DOCSLIB.ORG

Draft SP 800-189, Secure Interdomain Traffic Exchange

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Draft SP 800-189, Secure Interdomain Traffic Exchange Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date October 17, 2019 Original Release Date December 17, 2018 Superseding Document Status 2nd Public Draft (2PD) Series/Number NIST Special Publication 800-189 Title Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation Publication Date October 2019 DOI https://doi.org/10.6028/NIST.SP.800-189-draft2 CSRC URL https://csrc.nist.gov/publications/detail/sp/800-189/draft Additional Information 1 Draft NIST Special Publication 800-189 2 3 Secure Interdomain Traffic Exchange 4 BGP Robustness and DDoS Mitigation 5 6 Kotikalapudi Sriram 7 Doug Montgomery 8 9 10 11 12 13 This publication is available free of charge from: 14 https://doi.org/10.6028/NIST.SP.800-189-draft 15 16 17 C O M P U T E R S E C U R I T Y 18 19 20 Draft NIST Special Publication 800-189 21 22 Secure Interdomain Traffic Exchange 23 BGP Robustness and DDoS Mitigation 24 25 Kotikalapudi Sriram 26 Doug Montgomery 27 Advanced Network Technology Division 28 Information Technology Laboratory 29 30 31 32 33 34 35 36 This publication is available free of charge from: 37 https://doi.org/10.6028/NIST.SP.800-189-draft 38 39 40 December 2018 41 42 43 44 45 U.S. Department of Commerce 46 Wilbur L. Ross, Jr., Secretary 47 48 National Institute of Standards and Technology 49 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 50 Authority 51 This publication has been developed by NIST in accordance with its statutory responsibilities under the 52 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law 53 (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including 54 minimum requirements for federal information systems, but such standards and guidelines shall not apply 55 to national security systems without the express approval of appropriate federal officials exercising policy 56 authority over such systems. This guideline is consistent with the requirements of the Office of Management 57 and Budget (OMB) Circular A-130. 58 Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and 59 binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these 60 guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, 61 Director of the OMB, or any other federal official. This publication may be used by nongovernmental 62 organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, 63 however, be appreciated by NIST. 64 National Institute of Standards and Technology Special Publication 800-189 65 Natl. Inst. Stand. Technol. Spec. Publ. 800-189, 70 pages (December 2018) 66 CODEN: NSPUE2 67 This publication is available free of charge from: 68 https://doi.org/10.6028/NIST.SP.800-189-draft 69 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 70 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 71 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 72 available for the purpose. 73 There may be references in this publication to other publications currently under development by NIST in accordance 74 with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, 75 may be used by federal agencies even before the completion of such companion publications. Thus, until each 76 publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For 77 planning and transition purposes, federal agencies may wish to closely follow the development of these new 78 publications by NIST. 79 Organizations are encouraged to review all draft publications during public comment periods and provide feedback to 80 NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 81 https://csrc.nist.gov/publications. 82 [1/29/2019: Comment period extended.] 83 Public comment period: December 17, 2018 through March 15, 2019 84 National Institute of Standards and Technology 85 Attn: Advanced Network Technologies Division, Information Technology Laboratory 86 100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920 87 Email (for submission of reviewers’ comments): [email protected] 88 All comments are subject to release under the Freedom of Information Act (FOIA). NIST SP 800-189 (DRAFT) SECURE INTERDOMAIN TRAFFIC EXCHANGE: BGP ROBUSTNESS & DDOS MITIGATION 89 Reports on Computer Systems Technology 90 The Information Technology Laboratory (ITL) at the National Institute of Standards and 91 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 92 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 93 methods, reference data, proof of concept implementations, and technical analyses to advance the 94 development and productive use of information technology. ITL’s responsibilities include the 95 development of management, administrative, technical, and physical standards and guidelines for 96 the cost-effective security and privacy of other than national security-related information in federal 97 information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and 98 outreach efforts in information system security, and its collaborative activities with industry, 99 government, and academic organizations. 