Application Adaptive Bandwidth Management Using Real-Time Network Monitoring
Total Page：16
File Type：pdf, Size：1020Kb
East Tennessee State University Digital Commons @ East Tennessee State University Electronic Theses and Dissertations Student Works 8-2003 Application Adaptive Bandwidth Management Using Real-Time Network Monitoring. Amit Grover East Tennessee State University Follow this and additional works at: https://dc.etsu.edu/etd Part of the Computer Sciences Commons Recommended Citation Grover, Amit, "Application Adaptive Bandwidth Management Using Real-Time Network Monitoring." (2003). Electronic Theses and Dissertations. Paper 802. https://dc.etsu.edu/etd/802 This Thesis - Open Access is brought to you for free and open access by the Student Works at Digital Commons @ East Tennessee State University. It has been accepted for inclusion in Electronic Theses and Dissertations by an authorized administrator of Digital Commons @ East Tennessee State University. For more information, please contact [email protected]. Application Adaptive Bandwidth Management Using Real–Time Network Monitoring ________________ A thesis presented to the faculty of the Department of Computer and Information Sciences East Tennessee State University _______________ In partial fulfillment of the requirements for the degree Master of Science in Computer Science ________________ by Amit Grover August 2003 _______________ Dr Neil Thomas, Chair Dr Phillip E. Pfeiffer IV Dr Qing Yuan Keywords: Bandwidth Management, Network, Security, Ports, Intrusion ABSTRACT Application Adaptive Bandwidth Management Using Real–Time Network Monitoring by Amit Grover Application adaptive bandwidth management is a strategy for ensuring secure and reliable network operation in the presence of undesirable applications competing for a network’s crucial bandwidth, covert channels of communication via non-standard traffic on well-known ports, and coordinated Denial of Service attacks. The study undertaken here explored the classification, analysis and management of the network traffic on the basis of ports and protocols used, type of applications, traffic direction and flow rates on the East Tennessee State University’s campus- wide network. Bandwidth measurements over a nine-month period indicated bandwidth abuse of less than 0.0001% of total network bandwidth. The conclusion suggests the use of the defense- in-depth approach in conjunction with the KHYATI (Knowledge, Host hardening, Yauld monitoring, Analysis, Tools and Implementation) paradigm to ensure effective information assurance. 2 DEDICATION To my parents Shri Suresh K Grover and Smt Asha Grover and my brother Sumit Grover to whom I am indebted for their constant encouragement and unwavering support that helped me sail through trying times. 3 ACKNOWLEDGEMENTS I wish to express my sincere gratitude to my advisory committee members—Dr Neil Thomas (chair for the final part), Dr Phillip E Pfeiffer IV (chair for the initial part), and Dr Qing Yuan— without whose unwavering support and guidance, this manuscript would not have been possible. Dr Pfeiffer’s academic brilliance, impeccable computing experience, clarity of vision, and meticulousness was responsible for shaping this thesis in its crucial foundation stages. Dr Thomas’s constant encouragement, thorough knowledge and invaluable computing expertise were responsible for guiding the remaining part of the thesis. I also wish to express my sincere thanks to the staff of OIT—Bob Cook, Steven Webb, Timothy White, JD Reed and Jim Ashe— for their help in dealing with various infrastructure issues. 