bn2019_2

Size: px

Start display at page:

Download "bn2019_2"

다은 견
4 years ago
Views:

10 arp -a

16 Packet Logging/Editing Decode Buffer Capture Driver Logging: permanent storage of packets for offline analysis Decode: packets must be decoded to human readable form. Buffer: packets must temporarily buffered prior to storage or processing. Capture driver: software driver to capture and filter network traffic.

18 Router Attacker

21 arpspoof -t :c:29:12:d:cd 0:c:29:4b:3a:ad : arp reply is-at 0:c:29:12:d:cd 0:c:29:12:d:cd 0:c:29:4b:3a:ad : arp reply is-at 0:c:29:12:d:cd 0:c:29:12:d:cd 0:c:29:4b:3a:ad : arp reply is-at 0:c:29:12:d:cd 0:c:29:12:d:cd 0:c:29:4b:3a:ad : arp reply is-at 0:c:29:12:d:cd

22 tcpdump -v -XX arp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size bytes 20:57: ARP, Ethernet (len 6), IPv4 (len 4), Reply _gateway is-at 00:0c:29:12:0d:cd (oui Unknown), length 28 0x0000: 000c 294b 3aad 000c dcd )K:...)... 0x0010: c dcd ac10 b502...)... 0x0020: 000c 294b 3aad ac10 b590..)k:... 20:57: ARP, Ethernet (len 6), IPv4 (len 4), Reply _gateway is-at 00:0c:29:12:0d:cd (oui Unknown), length 28 0x0000: 000c 294b 3aad 000c dcd )K:...)... 0x0010: c dcd ac10 b502...)... 0x0020: 000c 294b 3aad ac10 b590..)k:...

34 tcpdump -n -v icmp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size bytes 21:35: IP (tos 0x0, ttl 64, id 43041, offset 0, flags [DF], proto ICMP (1), length 1500) > : ICMP echo request, id 6076, seq 1, length 1480 tcpdump -n -v icmp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size bytes 21:35: IP (tos 0x0, ttl 64, id 19232, offset 0, flags [+], proto ICMP (1), length 1500) > : ICMP echo request, id 6071, seq 1, length :35: IP (tos 0x0, ttl 64, id 19232, offset 1480, flags [none], proto ICMP (1), length 21) > : ip-proto-1

36 Class A [bit]] 0 netid hostid Class B 1 0 netid hostid Class C netid hostid Class D Multicast address Class C 주소 Subnet mask 서브네트로 2bit 사용 Subnet mask

37 Reserved address blocks CIDR address block Description Reference /8 Current network (only valid as source address) RFC /8 Private network RFC /8 Public data networks RFC /8 Loopback RFC /16 Reserved (IANA) RFC /16 Link-Local RFC /12 Private network RFC /16 Reserved (IANA) RFC /24 Reserved (IANA) RFC /24 Documentation and example code RFC /24 IPv6 to IPv4 relay RFC /16 Private network RFC /15 Network benchmark tests RFC /24 Reserved (IANA) RFC /4 Multicasts (former Class D network) RFC /4 Reserved (former Class E network) RFC Broadcast

40 void main() { unsigned int i; int c; i=0x4500+0x002c+0x02e4+0x8006+0x4a7d+0x8268+0xac10+0xb58d; if (i>0xffff) { }

08:16:48.095814 IP (tos 0x0, ttl 53, id 61092, offset 0, flags [none], proto TCP (6), length 60) 172.217.24.36.80 > 192.168.0.89.57664: Flags [S.

41 08:16: IP (tos 0x0, ttl 53, id 61092, offset 0, flags [none], proto TCP (6), length 60) > : Flags [S.], cksum 0xba9f (correct), seq , ack , win 42408, options [mss 1380,sackOK,TS val ecr ,nop,wscale 7], length 0 0x0000: c eea acd E..< $ 0x0010: c0a e140 c8a5 c8a4 2a5e 2a8e...Y.P.@...*^*. 0x0020: a012 a5a8 ba9f a...d... 0x0030: d5e0 baac 4737 c26c G7.l...

42 Packet Logging/Editing Decode Buffer Capture Driver Media Logging: permanent storage of packets for offline analysis Decode: packets must be decoded to human readable form. Buffer: packets must temporarily buffered prior to storage or processing. Capture driver: software driver to capture and filter network traffic. Media: usually an Ethernet card but could also be a wireless card or anything else.

55 FTP Mail http Etc 응용 프로그램 소켓 소켓 소켓 소켓 소켓 Port 21 번 Port 25 번 Port 80 번 Port 1025 번 Port IP :

59 A B SEQ ACK SEQ ACK A0 0 -> SYN <-SYN,ACK B0 A1 A1 B1 -> ACK A1 B1 ->PSH,ACK 데이터 21B <-ACK B1 A22 <-PSH,ACK 데이터 1068B A22 B1069 ->ACK B1 A22 <- FIN, ACK B1069 A22 A22 B1070 -> ACK A22 B1070 -> FIN, ACK <-ACK B1070 A23

82 4XX ( 클라이언트에러 ) 400 bad request 401 unauthorized 403 forbidden 404 not found 5XX ( 서버에러 ) 500 int. server error 501 not impl. 502 bad gateway 503 svc not avail

TCP.IP.ppt

TCP.IP.ppt TCP/IP TCP/IP TCP/IP TCP/IP TCP/IP Internet Protocol _ IP Address Internet Protocol _ Subnet Mask Internet Protocol _ ARP(Address Resolution Protocol) Internet Protocol _ RARP(Reverse Address Resolution