100 Abstract 101 In recent years, numerous routing control plane anomalies such as Border Gateway Protocol 102 (BGP) prefix hijacking and route leaks have resulted in Denial of Service (DoS), unwanted data 103 traffic detours, and performance degradation. Large-scale Distributed Denial of Service (DDoS) 104 attacks on servers using spoofed Internet Protocol (IP) addresses and reflection-amplification in 105 the data plane have also been frequent, resulting in significant disruption of services and 106 damages. This special publication on Secure Interdomain Traffic Exchange (SITE) includes 107 initial guidance on securing the interdomain routing control traffic, preventing IP address 108 spoofing, and certain aspects of DoS/DDoS detection and mitigation. 109 Many of the recommendations in this publication focus on the Border Gateway Protocol (BGP). 110 BGP is the control protocol used to distribute and compute paths between the tens of thousands 111 of autonomous networks that comprise the Internet. Technologies recommended in this 112 document for securing the interdomain routing control traffic include Resource Public Key 113 Infrastructure (RPKI), BGP origin validation (BGP-OV), and prefix filtering. Additionally, 114 technologies recommended for mitigating DoS/DDoS attacks focus on prevention of IP address 115 spoofing using Source Address Validation (SAV) with Access Control Lists (ACLs) and unicast 116 Reverse Path Forwarding (uRPF). Other technologies (including some application plane 117 methods) such as Remotely Triggered Black Hole (RTBH) filtering, Flow Specification 118 (Flowspec), and Response Rate Limiting (RRL) are also recommended as part of the overall 119 security mechanisms. 120 Keywords 121 Routing security and robustness; Internet infrastructure security; Border Gateway Protocol 122 (BGP) security; prefix hijacks; IP address spoofing; Distributed Denial of Service (DDoS); 123 Resource Public Key Infrastructure (RPKI); BGP origin validation (BGP-OV); prefix filtering; 124 BGP path validation (BGP-PV); BGPsec; route leaks; Source Address Validation (SAV); unicast 125 Reverse Path Forwarding (uRPF); Remotely Triggered Black Hole (RTBH) filtering; Flow 126 Specification (Flowspec). 127 ii NIST SP 800-189 (DRAFT) SECURE INTERDOMAIN TRAFFIC EXCHANGE: BGP ROBUSTNESS & DDOS MITIGATION 128 Acknowledgements 129 The authors are grateful to William T. Polk, Scott Rose, Okhee Kim, Oliver Borchert, Susan 130 Symington, William C. Barker, William Haag, Allen Tan, and Jim Foti for their review and 131 comments. 132 Audience 133 This document gives technical guidance and recommendations for secure interdomain traffic 134 exchange. The primary audience include information security officers and managers of federal 135 enterprise networks. The guidance also applies to the network services of hosting providers (e.g., 136 cloud-based applications and service hosting) and Internet Service Providers (ISPs) when they 137 are used to support federal IT systems. The guidance will also be useful for enterprise and transit 138 network operators and equipment vendors in general. 139 It is expected that the guidance and applicable recommendations from this publication will be 140 incorporated in the security plans and operational processes of federal enterprise networks. 141 Likewise, it is expected that applicable recommendations will be incorporated into the service 142 agreements for federal contracts for hosted application services and Internet transit services. 143 Trademark Information 144 All registered trademarks belong to their respective organizations. iii NIST SP 800-189 (DRAFT) SECURE INTERDOMAIN TRAFFIC EXCHANGE: BGP ROBUSTNESS & DDOS MITIGATION 145 Executive Summary 146 There have
Load more

Recommended publications
  • IT Acronyms.Docx