4 CONTENTS Page ABSTRACT ……………………………………………………………….……….. 2 DEDICATION ……………………………………………………………………… 3 ACKNOWLEDGEMENTS ………………………………………………………… 4 LIST OF TABLES………………………………………………………………….. 11 LIST OF FIGURES…………………………………………………………..…….. 13 Chapter 1 INTRODUCTION………………………………………………..………… 15 1.0 Information Assurance……………………………………………… 15 1.1 Synopsis of the Approach Taken…………………………………… 19 1.2 Firewalling……………………………………………..…………… 19 1.3 Packet-Shaping……………………………………………………… 19 1.4 Hybrid Strategy…………………………………………………...… 20 1.5 Key Results………………………………………………….….…… 20 1.6 Structure for the Balance of the Thesis……………………………… 21 2 PORT ABUSE AND COUNTERMEASURES…………………………..… 22 2.1 Characteristics of the Transport Layer ……………………………… 22 2.1.1 Mechanisms for Layer 4 Traffic Flow………………………. 22 2.1.1.1 Notion of Ports………………………………..…… 23 2.1.1.2 Standard Uses of Ports……………………………. 24 2.1.1.2.1 “Trojan” Ports…………………………… 25 2.1.1.3 Covert Channels of Communication……………… 25 2.1.2 Typical Characteristics of Layer 4 Traffic Flow………………. 26 5 2.2 Abusing Ports to Compromise Security…………………………….. 27 2.2.1 Port Scanning………………………………………..……… 27 2.2.1.1 TCP Connect Scan………………..………………… 28 2.2.1.2 TCP SYN (Half Open) Scan……………………..… 29 2.2.1.3 TCP FIN (Stealth) Scan………………………….… 29 2.2.1.4 TCP Ftp Proxy (Bounce Attack) Scan……………... 29 2.2.1.5 TCP Xmas Tree Scan…………………………….… 30 2.2.1.6 TCP Null Scan…………………………………….… 30 2.2.1.7 TCP ACK Scan……………………………….…… 30 2.2.1.8 TCP Windows Scan………………………………… 31 2.2.1.9 TCP RPC Scan……………………………………… 31 2.2.1.10 SYN / FIN Scan Using IP Fragments (Bypass Packet Filters)……………………………………………….. 31 2.2.1.11 UDP Recvfrom() And Write() Scan………….…… 32 2.2.1.12 UDP Raw ICMP Port Unreachable Scan…….…… 32 2.2.1.13 ICMP Echo Scan (Ping – Sweep) ………………… 32 2.2.1.14 Reverse-ident Scan………………………………… 33 2.2.1.15 Idle Scan…………………………………………… 33 2.2.2 Stack Fingerprinting……………..…………………………… 33 2.2.2.1 Active Stack Fingerprinting ….……………………… 34 2.2.2.1.1 FIN Probe………………………………… 34 2.2.2.1.2 Bogus Flag Probe………………………… 34 2.2.2.1.3 Initial Sequence Number (ISN) Sampling… 35 6 2.2.2.1.4 “Don’t Fragment Bit” Monitoring……… 35 2.2.2.1.5 TCP Initial Window Size……………… 35 2.2.2.1.6 ACK Value…………………………..… 36 2.2.2.1.7 ICMP Error Message Quenching…….… 36 2.2.2.1.8 ICMP Message Quoting………..…….… 36 2.2.2.1.9 ICMP Error Message-Echoing Integrity.. 37 2.2.2.1.10 Type of Service (TOS) ……..………….. 37 2.2.2.1.11 Fragmentation Handling………………… 37 2.2.2.1.12 TCP Options…………………………..… 38 2.2.2.2 Passive Stack Fingerprinting ………………………… 38 2.3 Techniques for Detecting Invalid Use of Ports…………………………… 38 2.3.1 Use Analysis……………………………………………….…… 38 2.3.2 Bandwidth Analysis…………………………………………… 39 2.3.3 Content Analysis……………………………………………… 40 2.3.3.1 Real Time Intrusion Detection……………………… 42 2.3.3.1.1 Overload, Crash and Subterfuge Attacks……. 43 2.3.3.2 Traffic Normalization………………………………..