We switched because I had a demonstration for Solaris that was going to be on that screen and there wasn't a screen in the other room, but somebody owned the power adapter so that was kind of a pointless switch but we're going to stay here for this talk anyway. Pretty much we are going to go through a hardening process of Solaris. I had asked for about two hours and I got 50 minutes so we're going to be kind of cruising to get everything done in time. The old and back to the wireless thing for the rest of the day, the breakout area is going to be in Athena and wireless is going to be in here. What I want to do this morning is go through pretty much a step-by-step process of how to lock down hardening Solaris and install. Basically, the best practice of actually hardening a box before you put it on the network is what I'm looking at. However, because I live in the real world and I know that a lot of times these boxes are already on your networks, most of the concepts that we're going to talk about you can do to a live box. Any time that it's going to be something that's dangerous to a live box or to an operational box, I'm going to go ahead and point that out to you so that you know to be careful before you try it. What we're going to cover this morning are basically installation, what we do with the overview process, screen auto lock for the GUI, disabling services, setting up disc quotas, access control lists, set UIDs, set GID files which Solaris by default has a ton of permissions and setting them correctly, setting up, verifying the paths are correct, aliases, system identification, groups, accounts and passwords, logging, chronic add jobs and also the if you must use stuff that I would recommend that you turn off immediately before you even think about looking at your box. But if you've got to use it for some operational requirement, what we can do there. The NDDs and some miscellaneous stuff and finally the border. What I'm not going to cover today are DNS and bind, NIS and NIS plus, NFS and sort of specific or third party software like Apache or anything like that because in one of those we can talk for two hours on by themselves. First off, installation. Load from an official CD. Don't get some burned CD that somebody is that, hey man, this is a great Solaris A version, go with it. Also make sure that you set up your partitions large enough to accommodate patches. I found that one of the biggest problems I run into is that people download the patch cluster but they haven't actually set up a partition big enough to put the patches on the machine and they end up having to either rebuild or skip the patch. Don't load the entire distribution which is actually what I'm covering.  If you just come in and say everything plus OEM, that's how we're looking at it, don't do that. Just install the packages that you need and apply the appropriate patches. There is the link for the patches and the presentation is on your CD and all the links are on there so if you don't have them, you can just copy paste them out of there. Also maintain two current backups. If you have the resources, keep one on site and keep one off site. Open boot. Open boot is fun because I like to make things difficult with open boot. First of all, I suggest that you set the security level to full instead of command. However, at a minimum it needs to be set to command. To do that, from the root prompt, ee prompt security mode equals command. Very difficult. From the open boot prompt, set in security mode command. Also very easy. For full, pretty much the same things that you go with full instead of command. Open boot password. You should always set the open boot password. That way when somebody comes by and reboots your machine because somebody didn't lock the screen, they have to know an additional password before they can even begin to start playing around with your system. To do that, from the root prompt, ee prompt security password, it will prompt you and you can put your password in. From the open boot prompt password. Also set an open boot banner. To set the environment variable for the oan banner to true. And then the system property of or unauthorized access or whatever you want to put in there. Make sure that you've got something, it's an extra little no trespassing sign that you can put on the machine. The GUI really should be in the if you must view section because mainly what I'm talking about today are servers. And the fact of the matter is there is no reason that you need to have a GUI enabled on your server.  Then make sure that you have the auto lock enabled. For CDE, very easy to do. Right click on the desktop, choose desktop controls. Choose the screen style manager and click the on button. And then make sure to scroll the screen wherever you want it to be set. I like to do it at one minute. That way if I walk away for any reason it would immediately pretty much go to a screen lock. However, most people seem to like five or ten minutes a little bit better. It's a little bit more realistic in case you turn around to pick up a piece of paper. Open windows, properties, miscellaneous and set the screensaver to auto and fill in the number of minutes that you want to actually have it turn on the auto lock. Services. Before I get started on services, one thing. Disable all unneeded services. When I go out and do assessments pretty much at least one a week. And one of the biggest problems that I have there from an assessment standpoint and from an incident response standpoint is somebody that has got owned because they have their box sitting there with telemet running and FTP running or SEMP. Any number of services. Solaris starts about a 900,000 by default.  If it's an SSH server, make sure to have it running only SSH and nothing else. If it's Apache, just web and whatever method you're going to use to actually access the box remotely. SSH being the best choice there. I'm going to switch real quick to what I did was I did an ISS scan of a default Solaris installed with OEM. That is what ISS picks up as you see there are a ton of highs, a ton of mediums and a ton of rows. But I also did was at the end of this, after I went through the whole process, I did another scan to show you what the difference is and we'll take a look at that in a few minutes. But as you can see, this is what most people have sitting on that network. Most people just put it to fault install. If it works, they're good. So they think, unfortunately they don't realize the admin D has started, well this admin D has started by default. They don't realize that SEMP gaming is running and the UNFS server is running. Let me catch myself back up for that separate PowerPoint. Exciting. Okay, so disable unneeded services. First off, INED.com, that is where you're going to have about 30 unneeded services that are enabled by default. Telnet's in there, FTP is in there. What else? SMMD is in there, Tool Talk database server is in there. If you're not using them, disable them. If you're using any of those, try and figure out why and see if you can't get rid of them. The way to do that is just quite simply to comment out the lines that aren't needed. Also check your RC2.D and RC3.D directories that have the startup scripts in there. You don't want to move the file to a different name and stop the service that it's already running. I usually just use a lowercase letter then when it boots up it won't get it. Other people put dots in front of them and do all kinds of things, but whatever method you want to use is fine just as long as it has changed the name from a capital S with the number and the service. One thing that I like that people know is the GUI interface.  