    List of computing and IT abbreviations /.—Slashdot 1GL—First-Generation Programming Language 1NF—First Normal Form 10B2—10BASE-2 10B5—10BASE-5 10B-F—10BASE-F 10B-FB—10BASE-FB 10B-FL—10BASE-FL 10B-FP—10BASE-FP 10B-T—10BASE-T 100B-FX—100BASE-FX 100B-T—100BASE-T 100B-TX—100BASE-TX 100BVG—100BASE-VG 286—Intel 80286 processor 2B1Q—2 Binary 1 Quaternary 2GL—Second-Generation Programming Language 2NF—Second Normal Form 3GL—Third-Generation Programming Language 3NF—Third Normal Form 386—Intel 80386 processor 1 486—Intel 80486 processor 4B5BLF—4 Byte 5 Byte Local Fiber 4GL—Fourth-Generation Programming Language 4NF—Fourth Normal Form 5GL—Fifth-Generation Programming Language 5NF—Fifth Normal Form 6NF—Sixth Normal Form 8B10BLF—8 Byte 10 Byte Local Fiber A AAT—Average Access Time AA—Anti-Aliasing AAA—Authentication Authorization, Accounting AABB—Axis Aligned Bounding Box AAC—Advanced Audio Coding AAL—ATM Adaptation Layer AALC—ATM Adaptation Layer Connection AARP—AppleTalk Address Resolution Protocol ABCL—Actor-Based Concurrent Language ABI—Application Binary Interface ABM—Asynchronous Balanced Mode ABR—Area Border Router ABR—Auto Baud-Rate detection ABR—Available Bitrate 2 ABR—Average Bitrate AC—Acoustic Coupler AC—Alternating Current ACD—Automatic Call Distributor ACE—Advanced Computing Environment ACF NCP—Advanced Communications Function—Network Control Program ACID—Atomicity Consistency Isolation Durability ACK—ACKnowledgement ACK—Amsterdam Compiler Kit ACL—Access Control List ACL—Active Current
    [Show full text]
  • Reference Information
    APPENDIX B Software Field Description Tables The window field description tables for the following are included in this section: • “Flow Record Match and Collect Field Descriptions” • “Configure Filter Window Fields” • “Configure Records Window Fields” • “Configure Collector Window Fields” • “Configure Exporter Window Fields” • “Configure Monitor Window Fields” • “Application ID Collect Field Information” Table B-1 lists the match and collect field descriptions for IPv4, IPv6, and Layer 2 flow records in the user interface, as well as the CLI. Table B-1 Flow Record Match and Collect Field Descriptions Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 CoS X X X Ethertype X X X Input SNMP Interface X X X IP Protocol X X IPv4 Destination Address X IPv4 Source Address X IPv4 TOS X IPv4 TTL X IPv6 Destination Address X IPv6 Hop Limit X IPv6 Source Address X IPv6 Traffic Class X Layer 4 Destination Port X X Layer 4 Source Port X X MAC Destination Address X X X Cisco NetFlow Generation Appliance User Guide B-1 Appendix B Software Field Description Tables Table B-1 Flow Record Match and Collect Field Descriptions (continued) Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 MAC Source Address X X X MPLS Label X X X Output SNMP Interface X X X VLAN ID X X X Collect Fields Application ID1 XXX Byte Count X X X First Timestamp X X X Flow Label X IPv4 ICMP Code X IPv4 ICMP Type X IPv6 ICMP Code X IPv6 ICMP Type X Last Timestamp X X X Network Encapsulation X X X Packet Count X X X TCP Header Flags X X X 1.
    [Show full text]
  • Troubleshooting TCP/IP
    4620-1 ch05.f.qc 10/28/99 12:00 PM Page 157 Chapter 5 Troubleshooting TCP/IP In This Chapter ᮣ Troubleshooting TCP/IP in Windows 2000 Server ᮣ TCP/IP troubleshooting steps ᮣ Defining which is the best TCP/IP troubleshooting tool to solve your problem ᮣ Mastering basic TCP/IP utilities roubleshooting is, it seems, an exercise in matrix mathematics. That is, Twe use a variety of approaches and influences to successfully solve our problems, almost in a mental columns-and-rows format. These approaches may include structured methodologies, inductive and deductive reasoning, common sense, experience, and luck. And this is what troubleshooting is made of. Troubleshooting TCP/IP problems is really no different from troubleshooting other Windows 2000 Server problems mentioned in this book, such as instal- lation failures described in Chapter 2. Needless to say, Windows 2000 Server offers several TCP/IP-related tools and utilities to assist us, but more on the specifics in a moment. TCP/IP Troubleshooting Basics The goal in TCP/IP troubleshooting is very simple: fix the problem. Too often, it is easy to become overly concerned about why something happened instead of just fixing the problem. And by fixing the problem, I mean cost effectively. 1. Be cost effective. Don’t forget that several hours’ worth of MCSE-level consulting could more than pay for the additional bandwidth that may easily solve your TCP/IP WAN-related problem. Don’t overlook such an easy fix when struggling to make a WAN connection between sites utilizing Windows 2000 Server. Too little bandwidth is typically the result of being penny wise and pound foolish.