… 44 2.3.3.3 Intrusion Detection Wrappers………………………… 45 2.3.3.4 Intrusion Detection Based On Expert Systems………. 45 2.3.3.5 Intrusion Prevention…………………………………. 46 2.3.4 Timing Analysis……………………………………………… 46 2.4 Techniques for Blocking Invalid Use of “Mainstream” Ports……….. 47 2.4.1 Shutting Down Unneeded Services………………………..…. 47 7 2.4.2 Port Re-Mapping…………………………….……………… 47 2.4.3 Static Packet Filtering………………………………….…… 48 2.4.4 Dynamic Packet Filtering…………………………………… 48 2.4.5 Stateful Filtering…………………………………………..… 48 2.4.6 Proxy Filtering……………………………………………… 49 2.4.7 Plug Gateways……………………………………………… 49 2.4.8 Port Address Translation…………………………………… 49 2.4.9 Traffic Management………………………………………… 49 3 BANDWIDTH MANAGEMENT…………………………………………… 51 3.1 Goals ………………………………………………………………… 51 3.2 Preliminaries………………………………………………..………… 51 3.2.1 Background study…………………………………………….. 52 3.2.2 Data Collection Tools………………………………………… 52 3.2.2.1 PacketShaper………………………………………… 53 3.2.2.2 Active Ports ………………………………………… 53 3.2.2.3 PacketPup …………………………………………… 54 3.2.2.4 Network Probe 0.4…………………………………… 54 3.2.2.5 Ethereal ……………………………………………… 55 3.2.2.6 Action Request System ……………………………… 56 3.2.2.7 McAfee’s GroupShield Exchange 5.0 Enterprise Suite… 56 3.2.3 Monitoring Station………..………………………………….… 56 3.3 Bandwidth Management………………………………………….…… 57 3.3.1 Classification of the Network Traffic…………………………. 57 8 3.3.2 Analysis and Interpretation…………………………………… 61 3.3.3 Enforcement of Management Policies………………………… 63 3.3.3.1 Feedback-Oriented Fine-Tuning……………………… 65 3.3.4 Data Integrity Verification……………………………………. 73 3.3.5 Non-Standard Traffic ………………………………………… 73 3.3.5.1 Step I: Initiate Network Probe………………………… 75 3.3.5.2 Step II: Isolate Communication for Interesting Ports….. 78 3.3.5.3 Step III : Identification of Potential Secondary Target Ports…………………………………………..... 78 3.3.5.4 Step IV : Isolating Conversations from ‘Suspect’ Hosts…………………………………………….…..…. 79 3.3.5.5 Step V: Target Host Investigation…….……………….. 80 3.3.5.6 Step VI : Physical Identification of Target Machines…. 84 4 RESULTS …………………………………………………………………….… 88 4.1 Results ………………………………………………………………….. 88 4.2 Bandwidth Traffic Tree………………………………………………… 88 4.3 Top Ten Protocols……………………………………………………… 89 4.4 Breakdown of HTTP Traffic…………………………………………… 90 4.5 Bandwidth Utilization………………………………………………..… 91 4.6 Rogue Traffic on Legitimate Ports……………………………..……… 93 4.7 Bandwidth Abuse……………………………………………………… 94 4.7.1 Bandwidth Abuse Analysis…………………………………… 96 5 CONCLUSION……………………………………………………………..… 97 9 5.1 Defense–In–Depth ………………………………………………..…… 97 5.2 The ‘KHYATI’ Paradigm……………………………………………… 97 5.2.1 Knowledge……………………………………………………… 98 5.2.2 Host hardening…………..……………………………………… 98 5.2.3 Yauld monitoring……………….……………………………… 99 5.2.4 Analysis…………….………………………………………..… 99 5.2.5 Tools…………………..……………………………………..… 99 5.2.6 Implementation………………………..……………………..… 100 BIBLIOGRAPHY ………………..………………………………………………… 101 APPENDICES Appendix A: PROTOCOLS AND SERVICES SUPPORTED BY ETHEREAL 105 Appendix B: PROTOCOLS AND SERVICES CLASSIFIED BY PACKETSHAPER ………………………………….………….... 107 Appendix C: SAMPLE AVERAGE AND PEAK FLOW RATES…………….. 112 Appendix D: NETWORK PERFORMANCE SUMMARY………..…………… 115 Appendix E: ETSU NETWORK TRAFFIC TREE