What I've been able to find out is if you've got some manager that wants you to run a GUI so he can come and look at the pretty firewall rules, what you can do is disable the GUI for having it running by simply killing an RPC. If you had an RPC dead, the GUI will not work. All you have to do if you want to enable the GUI is restart RPC manually, just a S71 RPC start and then start the GUI up and you can do whatever you need to do and then disable it when you're done. Make sure to disable send mail, it is started by default. If it's not a mail server and you want to get rid of it, it opens up a ton of problems for you. To do that, that is in rc2.d and it's the SADA script. If it is a mail server, configure it to prevent message source routing. I'm now running out the next few lines in the send mail.cf. I'm not going to read those but you can look at them and they are on the CD. Expand and verify are started by default. What you want to do with those is add the following two lines to send mail.cf. I've no expand, I've no verify, that would kill those for you. Install and configure secure shell on the CD in the directory. I actually put the HTML file for how to install OpenSSH on the CD so that you can read through it. It's got pretty good directions on what files you need. I actually wanted to put several other things including OpenSSH and the recommended zip files on there. But when I got done with all the stuff I wanted to put on the CD, I think I had a CD by myself so they told me to dial it back a bit. Use reporters. Does anybody have any idea why you would want use reporters? Mainly? Good. I'm going to assume you're right because I can't hear you. But if he said because you don't want your users to have... Users are generally running their own scripts. They've got all kinds of things they're running in their home directories. You don't want them to have something get away from them and run away and take up all of your disk space. If you have a quota there, it will stop all from happening. And putting these in quotas is actually pretty easy. The first thing you do is you edit the VFS tab and add the mount option for quota, which is just quota at the very end. There's a dash there by default, replace it with quota. Create a file called quota in the root directory of the file system. And for what we're doing here, we're going to take a look at export home. Touch export home quotas. Then you're going to need to set up a prototype quota entry. And to do that, you use egg quota. Egg quota, quota user, whatever the user that you want to be there. And you add the number of blocks, hard and soft blocks and inodes. What that does is that tells you how big of a disk space they're allowed to have and also how many files they are allowed to have. The inodes are the number of files. So in our example here, they're getting five megabytes of space and they are getting up to a thousand files in their home directory. That would be when they get a warning. That's the soft limit. The hard limit is when it will actually cut them off. They will not be able to log back in until they get that fixed. I'm sorry, they will be able to log back in. They will not be able to create any new files or add any new space to the disk. Then what you need to do is replicate that across the board for all the users. So if you have 10 users in there, egg quota minus p, then you're quota user. And then just list out the names of the users that you want to set that quota up for. Next thing you do is activate them with quota on, which is the quota on and the file system that you want the queries to be enabled on. Quota check command is used next and that is going to build the statistics. That's so that you can actually go back and see where people stand. Is anybody getting close to their quota limit and why? And to do that, just quota check minus a. That quota will then report that data back to you and it will look something like that, tell you where people are. Access control lists. Next, ACLs are very, very easy to set up in Salares, unlike some distros. There's a ton of things I like about it because you can change things around and only let people get to what they need to get to. It will allow you to avoid the group account problems. To do that, just use setFACL to set the access controls. For our example here, what we're going to use is a file called access file. It will give you an output of what it currently looks like. You can see that I have the ownership and the admins group get access to the file. Do a getFACL on it and it will show you that user has re-write, group has re-write, other has nothing. If we want to change that to allow a user named Russ, who was actually going to be sitting there showing you guys how to do this, but he's going now to have access to that file. He's not part of the admins group. Just do a setFACL minus a. The user and code one and then whatever user you want to have access to the file, what access is going to have in this case re-write and then the name of the file. Then when you do another getFACL on it, you will see that user Russ has been added to the list. SetUID and setGID files. I would actually recommend that rather than do exactly what I say here, I would actually script this out because otherwise it will take you a long time, but you simply do a find on the type here that will give you your setUID files. You can pipe that out to a file somewhere to look at later because like I mentioned before there are a ton. For the most part, very, very few of them actually need to be setUID. Same thing as setGID. Once you have those piped out, you can go through them kind of at your leisure and look at them or if you want to take the time to actually write a script out for it, you can have a grep through the file and pull out the ones that you want and change them, change the farms on them. Next, you want to find all the world-rightable files. Again, SolarOS has quite a few of these. Simply do a find on them, pipe it out to a file and go through and look at them. You should be able at that point to go through and figure out which ones need to be and which ones don't because there aren't that many that do, especially in a server environment. Permissions. Root UMass. Set to either 027 or 077 to do that. You edit the Etsy default login file and just set the root UMass to 077, which is what I actually recommend. The way the UMass works is it XORs, every time you create a new file, it XORs with the root UMass that is set in that file and it will then give you the opposite. So in our case, every file that Root creates is going to have initial permissions of 700. You also want to check the system device permissions by default. So the device permissions are set correctly. You shouldn't change them. There's really no need. What you would want to do is actually verify and make sure that they don't change and they have not been changed. You can check that periodically. You also want to check the permissions on UTMP. Ensure that they are set to 644. Ensure that the Etsy password is set to 644. Got to love the Root UMass graphic. And you want to make sure that the Etsy shadow is set to 400. Also, to really restrict the host type query of our hosts and .NET RC files, what I suggest doing on those is actually touching create them and then chmod zero them so that when you look down there, no one has read, write, or execute access to any of those. Restrict the privileges on Snoop to Root only. By default, I think that it sets it to, yeah, pretty much everybody can use it. So you don't want that. You don't want anybody who is on your network, especially if you're not in a switched environment to be able to sniff all