    [Show full text]
  • 09-Mobile Networking
    Mobile Networking Programming for Engineers Winter 2015 Andreas Zeller, Saarland University Today’s Topics • Mobile Networking • HTTP • HTML • Webserver! The aim of a computer network is Murray Leinster to have computers communicate “A Logic Named Joe” (1946) with each other The computer ... manages the spreading of ninety-four percent of all TV programs, conveys all information about weather, air trafc, special deals… and records every business conversation, every contract… Computers have changed the world. Computers are the civilisation. If we turn them of, we will fall back to a kind of civilisation, of which we have forgotten how it even works. Murray Leinster, 1896–1975 Partial map of the Internet based on the January 15, 2005 data The Internet found on opte.org. Each line is drawn between two nodes, representing two IP addresses. The length of the lines are indicative of the delay between those two nodes. This graph represents less than 30% of the Class C networks reachable by the data collection program in early 2005. Wireless Internet • WLAN = Wireless Local Area Network • Allows “local” computers to communicate The Arduino ESP8266 shield allows the Arduino to connect to Wireless Modem networks, and also to set up its own network The modem is controlled by so- Controlling a Modem called AT commands Modems receive • data to be sent • commands to control them View from above – connectors are Programming for Engineers WS15/16 Prof. Dr. Andreas Zeller saarland Software Engineering Chair Resp. Tutor: Curd Becker university at the bottom ConnectingSaarland University theAssignment Modem Sheet 6 computer science The connectors for the ESP8266 wireless module are shown in more detail here.
    [Show full text]
  • Dos Amplification Attacks – Protocol-Agnostic Detection Of
    DoS Amplification Attacks – Protocol-Agnostic Detection of Service Abuse in Amplifier Networks B Timm B¨ottger1( ), Lothar Braun1 , Oliver Gasser1, Felix von Eye2, Helmut Reiser2, and Georg Carle1 1 Technische Universit¨at M¨unchen, Munich, Germany {boettget,braun,gasser,carle}@net.in.tum.de 2 Leibniz Supercomputing Centre, Munich, Germany {voneye,reiser}@lrz.de Abstract. For many years Distributed Denial-of-Service attacks have been known to be a threat to Internet services. Recently a configura- tionflawinNTPdaemonsledtoattackswithtrafficratesofseveral hundred Gbit/s. For those attacks a third party, the amplifier, is used to significantly increase the volume of traffic reflected to the victim. Recent research revealed more UDP-based protocols that are vulnerable to amplification attacks. Detecting such attacks from an abused ampli- fier network’s point of view has only rarely been investigated. In this work we identify novel properties which characterize ampli- fication attacks and allow to identify the illegitimate use of arbitrary services. Their suitability for amplification attack detection is evaluated in large high-speed research networks. We prove that our approach is fully capa- ble of detecting attacks that were already seen in the wild as well as capable of detecting attacks we conducted ourselves exploiting newly discovered vulnerabilities. 1 Introduction Denial-of-Service attacks aim at making services unavailable to their intended users. Attackers can use different methods to consume bandwidth or deplete other resources of the victim. One method to exhaust bandwidth is called Dis- tributed Reflection Denial-of-Service (DRDoS) attack: an attacker sends forged requests to several servers with the victim’s spoofed source address.
