quando leggendo questa notizia ho appreso di questo cambiamento di rotta, il nuovo IOS-XE sara` sviluppato prendendo come base un kernel linux e il suo target saranno i router di fascia alta come il ASR1000 che con il supporto per KVM (virtualizzazione in hardware) offrira` funzionalita` di ridondanza del sistema operativo.

Immagino quindi che gli sviluppatori Cisco si prefiggano di far girare due istanze di IOS che vengono tenute sincronizzate, in modo che nel caso muoia o vada in crash un’istanza ci sia l’altra ad entrare in azione finche` la prima non viene riavviata. Ma a dirsi sembra facile..

Era ora Cisco!

YouTube IP Hijacking

jekil — Sun, 02 Mar 2008 19:49:00 +0000

Saturday 24 February a Pakistan AS started an unauthorized announcement of YouTube IP class.
Here you can found a RIPE case study:
http://www.ripe.net/news/study-youtube-hijacking.html

Video about YouTube IP Hijacking

Sniffing: SPAN port vs TAP

jekil — Sun, 02 Dec 2007 18:21:00 +0000

Sometimes the only way to do network monitoring and sniffing is using SPAN ports on network devices.
I think that SPAN its not all bad but you must know that its limitations to be compliance with your requirements.
This article can explain a lot of things that for a lot of network administrators is a unexplored planet.

PHPIDS

jekil — Sat, 06 Oct 2007 23:25:00 +0000

PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application. The IDS neither strips, sanitizes nor filters any malicious input, it simply recognizes when an attacker tries to break your site and reacts in exactly the way you want it to. Based on a set of approved and heavily tested filter rules any attack is given a numerical impact rating which makes it easy to decide what kind of action should follow the hacking attempt. This could range from simple logging to sending out an emergency mail to the development team, displaying a warning message for the attacker or even ending the user’s session.

PHPIDS enables you to see who’s attacking your site and how and all without the tedious trawling of logfiles or searching hacker forums for your domain. Last but not least it’s licensed under the LGPL!

Website: http://php-ids.org/
Demo: http://php-ids.org/demo/

I am using it from a lot of time and is a good score based IDS for web application developers.

Documentation about Netflow

jekil — Fri, 14 Sep 2007 19:43:00 +0000

Here is some documentation about NetFlow, slides, papers, and how to:

Papers about NetFlow applications

jekil — Thu, 13 Sep 2007 23:16:00 +0000

Properties and Prediction of Flow Statistics from Sampled Packet Streams: Nick Duffield, Carsten Lund, Mikkel Thorup, Proc. ACM SIGCOMM
IMC, 2002. A detailed investigation of the effects of packet sampling
on flow-based traffic accounting.
TCP Use and Performance on Internet2: Stanislav Shalunov, Benjamin Teitelbaum, ACL SIGCOMM IMW, 2001.
See the pointer to the
Abilene usage report page in the projects section of these
pages.
Traffic analysis and infrastructure monitoring in CESNET2 Network: Tom Kosnar, PAM 2001.
Flow-Based Traffic Analysis at SWITCH: Simon Leinen, PAM 2001 (poster).
FlowScan Presentation and BOF: Dave Plonka, NANOG 21, 2001. Slide presentation and RealVideo
recording. Slides also available here.
FlowScan: A Network Traffic Flow Reporting and Visualization Tool: by Dave Plonka, Usenix LISA 2000. Also available in full as HTML and PS,
as well as the slides
of the presentation.
Combining Cisco NetFlow Exports with Relational Database Technology for Usage Statistics, Intrusion Detection, and Network Forensics: by Bill Nickless, John-Paul Navarro, and Linda Winkler, Usenix
LISA 2000.
The OSU Flow-tools Package and CISCO NetFlow Logs: by Steve Romig, Mark Fullmer, and Ron Luman, Usenix LISA
2000.
Cisco Flow Logs and Intrusion Detection at the Ohio State University: by Steve Romig, Mark Fullmer, Suresh Ramachandran, Usenix
;login: vol.9, 1999. Describes the use of the OSU flow tools for Intrusion
Detection.
Deriving traffic demands for operational IP networks: Methodology and experience: by Anja Feldmann, Albert Greenberg, Carsten Lund, Nick Reingold,
Jennifer Rexford, and Fred True, ACM TON, June 2001. Also available:
slides
from a presentation to the ISMA workshop.