your network traffic. So we're going to set the default provisions to execute for Root and no one else. The root user path. User bin has been and user has been. Root user really does not need to have anything other than Madness path. That's done by editing the .pro file file in Roots home directory. Also, this is another one that you're probably going to want to script out a little bit and I actually wanted to do that for you guys, but again, they had me pull a bunch of stuff off the CD so you didn't get everything. But you want to make sure that no user has a . in his path. Just if you're going to do it manually, if you're in an environment where you don't have a lot of users, it's pretty easy to just let the read user's path and make sure that there are no dots in there. Now, alternatively, it can be scripted, thanks. I recommend that you alias both the ls and the rm command. With ls, I like to add the dash a and dash b option and with rm, I like to add the dash i. What that will do is with ls, you will get all of your dot files. Without having to actually do a minus a, every time you type ls out, you'll get all the hidden files that may be shown to you so you can keep track of them and you make sure that nothing has popped up that you aren't aware of. With the dash i, what you do is, it's going to ask you before you, I'm sorry, before it deletes the file, it will ask you, are you sure you want to do this? This is particularly important with root because root can delete very important files very quickly. The example that I always like to give is a mistake that I made a long, long time ago where I did an rm minus rf dot dot slash star and that is recursive and it started going up and up and up and up and up to leading files. I would have very much liked to have had that ask me before it destroyed my entire file system. To do that, depending on the shell that root is using or the user is using, you follow the steps on there, you use cshell, you use the alias command inside the dot login file, born and corn, you add those lines to dot profile and with bash, you use the dot bash rc and do the same commands that you would use in the born and corn shell. Include the system name in the root and admin shell prompt. Most of your admins have access to multiple boxes at a time. So they're ssh'd into four different machines running around making changes. What you want to do is make sure that for at least those people, the name of the system that they're on is in their prompt. That way they don't accidentally change things on the machine that they did not mean to. Again, you do that with the cshell and the dot login file, born and corn in the dot profile and with bash and the dot bash rc. And you just do, for born and corn, the ps1 equals uname minus n for the cshell you set the prompt. Groups, accounts and passwords. What you want to do is require the users to use the new group command to change groups. To do that, don't have any users assigned to groups other than staff. Every single user to include your admins to have just a regular staff user group. Then you want to choose a strong group password for, let's say we're going to have the admins group in this case. You want to choose a strong password for that group. The easiest way to actually set that password is to change the password on a normally locked account. I like to use LP. To do that, just obviously the password LP, put the password in and then that's the slide that I lost. Then what you do is you actually cut and paste that out, edit the etsy groups file and replace the no password in the etsy groups file with that password. Then whenever someone wants to actually change to that group, they just issue a new group command. New group admins, for instance, it will then prompt them for the password. They put the password in and they are then part of that admins group. If they do not have the correct password, they cannot change groups. Obviously also you'll probably want to go back and relock the LP account when you're done. I like to restrict the use of SU.  I like to make it as difficult as possible even for people that are supposed to have it. If you want to actually get UID0 on one of my machines, you're going to have to provide me with about eight strong passwords before you're done.  A sign of password to that group which we talked about. Then anyone, then change your permissions on the group and anyone who wants to then SU has to add as to new group first to the admins group and then they'll be allowed to SU. That's the system accounts. This one I'm not quite sure why so many of these accounts are unlocked by the Fed, the Solerys. Make sure to lock the Daemon, the LP, the BAN, the Sys, the ADM, the UCP, blah blah blah blah blah. Lock them all so that they look like that. Also lock the sysadmin and sysgroups in the Etsy group file. Same group process. Next you want to add the Etsy default password to require a password change. At least every eight weeks with a one-week interval between password changes. Also in that file you can set your minimum character length for passwords properly configured. You're going to look something like that where you have a max weeks of eight and then weeks of one and the password length. Eight, nine, ten, whatever you want to use there at least eight for the password length. One thing if the password is already enabled is not going to do anything until they have to change. In other words, if you've got some guy who's got his username, it's three characters for his password as well, until eight weeks have passed and he has to change his password, that password is still going to be sitting there. One PW check to check for inconsistencies. What that will do is it will check the field number, the login name, the UID, the GID and the login directory and shell for the user. Verify that those are correct. Do the same thing with the group. Run group check to make sure that those are properly configured and what you're expecting to see. Then you're also going to want to verify the permissions of Etsy group for 644. No all SU attempts. I like to, some people have this said so that they're not all logged, that only the failed issues are logged. I like to log them all. I want to know everyone that tried and everyone that succeeded to get SU. Disk space can be an issue if you don't check this and clear it out every once in a while. First of all, to do that you just verify that Etsy default SU exists and provides a path to the SU log. If you want to log something like that, then you also want to log the failed login attempts to the login log. You have to actually create that file. It is not created by default. On a very large network where you have a whole lot of users that are going to be logged in on a regular basis. This may not be feasible because you don't need to necessarily know every single login. It will just take up too much space and it's going to be something that you're never actually going to go through and look at anyway. But if you're in a small environment where you have only a few users, it's a good idea to actually see when and where and how they log in. To do that, after you touch it, you change the ownership over to root and assist group and you change the permissions to root only. Fail login attempts are going to look like this. Hacksaw did not get in. What that tells us is the time that he attempted to log in and failed and where he tried to log in from. You want to turn on INET D connection tracing and what that will do is attempt to trace all incoming TCP services and that will log in SysLog. To do that, you just edit the init.d INET services file and add a minus T to the INET D start line. So it will