    [Show full text]
  • Vulnerability Report TLP: White
    Vulnerability Report TLP: White Contents 1 Introduction ..................................... 4 2 Overview of Scanning Projects ............... 5 2.1 SSL POODLE Scan ................................................ 6 2.2 HTTP Scan ........................................................ 7 2.3 FTP Scan .......................................................... 8 2.4 RDP ................................................................ 9 2.5 mDNS ............................................................ 10 2.6 SNMP ............................................................. 11 2.7 AFP ............................................................... 12 2.8 NTP .............................................................. 13 2.9 Telnet ........................................................... 14 2.10 SSL Freak ....................................................... 15 2.11 Port Mapper .................................................... 16 2.12 VNC .............................................................. 17 2.13 DNS............................................................... 18 2.14 Netbios .......................................................... 19 2.15 SSDP ............................................................. 20 2.16 ISAKMP .......................................................... 21 2.17 TFTP ............................................................. 22 2.18 RSYNC ........................................................... 23 2.19 SMB .............................................................. 24 2.20 CWMP
    [Show full text]
  • Amplification Hell: Revisiting Network Protocols for Ddos Abuse
    Amplification Hell: Revisiting Network Protocols for DDoS Abuse Christian Rossow VU University Amsterdam, The Netherlands Horst Gortz¨ Institute for IT-Security, Ruhr University Bochum, Germany firstname.lastname @rub.de { } Abstract—In distributed reflective denial-of-service (DRDoS) In distributed reflective denial-of-service (DRDoS) attacks, attacks, adversaries send requests to public servers (e.g., open an adversary aims to exhaust the victim’s bandwidth. He recursive DNS resolvers) and spoof the IP address of a victim. abuses the fact that public servers of UDP-based network These servers, in turn, flood the victim with valid responses protocols respond to requests without further validating the and – unknowingly – exhaust its bandwidth. Recently, attackers identity (i.e., the IP address) of the sender. DRDoS offers many launched DRDoS attacks with hundreds of Gb/s bandwidth of this desired attack features for an adversary: (i) He disguises his kind. While the attack technique is well-known for a few protocols such as DNS, it is unclear if further protocols are vulnerable to identity, as victims receive backscatter traffic from amplifiers, similar or worse attacks. i.e., systems that can be abused to send traffic to the victim on the attacker’s behalf; (ii) The simultaneous abuse of multiple In this paper, we revisit popular UDP-based protocols of amplifiers permits a highly-distributed DoS attack to be con- network services, online games, P2P filesharing networks and ducted from a single Internet uplink. (iii) The traffic reflected P2P botnets to assess their security against DRDoS abuse. We find that 14 protocols are susceptible to bandwidth amplification to the victim is significantly larger in bandwidth than the traffic and multiply the traffic up to a factor 4670.
    [Show full text]
  • Ddos Beasts and How to Fight Them
    DDoS Beasts and How to Fight Them Artyom Gavrichenkov <[email protected]> Timeline of ancient history • First attacks: 1999-2000 • 2005: STRIDE model by Microsoft • Spoofing Identity • Tampering with Data • Repudiation • Information Disclosure • Denial of Service • Elevation of Privileges [D?]DoS The difference between “a distributed attack” and an, err, not distributed one is vague. Traditional meaning: a distributed attack comes from multiple sources. • What is a source? Is it an IP address or a machine? • If it is a machine, does a virtual instance count? Or a few instances under the same physical hypervisor? What if they often migrate between physical machines? If I’m a victim, how do I tell a single-sourced from a multiple-sourced? • If it is an IP, then how do we treat spoofed traffic? [D?]DoS Hence, a different sort of thinking applies: • DoS (as implied in STRIDE): a vulnerability in a software (e.g. NULL pointer dereference, like Ping of Death) • DDoS: computational resource exhaustion Risk management The basic idea behind STRIDE and other approaches is risk assessment, modelling and management. Probability/Impact Matrix Trivial Minor Moderate Significant Severe Rare Unlikely Moderate Likely Very Likely Probability/Impact Matrix Trivial Minor Moderate Significant Severe DDoS attack, Rare 2018 Unlikely • Impact: Moderate Likely Severe Very Likely • Probability: ? Motivation of an attacker • Fun! • Blackmail • Self-promotion • Political statement • Revenge • Market competition • Diverting attention (e.g. in case of theft) • Preventing access to a compromising information Motivation of an attacker • Fun! • Blackmail Rather hard to evaluate and control • Self-promotion • Political statement • Revenge • Market competition • Diverting attention More or less predictable! (e.g.
    [Show full text]
  • Threat Landscape and Good Practice Guide for Internet Infrastructure
    Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 European Union Agency for Network and Information Security www.enisa.europa.eu Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors Dr. Cédric Lévy-Bencheton (ENISA), Dr. Louis Marinos (ENISA), Rossella Mattioli (ENISA), Dr. Thomas King (DE-CIX Management GmbH), Christoph Dietzel (DE-CIX Management GmbH), Jan Stumpf (DE-CIX Management GmbH) Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected] Acknowledgements For the completion of this study, ENISA has worked closely with: • The “Internet infrastructure security and resilience” reference group. • Individual experts that reviewed the results and provided valuable feedback: Randy Bush (Internet Initiative Japan), Patrick Fältström (Netnod), Peter Koch (DENIC), Benno Overeinder (NLnetLabs), Andrei Robachevsky (Internet Society). We are grateful for their valuable input and comments.
