Packet Capturing and Attacks on the TCP/IP Stack

Two prevalent network security threats: packet sniffing and spoofing.

Packet Sniffing and Spoofing

• Packet Sniffing involves capturing network packets not intended for your machine.
• Packet Spoofing refers to creating and sending fake packets to a network.

Useful for:

• Intrusion Analysts: Examine network traffic to detect and study intrusions.
• Forensic Investigators: Assess the extent of malware infections.
• Attackers: Gain insights into victim networks.

Sniffing

Machines are connected to networks through Network Interface Cards (NIC)

• Network Interface Card (NIC):
  
  • NIC is a physical or logical link between a machine and a network. Each NIC has a hardware address called MAC address.
  • The NIC “hear” all the traffic on the network, but it only processes and accepts the frames that are addressed specifically to its own MAC address.
    • Frame with the destined address of the NIC will be taken to the CPU for further processing.
    • Frames with different destination MAC addresses are discarded by the NIC.

In order to sniff packets that are not ours, we turn on Promiscuous Mode:

• On Promiscuous Mode, NIC passes every frame received from the network to the kernel , regardless of whether the destination MAC address matches with the card’s own address or not.

Implementing Packet Sniffers

• Raw Sockets: These allow access to the raw data flowing through the network. The operating system kernel passes packets directly to applications that use raw sockets. However, this method is not portable across different operating systems.
• Packet Filtering: When sniffing, we aim to capture specific types of packets (e.g., TCP, DNS queries) while discarding unwanted ones. Filtering packets before they reach the application can save processing time.

Spoofing

Packet Spoofing: This involves altering critical information in packet headers, such as the source IP address, sequence number, or port number, to deceive the target.

1. TCP SYN Flooding

   • Denial-of-Service (DoS) Attack: The attacker sends numerous SYN packets to a server without completing the TCP three-way handshake, overwhelming the server’s queue of half-open connections and preventing legitimate connections.
   • Technique: Attackers use random source IP addresses to avoid being blocked.

2. TCP Reset Attack

   • Disrupting Connections: Attackers send spoofed RST packets to terminate an ongoing TCP connection between two hosts.

3. TCP Session Hijacking

   • Injecting Data: During an ongoing TCP session, attackers inject arbitrary data into the TCP receiver’s buffer. The injected packets must match the original session’s srcIP, destIP, srcPort, and destPort to be accepted by the server.

To learn more about attack methods and how they work, check out Analyze Attack on TCP

Conclusion

Understanding and mitigating the risks of packet sniffing and spoofing are crucial for maintaining robust network security. By comprehending the mechanisms and potential impacts of these threats, network administrators can better safeguard their systems, ensuring confidentiality, integrity, authenticity, and availability of their network resources.