look like that. Then you're going to want to kill and reboot the INET daemon because it is not currently running with tracing on. This is assuming, of course, a live system. It's not going to be rebooted before you put it on the network. Just kill it. Restart it with the minus T switch. This is one of those things I was talking about before where if you're in an operational environment, this can be very dangerous. You want to configure the instance system to prevent stack-based buffer overflow attacks. Prevent is probably a little bit strong of a word there. Maybe help prevent is better. To do that, you edit the instance system and set the no-exec user stack to 1 and also the no-exec user stack log to 1. What that will do is any attempts to execute code on the program stack will be logged to SysLog. What I would do if you were in an operational environment is I would set the rev to 1 and not actually set the no-exec user stack. I say that because especially with some legacy third-party software, they are programmed to intentionally run code on the stack. If you have a bootable of 7 is actually one of those. So if you have a local 7 running on your machine, it will kill it and it will not work anymore. But if you log it for a couple of weeks, a month of normal environment time, then see if anything actually showed up in the log. If it did not, you're probably in good shape and you can go ahead and do this. If it did, then you know that you need to probably either upgrade that piece of software or if that's not going to happen, you don't want to do this. Next you need to check your Cron and add jobs for validity. Pretty much just look at them, make sure that what you expected to be there is what is there. Place the user IDs of the users that are allowed to create Cron jobs in the cron.allow file. Place the user IDs of the people that are allowed to create add jobs in the add.allow file. Conversely, you want to make sure that people that are specifically not allowed are in the cron.deni. I say that because the cron.allow is your default. That is what it's going to use. However, if for some reason that is bypassing and fails, the cron.deni will at least users that you know on the system that you absolutely do not want creating cron and add jobs, it will fail over to there and if they're in there, you'll have a secondary measure to make sure they're not allowed to create the job. It's also important to verify that cron jobs are legit before and after adding a user to cron.deni. That's because it only disallows users from creating future jobs. If they already have the job scheduled with cron or add, it will continue to run. You need to ensure that the scripts and programs that are launched by cron and add are readable only by the owner. You don't want anybody in their brother to be able to take a look at these. An example of that is if mail1.pl is scheduled to run in the cron tab, it should look like that. I'm the only person that has access to it. I'm the only person that can modify it. I'm the only person that can look at it. To the if you must users, FTP disabled. Use SFTP instead. If you have to use it, enable logging debugging by adding the ined.conf and adding the minus dl switches. Probably logging entry in ined.conf is going to look like that. Just at the end you have the minus dl. You also want to make sure that at a minimum, we will use FTP ban anonymous in the etsyftp users file. The etsyftp users file is the file that says who cannot use FTP. Who cannot FTP into your system? At a minimum those need to be in there. You want to configure the etsydefault FTP to remove the OS banner. You don't want every login to Solaris. They'll come back and they'll say sonos5.whatever. You want to get rid of that. You don't want to give them any eggs. There's enough programs and tools out there that will tell them what operating system you're running. They'll just freely give them the information and cut half the time out of their work. Also, if they actually haven't used NMAP or whatever, you're going to be getting something along the line to let you know that you've been scanned or whatever. If they are able to just FTP to and it tells them what version you're running, you've cut a lot of their work off. To do that, you just echo banner with null that's open and close quotes into the etsydefault FTPD. When they log in at that point, it will then have no login banner. Tell that banner is essentially the same thing. The etsy issue is the issue of warning banner. First of all, you're going to have to create that file. It is not created by default. Just again, put something in there. Unauthorized access.  I don't care. Just something that tells them I don't want you here if you're not supposed to be here.  I've never logged off. But what it will do is if you have a properly authorized by your deal department etsy issue and a warning banner, when it comes time for prosecution, you can take that to court and say, we told them don't come here. They came anyway and we want them to pay. Configure the file time at date or remove the OS banner. That is the exact same process as the FTP banner. And it will just get rid of the OS version once somebody logs in. The NDDs. Most of you guys are familiar with the NDDs. I like to use them. They allow you to do quite a few things that otherwise you don't really realize are running because nowhere does it say, oh, I have IP source routing enabled. There's no script that you can run through and find that where that is. But you can actually sit here with the NDDs and disable that stuff. First thing I'd like to do is get rid of the IP forwarding and directed broadcast. To do that, you just do an NDD-set, slash dev, slash IP, IP underscore forwarding, set to zero and hit enter. Same thing for forward directed broadcast. If you do a dash get instead of a dash set, it will tell you what it is currently set to. You want to configure the system to ignore redirects and disable the forward source routing. If you want to redirect, you want to set to one forward source routing. You want to set to zero to disable. You also want to configure the system to not respond to address mask broadcast, echo broadcast, time stamp and time stamp broadcast. Set all of those to zero with your NDDs. Also, while I'm thinking about it, there's not just dev IP. You have UDP, you have TCP specific. You can go through and look at them and see what exactly you do need, what exactly you don't need and there's a lot that you can disable. There's a lot of enumeration info that will come back to haunt you later that you can stop right there at the OS level and not have to rely on your board of devices. Here comes what I was talking about before about making it very, very difficult. A lot of people do not like to do this because it becomes very hard for your admins, as well as everyone else to gain access to the box. What I like to do is totally disable root log in from everything. Root can never log in, period. The only way that you can get UID zero is to log in at this point. If we do this, we'll have to know the open group banner to get the machine up. Then they'll have to have a regular user account and password so that they can log in. Next, if they want to ask you to root, they're going to have to have the admins group password so that they can get in and finally they're going to actually have to know the root password so they can ask you. If they can get through all that and only you deserve to be on because you have crappy passwords. To do that, console only access. You have the console setting and the Etsy default log in to dev console. That way, root can't come in any other way. As a sage can't tell and I can't FTP but it can still come in as a console user sitting at the box. Like I said, I like to go a step further and disable it completely and just set it to dev null. TCP sequence prediction. Do any of you guys use ISS?  