    [Show full text]
  • Port Ranges Traffic Analysis
    Simon Owens Port Ranges • Ports 0 to 1023 are Well-Known Ports. • Ports 1024 to 49151 are Registered Ports (often registered by a software developer to designate a particular port for their application) • Ports 49152 to 65535 are Public Ports. Traffic Analysis - Wireshark Configure Name Resolution 1. Make a new profile 2. Make a “hosts” file with format “ip hostname” 3. Place that “hosts” file in the ~/.config/wireshark/configprofilename/ folder 4. open pcap file, select your configuration profile, and ensure “view>>name resolution>>resolve network/transport address names” is checked Configure Ports 1. Go to “Edit>>preferences>>columns” and add src and dst ports to the display Figuring out what multi-cast goes too 1. Fill out “hosts” and “services” file if you can 2. Click on various multi-cast products – generally the parameters will identify what the application is with a version or the company that made it. Query for Common Ports • tcp.dstport >= 0 and tcp.dstport <= 10000 || tftp || dns Saving off filters to make capture smaller 1. Apply a filter 2. Click “File>> Export Specified Packets” then save them to a file Search for Strings • Edit >> find packet Extracting files • file >> export objects Find Hashes • net-creds.py file.pcap Changing Parameters in the Packets Simon Owens • Port Scan Netdiscover -r <ip-range> make sure you know everything on network IP=insert mkdir $IP Masscan: • masscan -p0-65535 $IP --banners -oG $IP/masscan_$IP.grep Nmap: • Nmap -sV -T4 $IP -oN $IP/normalNmap.txt • nmap -v -sS -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/TCPscan_$IP • nmap -v -sU -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/UDPscan_$IP General Services: • 9/tcp - Discard o Discard Protocol - https://www.exploit-db.com/exploits/19555 The Discard Protocol is a service in the Internet Protocol Suite defined in RFC 863.
    [Show full text]
  • ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction
    ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction ...............................................................................................................................................................................3 Signature-Based Recognition vs. ACL’s ................................................................................................................3 Detection Engine ...................................................................................................................................................................3 Using Groups or Individual Applications .............................................................................................................3 Actions Once an Application is Detected ...........................................................................................................3 Appendix A: Application List ........................................................................................................................................ 4 martellotech.com elfiq.com 2 INTRODUCTION The Elfiq AppOptimizer is designed to give organizations full control over their existing and future bandwidth, guaranteeing key applications such as Citrix XenDesktop or Skype get priority treatment and undesirables such as peer-to-peer file transfers or games are limited or no longer permitted. It is an add-on-module that provides application-layer deep packet inspection (layer 7) classification and control, including Mobile, Social Networking, P2P, Instant Messaging,
    [Show full text]
  • Download Pdf Presentation Here
    Brocade SDN/OpenFlow Update Legal Disclaimer All or some of the products detailed in this presentation may still be under development and certain specifications, including but not limited to, release dates, prices, and product features, may change. The products may not function as intended and a production version of the products may never be released. Even if a production version is released, it may be materially different from the pre-release version discussed in this presentation. NOTHING IN THIS PRESENTATION SHALL BE DEEMED TO CREATE A WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT OF THIRD-PARTY RIGHTS WITH RESPECT TO ANY PRODUCTS AND SERVICES REFERENCED HEREIN. ADX, AnyIO, Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, HyperEdge, ICX, MLX, MyBrocade, OpenScript, VCS, VDX, and Vyatta are registered trademarks, and The Effortless Network and The On-Demand Data Center are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of others. © 2015 Brocade Communications Systems, Inc. All Rights Reserved. 2 Agenda • Brocade Flow Optimizer Application • Brocade SDN Controller • New Brocade OpenFlow router features • Presenter’s latest research work © 2015 Brocade Communications Systems, Inc. All Rights Reserved. 3 Brocade Flow Optimizer Application REST API Internet
    [Show full text]