Detecting Suspect Traffic
To illustrate the differences in the output of ipchains and iptables firewalls, we first compare log entries generated by an nmap XMAS scan.
The ipchains messages in Listing 2 were generated by an nmap XMAS scan of TCP ports 79 through 81. Recall that an XMAS scan sets the FIN, URG and PSH flags. First the nmap command and output is listed followed by the corresponding ipchains output. Note that ipchains makes no mention of which TCP flags were set.
Now we perform the same nmap scan (the nmap command line and output is identical to the above ipchains example, so it is not repeated) and display the corresponding iptables output (see Listing 3). This time we can plainly see the FIN, URG and PSH flags set in the packets used in the scan.
Michael Rash works as a senior security engineer for an ASP in Annapolis, Maryland. He holds a Master's in Applied Mathematics from the University of Maryland and has been tinkering with Linux since 1998. He can be reached at firstname.lastname@example.org.
|Alice, the Turtle of the Modern Age||Mar 07, 2014|
|Using Django and MongoDB to Build a Blog||Mar 05, 2014|
|What virtualization solution do you use/manage at work?||Mar 04, 2014|
|Our Assignment||Mar 04, 2014|
|March 2014 Issue of Linux Journal: 20 Years of Linux Journal||Mar 03, 2014|
|Have Resume - Will Travel||Feb 28, 2014|
- Alice, the Turtle of the Modern Age
- Using Django and MongoDB to Build a Blog
- Senior Perl Developer
- Linux Systems Administrator
- Technical Support Rep
- UX Designer
- Zato—Agile ESB, SOA, REST and Cloud Integrations in Python
- Sign Up to Win a Silicon Mechanics Swag Pack!
- Drupal Special Edition
- You have to be careful there
1 week 3 days ago
- Wonder when LJ is going to
1 week 4 days ago
- Puerto Rico Free Software
1 week 5 days ago
1 week 6 days ago
- I hate voice commands
2 weeks 1 hour ago
- usabilty --- AGAIN with this nonsense
2 weeks 3 hours ago
- Don't make excuses
2 weeks 6 hours ago
- Sorry to let you know, but
2 weeks 7 hours ago
- Ridiculous statement. Not a
2 weeks 1 day ago
2 weeks 1 day ago