It shows up every time no matter what version of what software you're running. Everything apparently has a TCP predictable sequence and that's because they said it's like, if they guess it's one out of 500,000 correctly then it's predictable. But you can actually with Solaris 8, you can take care of that problem even for ISS's toughness. To set the TCP strong ISS to two in the Etsy default magnet in it, it is by default set to one. Next you want to edit the Etsy profile and set the U limit to zero to restrict the generation of core files. It doesn't always work but it's worth a try. Here's another one that can be kind of dangerous. Randomizing the file system i-load numbers with FSI ran. It tells you why, but again, very dangerous. You have to unmount the file system before FSI ran to be run. You want to make sure that you have backed them up before you do it and you check the file system on them because the chances of it actually ruining your file system i-nodes are just as good as it's working. That's one that you're going to kind of take with a grain of salt. If it works and you've got a system in place where you can actually do it on a regular basis, it's great. If you actually have a problem where you have an operational system that cannot go down for any length of time, I would actually skip this step. Tripwire and load check. Install and configure those to monitor for file system integrity. Install SLORT. Any other intrusion detection IDS that you have at your disposal. I like SLORT. It's free. It works. It's just what I prefer. If you want to use RISCure or something else, go for it. There aren't freeware IDS products out there that you have access to so you really don't have an excuse for not having some intrusion detection sitting on your servers. At the border, you are going to want to stop at UDP-113 and TCP-113 traffic inbound. Also, you want to block ICMP-17, that's your mask request traffic at the border. And finally, allow access through the firewall and any necessary ports on specific machines. In other words, if you have a web server, a mail server, and a DNS server sitting behind your firewall, what you want to do is allow port 25 traffic only inbound to the mail server, not port 25 traffic across the board. Same thing would go for HTTP, port 80, and port 53. Specifically to that box that way, if you for some reason skip a step, miss a step, or somebody accidentally re-enables a service on one of those machines, you have another layer of protection to keep somebody from making access to your machine on that port. Influencing the stuff that we talked about here today is not going to make you totally secure. We were talking about the other day that you have to find you're actually totally 100% secure and you know it box. It cannot be made.  But what you can do by doing this is taking time to reduce your script kitty thread to essentially nothing. You will also be able to, if you have an attacker that is looking for a target of convenience, you are not convenient. It's like the club. Car thieves can get the club off of your car very quickly. However, when they walk by and they see tubes sitting next to each other, one has the club, one doesn't, they steal the car without.  Finally, also patches. One of the biggest problems I've seen and I mentioned it before is people not applying the patches. If you maintain patch level, you will reduce the bulk of your problems. Just by maintaining patch level and disabling unneeded services, you've probably reduced your risk by about 90%. I have a few references in here. Some of you are online, some are books. So, we're Security by Peter H. Gregory. Some press actually put that out. It was a very good book. The info that came from this can be found in that book. Unfortunately, it is Slayer 7 specific. So, that's why I had to update quite a few of the things from this book. The other thing that I wanted to do was show you the results of the ISS scans. So, that is the initial scan with essentially a default install or dummy install. If you run through this process and do all the steps when you are done, you will have, not that, this. You have four rows remaining trace route. I see if you wet mask. I see if you timestamp all of which should be blocked at your border. And open SSH running, which is more of an informational item to let you know that you have it. There is not a vulnerability actually associated with that assuming that you have your open SSH to the current patch level. I had hoped to actually get this presentation updated for Slayer 9. Unfortunately, I am not the processor system, so I had to buy this software. I didn't get it in in time to update the slides. But I did get it in and get it installed. I ran through the process on Slayer 9 with actually better results because there is no open SSH. It comes bundled with SSH now. However, I have tested everything to actually make sure that I'm not breaking anything. So, before you do this on Slayer 9, you didn't want to do it in a non-operational environment and verify that none of the steps are going to break your system. I have time. That is it. I have time for about three questions because I have to go to the road driving contest right from here. So, yeah, if you want to come up, people that want to ask questions, if you come up and use the mic so everybody can hear. Yeah, just a question about the slides. If people don't have them, they will be posted on a DEFCON site eventually. But if you want them before that, you can go to www.securitytrag.com and I will have a link off of there to the slides so that everybody can get a copy of them. Do you have a question? Hi. We see Venoma used to have software to help protect RPC services, like RPC buying and stuff. I don't know if they still work for Slayer 8 or are there any other... You can also use it in combination with TCP wrappers to help wrap our eyes and protect your RPC services. Is anything recommended for Slayer 8 or 9? Does that matter? Unfortunately, I don't really have a very good answer for you. I don't know. Explain your pros and cons of using SUDU instead of SU. Actually, SUDU I have absolutely no problem with. It essentially is doing the same thing that I'm doing with the lockdown with the groups. And thank you very much because I meant to mention that. If you want to make it a little bit easier on your admins, that is a definite way to do it. And I don't see any problem with doing it that way. If there are no other questions, I would just like to say thank you. And actually, I have a couple of questions for you guys. And those of you who have left have missed out. I've got two boxes. I'm going to ask a couple of questions from you and... What are you guys going to ask them? Are you guys going to ask questions? Are you going to give them away? Excellent. I'm getting out of your way.


Mae'r ein oes yn chi gwybod attitude ac mae'r 겁au a tîm опeth heddiw. A oes yn beverage os Cymru, os ond arall go iawnfog o. Mae pob ei gweld yn chi gweinydd o'ch mal. That's the way the team is doing it, that's why they're doing it and they're trying to do it. But what they needed to show was a good attitude and a good energy and enthusiasm to it. I think pressing at the moment is a big part of football. Many teams are trying to do it and they're having to do it because the proof is showing that you know if you win the ball back earlier up the field it's leading to more goals as it did do in the Champions League this year.


