Suppose a firewall is configured to allow outbound TCP connections but inbound connections only to specified ports. The FTP protocol now presents a problem: When an inside client contacts an outside server, the outbound TCP control connection can be opened normally but the TCP data connection traditionally is inbound. (a) Look up the FTP protocol in, for example, Request for Comments 959. Find out how the PORT command works. Discuss how the client might be written so as to limit the number of ports to which the firewall must grant inbound access. Can the number of such ports be limited to one? (b) Find out how the FTP PASV command can be used to solve this firewall problem.

Suppose a firewall is configured to allow outbound TCP connections but inbound connections only to specified ports. The FTP protocol now presents a problem: When an inside client contacts an outside server, the outbound TCP control connection can be opened normally but the TCP data connection traditionally is inbound. (a) Look up the FTP protocol in, for example, Request for Comments 959. Find out how the PORT command works. Discuss how the client might be written so as to limit the number of ports to which the firewall must grant inbound access. Can the number of such ports be limited to one? (b) Find out how the FTP PASV command can be used to solve this firewall problem.

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below: 1st: client:port1 -> server:port2, SYN 2nd: server:port2 -> client:port1, SYNACK 3rd: client:port1 -> server:port2, ACK When this client is performing scanning attacks, it will generated a large number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed. By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules without considering SYNACK:
The following questions are related to HTTP protocol Q1. The first line of a HTTP request from some client to some server is basically made of where the web page file path is added. The path is shown as folders separated by slash. Q2. If an HTTP server responds to a client request and the response is a success, what is the http code and string that marks a success response? Must provide the code and the string as they appear in TCPDump or Wireshark traces. (note: use upper case for the string and also proper spacing in you answers. Keep the order of the string and the code as seen in TCPDump) Answer: code and string that marks a success response Q3. What http header field is used to identify an address of a web page (i.e. the URI) that linked to the resource currently being requested. This field indicates the last page the user/requester was on by the time they link to the requested page. Answer: The field that indicates the last page the user/requester was on is Q4. What is the http…
SMTP (Simple Mail Transfer Protocol) is the standard protocol for transferring mail between hosts. A TCP connection is set up between a user agent and a server program. The server listens on TCP port 25 for incoming connection requests. The user end of the connection is on a TCP port number above 1023. You have defined the packet filter rule set shown in the table below. These rules permit and/or deny inbound and outbound traffic between the user agent and the mail server. Describe the purpose of each packet filter rule in the table. Rule Direction Source Address Destination Address Protocol Destination Port Action A2 In External Internal TCP 25 Permit B2 Out Internal External TCP > 1023 Permit C2 Out Internal External TCP 25 Permit D2 In External Internal TCP > 1023 Permit E2 Either Any Any Any Any Deny
As presented in the text, SMTP involves the exchange of several small messages. In most cases, the server responses do not affect what the client sends subsequently. The client might thus implement command pipelining: sending multiple commands in a single message. (a) For what SMTP commands does the client need to pay attention to the server's responses? (b) Assume the server reads each client message with gets() or the equivalent, which reads in a string up to a . What would it have to do even to detect that a client had used command pipelining? (c) Pipelining is nonetheless known to break with some servers; find out how a client can negotiate its use.
TCP is a connection-oriented protocol. This means that... O a. both of the endpoints communicating over TCP keep information about the state of the connection. O b. a TCP sender can start sending data to the receiver before the three-way handshake takes place. O c. there is a direct physical connection between the two endpoints of a TCP session. O d. both endpoints of a TCP session have to connect to a third party before data can be sent or received.
Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below: 1st: client:port1 -> server:port2, SYN 2nd: server:port2 -> client:port1, SYNACK 3rd: client:port1 -> server:port2, ACK When this client is performing scanning attacks, it will generated a large number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed. By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules without considering SYNACK: If a client:port1 sends…
Please solve it correctly with a proper explanation of the calculation. Question: Given, you want to visit “welcomebacktophysicalexams.com”. Your network has alocal DNS server and is using a recursive lookup to fetch IP addresses and RTT of 29 ms.Others in your network have already visited the above website a few hours before yourvisit.After fetching the IP address, your PC sends a non-persistent HTTP request of size 109bytes to bring 13 objects of size 31 bytes each. In this particular connection, it requiresthe PC 67ms to send the TCP request to the server. I. What is the total RTT in ms in the DNS lookup?II. What is the total RTT in ms required (including DNS) to bring the full object toyour PC?III. What is the total file transmission time in ms after fetching the IP address?
What does it mean when an HTTP query has a header field of "Connection: keep-alive"? a. The client can keep the TCP connection open for future requests/responses if this is supported by the server. O b. Use UDP for additional connections to the server. c. Continually send an object from the server to the client until the client has acknowledged receipt of the requested object. O d. Use the QUIC protocol for this connection.
Please solve it correctly and please provide explanation of your answers. Please answer parts g, h and i. A PC and a Web Server are communicating over a TCP connection. The PC had started the three way handshake with the initial sequence number of 3069 . The Web Server's initial sequence number is 4830 . The window size of the PC is 815 bytes and the window size of the Web Server is 463 bytes. Using the third TCP handshake ack segment the PC sends the http request of the size 396 bytes to the Web Server. Then the Web Server answers with 3 segments containing the requested data. The first segment size is 42 bytes and the second segment size is 276 bytes and the third segment size is 146 bytes respectively. The PC receives all three segments within the timer. But unfortunately the second segment was corrupted. So the PC immediately sends an acknowledgement segment. Assume that the PC uses Selective Repeat/Reject ARQ. g) The second segment from webserver was corrupted. So the PC…
TCP is a sliding window protocol. This means... а. the TCP retransmission timer slides up as ACKS are received. O b. there can be more than one segment "in flight" (sent but no ACK has been received) at a time. с. there can only be one segment outstanding (sent but no ACK has been received) at at time.
In this problem we investigate whether either UDP or TCP provides a degree of end-point authentication. a. Consider a server that receives a request within a UDP packet and responds to that request within a UDP packet (for example, as done by a DNS server). If a client with IP address X spoofs its address with address Y, where will the server send its response? b. Suppose a server receives a SYN with IP source address Y, and after responding with a SYNACK, receives an ACK with IP source address Y with the correct acknowledgment number. Assuming the server chooses a random initial sequence number and there is no "man-in-the-middle," can the server be certain that the client is indeed at Y (and not at some other address X that is spoofing Y)?
Write a snort rule to generate an alert for the following: search for the word “HTTP” in the first 20bytes of the payload of a packet that is originating in subnet (192.168.34.0/24) and going toyour subnet (192.168.56.0/24). The alert should read: “HTTP detected”. Could you please also include the nmap command used to scan the target?