Hey Golden Bears, you're watching CalTV Sports. I'm Brandon Lee here at Clark Kirk Sandcourt's with Taya Neff, one of the co-captains of the California Beach volleyball team. Congratulations, Taya. Welcome and thanks for joining us today. You just defeated the Washington Huskies with a final score of 4-1. How do you feel? I feel amazing. Yeah, I just feel so happy and proud of the team. We came out this season with a run of wins and we're undefeated and then we had a little lull here with losing our past three games but I'm just so proud of how everyone came out today and really turned it up and executed so yeah I'm just feeling good. Gotcha. So I know that Beach volleyball really relies on good communication, chemistry, and teamwork. What do you and star freshman Bridget Gustafson work on off the courts to you know keep and increase that good relationship? Yeah so I am just really lucky to call my partner also one of my best friends. Bridget and I you know I'm a junior she's a freshman but we've just become so close over the past few months and we actually do a lot of things together off the court. We like to do a night before game meal together. We've been going to Eureka which is down by Shaddick. Shout out to Eureka. You guys should go and then we also have done a lot of I live in Marin which is nearby about 45 minutes away so we go out there with some other friends sometimes and like to go on hikes together. We've had sleepovers at my house and yeah we just really get along well so that's been really fun. Sounds like an adventure every time you two hang out. Yes it is indeed indeed it is. So tell us about your blog called Teya's Tidbits. It's a team blog available at cowbears.com. What do you usually write about in your blog entries if for the fans that don't know about your blog why they should read it? Yeah so Teya's Tidbits is kind of a weird inside look into the team and our happenings off the court. So I like to write about kind of the little idiosyncrasies that happen like when we flew down to LA kind of the places we went to eat, the movies we watch, the activities we did and I try to kind of convey the vibe of the trip for parents and family and friends. So yeah it's pretty fun sometimes I'll do little kind of interviews with different players or kind of more specific things about people so yeah you should check it out if you haven't already and the next one will be coming out on Tuesday so yeah it's a weekly thing and yeah. Sounds good be sure to catch that at cowbears.com and finally Teya I had the honor of working with you in some of the PAX classes with Dr. Karen Bangu. Shout out. Yes she is. I accidentally wore some Washington colors. I know I've never seen that. So what do you say since we usually work on the same team in PAX today we're gonna switch it up and I'll be challenging you to a one-on-one how does that sound? I am very much down let's do it. All right wish me luck. Thank you so much for joining us today Teya we wish you and the team the best of luck in the PAX 12 championships happening in Arizona in a few weeks. Yes a couple weeks we're very excited. Once again thank you for joining into CowTV Sports. I'm Brandon Lee. I'm TNF. Go Bears!


Okay, so we're looking here We can see our trachea the trachea branches you have to go into the left and right lung Right here were branches the site of Karina Then it's pretty simple you have the primary bronchius Where branches again are the secondary bronchius and finally they branch again into all these trashy area bronchius


Hi everyone, Joe for jasmiescasefrakes.com. We just created a really quick number block random number block randomizer thingy We didn't do a description for but you know what it is because people all the people that got into it We're watching life. So there you go Chargers Dolphins number block for two bucks a mac that football pick your team number four big Thanks to these folks for getting into it. There are the numbers right there. Let's roll it Let's randomize it two and a five seven times for each list one two three four Six and seventh and final time after seven we've got Paul down to Robert two and a five seven times for the numbers one two three and seventh and final time Nine down to one Remember zero gets any and all redemptions for those two teams right there including one of one redemptions one will still get live One of ones just keep that in mind That's in the frequently asked questions in the it would have been in the description But it's usually the frequently asked questions section for the details Paul with nine mark with two Paul with six Randy with three mark with four Joshua with eight Paul with zero Paul with five and seven Robert Grease with one Let's order these numerically right there and coming up in a separate video will be the break itself jasmiescasefrakes.com See you for that


Welcome back, so we will start with the clarification session, so to begin with what I will do is I will talk about the upcoming lab in the afternoon, the second lab, after that I will take some questions from you related to the lab and after that we will do some questions that were uploaded on the Google survey which all remote centers have uploaded a bunch of questions, I will pick up a few questions and answer them. So going with the lab, so today's afternoon lab is on demultiplexing again which you have probably already seen as part of lab 1 and we will also explore the protocol ARP, automatic resolution protocol. So the first exercise is kind of similar to the previous exercises except that we will explore SSH protocol, so for this SSH has to work, so it is kind of a stride forward thing, you basically need to establish two SSH sections from the same host, in other words so this is, so what you are going to do is, so this is your machine and you have to identify another machine which will be within your subnet, so you find out what are the other machines within the lab where you are doing, determine their IP address and also the username password, so this will be the login details corresponding to this other machine, so let me call it host2, host2 has a login, you need to know what this login information is as well as the IP address or the name of this particular machine and what you are going to do is, you are going to establish two SSH sessions, so basically in host1 you will open two terminals, terminal1 and terminal2 and what you are going to do is, within this terminal you are going to run SSH to this other host and in terminal2 also you will do SSH this other host, ok. By the way as I have mentioned earlier, before you do any of these things, you have to run TCP dump with the right filters, so that is your first step, this is the second step, the second step is to run this SSH in these two terminals, terminal1 and terminal2, so if you notice the IP address of host1, host2, so there are two sessions that have similar source as well as destination IP addresses, so this exercise is about figuring out how does host2 as well as host1 distinguish between these two different SSH sessions, even though they have the same source as well as destination IP address, so that is with respect to the first exercise. So, the next exercise is on the ARP protocol, so the role of ARP is to determine the MAC address given an IP address, so if you have seen the slides you would have this is something which is obvious, so before I get into the details of ARP there is something which I would like to clarify, so there are, so as far as routing is concerned before we get into the ARP I will give you some details, suppose this is again your machine, let me call it host1 and you are trying to reach URL, let us say you are trying to reach www.google.com, let us say you also used DNS and obtain the IP address of Google which I am representing as IPG, now what you are going to do as a consequence of this is you are going to assemble a HTTP packet which will have this get request saying I want this particular URL and then you are going to open a TCP connection, it will have some TCP header, let us assume the TCP handshake is done and then you will have the IP header where you are going to specify the source IP as your IP host, this host1 and the destination IP as the IP address of the Google, so this is what you are going to specify, so there is some portion that is here which I am reproducing here, so here is the IP that we are seeing there, so this and this is the same, then you have to put a link layer header, even here there is a source MAC, so even here there is, so let me put it here, there is a source MAC which will be the host1's MAC, let me call it MACH1 and there will be a destination MAC, now what should this destination MAC be, so this is a function of what the router does, so what the router does is it is going to look at the destination IP address which is here and it will determine if this destination IP address is within these same subnet or a different subnet, now how does this know this information, so when you configure the router we will deal with this later, you would have mentioned that your subnet is let us say 102.29.star.star, so this is your subnet, so this host may have an IP address which is <IP_ADDRESS>, so this may be the host's IP address that belongs to this particular subnet, now Google's IP address will definitely not belong to this IP address, for example I am just writing some random number here, <IP_ADDRESS> let us say is Google's IP address, you will notice that this is not in the same subnet, once you determine that it is not in the same subnet, what you do is you know that this packet has to go through your next hop router, so this destination MAC should correspond to your next hop router, but often what you know is the IP address of your next hop router, this information you would have obtained when you did DHCP, so when you are doing DHCP apart from giving you what your own IP address is, it will also give you information on who this next hop router is, what is the IP address of it, so once you have this next hop IP address information that is when the ARP protocol comes into play, you invoke the ARP to ask what is the MAC address corresponding to this IP address of the next hop router, let me represent it as an ARP, so once ARP protocol gives you that particular MAC address, here you are going to fill it with the MAC address of the next hop router, so this is where the host, the destination IP address did not belong to the same subnet, thereby you are using the MAC address of the next hop router, by the way typically this information you do not always invoke ARP, because this information is cached, but in case it is not in the cache, you will use ARP to get the MAC address corresponding to your next hop router, now this is for a case where your destination IP address was outside your subnet, let us look at the case where the destination IP address is within the same subnet, so we are talking about a case where the destination IP is within the subnet, so for example you are this host 1 whose IP address is <IP_ADDRESS>, let us say there is another host within your subnet called host 2 whose IP address is <IP_ADDRESS> and in the terminal that you have let us say you did ping 10.1, <IP_ADDRESS>, so this is what you did, now as a consequence of this ping message, ping message basically is works on ICMP, so you will have an ICMP packet and then you will have an IP header where the source IP address will be IP corresponding to host 1, destination IP address will be IP corresponding to host 2. Then you add a link layer packet, this is the link layer packet where again the source will be MAC corresponding to H1 which you will know, the destination has to be MAC corresponding to H2 but you do not know this information, so again what you do, the router at the network level will again look at this destination IP address which is <IP_ADDRESS> and it will determine that this is within the same subnet as 102.29.star.star, thereby this end host since it is within the same subnet, it is going to invoke the ARC protocol where it is going to ask what is the MAC address corresponding to IP <IP_ADDRESS>. In return to this once you invoke this ARC protocol it is going to return the MAC address corresponding to H2. Once you obtain that MAC address you will put it in here and send it out on the local area network and because it is destined it will reach the host 2 correctly. So, this is the forwarding mechanism behavior. So, as you can see the role of ARC is basically to determine the MAC address provided you give a IP address. So, the exercise 2 is basically for you to more or less whatever I have said is what you are going to work out on. So, a few things to note here is that you will be doing three things, one is you will send a packet to a host within the subnet. So, these IP addresses your workshop coordinator has to specify what are the IP addresses that fall within a subnet that are at that are working as well as you do not necessarily need a login information because just ping will suffice. You have to ping these machines. So, check that he is giving you IP addresses which are reachable. You also need IP addresses of host that are outside the subnet again your coordinator has to provide this information. Apart from this your coordinator should also provide IP addresses of host within the same subnet that are non-existent. In other words if you were to ping any of these machines you will not get a reply based on ping. In this first case within subnet you would get a reply that are reachable and in this non-existent host within the same subnet you will not get a ping reply because they are unreachable. So, you have to figure out what ARP does in each of these cases. So, the behavior you see should correspond to what I have explained. In other words that is the behavior the returning MAC address should conform to the behavior that I have explained. So, that is with respect to exercise 2. Now, coming to exercise 3, exercise 3 is on Gratius ARP. Now, you would be wondering what is this Gratius ARP. So, we are dealing with, so let me write we are dealing with. So, what we are so Gratius ARP is like any other ARP except that this ARP can be a reply or a request. Let us look at request first. When a Gratius ARP is generated as a request you are not expecting a reply. Earlier when you generated a ARP you were expecting a reply. You asked what is the MAC address corresponding to the specific IP address. You want to know what that MAC address is, but when you are doing a Gratius ARP this is what we call self-broadcast. You yourself are telling that this is my MAC and this is my IP. So, you are basically giving the relation between your IP address and your MAC address you are telling everyone. So, when you send this Gratius ARP as a request you are not expecting a reply because you know I mean this is the information you are conveying every to everyone. You are not really this IP address corresponds to your own IP address. So, there is not and you know your MAC address. So, there is not anything you expect from others. Similarly, Gratius ARP is sent as a reply no one asked for this information you are just giving yourself. So, you are not this did not proceed there was no request no preceding request you are just sending a reply. Now, what is the use of such Gratius ARP? So, there are multiple reasons why you may want to generate Gratius ARP. One is to detect duplicate IP addresses. So, for example, let us say you want to use an IP address.  Let me call it GARP for Gratius ARP. Now, as a result of this you are going to send out a mapping that says this IP address that I have assigned to myself corresponds to my MAC. Now, if it so happens that this IP address was also assigned to some other host this IP H1 which you have chosen is also assigned to some other host with MAC address H2. Now, this host will complain it will send a reply saying no this is my IP address in which case you will detect that and thereby you. So, in other words when you do this you are going to get a reply that will say this corresponds to this then you will detect a duplicate IP address and thereby you have to change your IP address. So, this is one use of Gratius ARP not only that there are other uses of Gratius ARP which have to do with caching ARP entries. So, whenever you have sent an ARP. So, you have changed your IP address, but your other machines within your network may remember your previous. So, for example, this is your host one which had MAC address H1 and you have now either changed your IP address. So, earlier you were using IP H1 now let us say you are using IP H11. So, you have changed your IP address. So, this is what you are using earlier now you have changed to IP H11. Now, you want everyone to know that this IP H11 now corresponds to MAC H1. So, when you send this Gratius ARP they are going to make a note of this. So, it is like a broadcast that is telling everyone that see I have changed my IP address. So, start using this. Similarly, if you were to retain the same IP address, but if you were to change your network card even then you can advertise to everyone that this is my new information. So, this way you are telling everyone what your new information is. This is also useful in switches I do not know whether you I mean this was covered as part of the course. There are these switches that are learning switches where they remember that if a packet came from on port 0 with some MAC address corresponding to H1 they know that any packet that is destined to this MAC H1 should be sent out in this direction that is what switches remember.  So, that the switches can also avoid broadcast of the packet to everyone and thereby use this Gratius ARP information to send it on the right port. So, these are some of the uses of Gratius ARP. So, what you are going to do in this exercise is use this tool called ARPing which generates Gratius ARPs. In order to manipulate ARP itself you need root permissions. So, since you do not have root permissions ARPing is a thing that will help you generate Gratius ARPs. Even though I have talked about a little bit of spoofing as part of this exercise you actually are not doing any spoofing because in order to do spoofing first of all it is not correct. Secondly, you need root permissions and so on which you do not have. So, what you are going to do is you are just going to generate a Gratius ARP for your own IP address. In other words you will say this IP address of my machine corresponds to this MAC address of my own machine. In other words you are not claiming somebody else's IP address. You are still advertising your own IP address and relate it to your own MAC. So, this one you will see how Gratius in this exercise you are going to see how Gratius ARPs work in reality by using this particular ARPing tool. Yeah, I think that is with respect to the lab exercises. So, what we will do next is I will take some questions related to the lab. So, let me emphasize again I want to handle questions only related to the lab right now. So, we will do this for the next 20 minutes or something and then we will take questions related to concepts. Yeah, 1319. How to access desktop of a password protected terminal password was site through Vino preferences in the yesterday's lab using SSH. I mean this is something your coordinator has to tell I have no idea what the setup there is. Okay ma'am second question is also there how to trace a website using its IP address in TCP dump. How to trace a website using IP address yeah. So, you have so TCP dump has this filters. So, you can so for example, you want to know what is the traffic that is coming from that particular web server or going to that particular web server. You can use the host and specify the IP address corresponding to that particular web server you can even specify the host name TCP dump will in turn do a resolution and get it. Does that answer your question? Basically, you need to use the host filter and specify the IP address of the server. If you want to capture all traffic that is going to the server as well as coming from the server. Okay ma'am. Hello ma'am. Yesterday when I was doing the lab and the exercise for and the question select the first TCP packet listed. So, in that question you said that to present the corresponding process a protocol the packet is passed on. My doubt is that when a packet arrives at the operating system systems. So, how the operating system is handling that process? Do you want us to mention that how the process is related to that or the other question is that if a packet arrives is that single process that is handling that packet or does the operating system create separate processes to handle that packet like each layer for each layer the operating system is generating a single process or is the operating system creating separate threads to actually encapsulate or decapsulate this packet. Okay. So, the use of the word process is typically at the application layer. We do not use processes for representing the kernel level stuff. So, whenever we say process, it is an application process that is listening on some particular port. So, the way the protocol stack is implemented is at the kernel level. So, there are these. So, whenever so there is some code at the kernel, whenever you get a packet it is going up the protocol stack. So, there is the code for example, as soon as the physical layer gets a packet it is there is an associated driver associated with that particular card and the driver is a piece of software that is sitting in your machine and the packet that you receive at the physical layer is passed on to that particular driver program and what the driver does is it is going to examine it will process that particular packet at the link layer and apart from that it is going to examine the details at the link layer in that you will see that demultiplexing key. It will specify that after this you have to pass on this packet to the IP layer. Thereby there will be some other module within the kernel that is dealing with IP. So, it is going to pass that packet to the IP. Now IP again is a module that is going to look at the IP header, it will do some processing and within it it will have the protocol field. Based on the protocol field it will decide should I pass it to UDP, TCP or whatever other transport protocols are there and again it is going to pass it to a kernel module that is handling TCP or UDP and that will in turn again look at the TCP headers. It will look at a port number and in turn it will pass it to the process that is listening on that particular port. So, that is how a packet goes up the protocol stack. So, when you say process when you are dealing with the application layer the users just listen on the ports, but internally within the kernel there are lot of different pieces of code that runs at the kernel level that is going to handle this packet as it goes up. One more question related to the web like PC-1 like for example PC-1 and PC-2 are in the same subnet. So, I am running a TCP dump in the PC-1 which will capture the frames that is sent by PC-1 or received by PC-1. So, can I use any other options of PC-P dump or Vaishak or any other tool to capture the frame from PC-1 that I will be able to capture the frames that is being sent by PC-2 or received by PC-2. PC-1 and PC-2 are in the same subnet. They are able to communicate successfully. So, can I use tool from PC-1 to capture the frames that is being sent by PC-2 or that is going to be received by PC-2? Okay. So, actually the voice was not very clear, but let me answer it. I think this is probably what you are asking. So, you are asking whether you can capture packets that are somehow your host has received the packets. Either they were destined to it or originated from it or they were broadcast thereby your host still received them. If you generally want to capture packets that belong to other conversations within your LAN. In other words, some other host H2 is communicating with some other host H3 and you as host 1 still want to capture some of these packets. For this you need to put the card. So, this needs special privileges. Not all cards may support it. You need to put the card in what is called promiscuous mode whereby it will capture all the packets and pass them up. Not all drivers may support it. Not all cards may support it. It is a function of the specific hardware drivers so on so forth. But there is a facility where you can put with root permissions a card in promiscuous mode whereby it will capture whatever traffic whether it is destined for it or not that is going on in the subnet. I would not say within the local area network. But I will put a clause there with the recent use of switches. Switches especially when they work very effectively where they learn they are not going to broadcast the packets everywhere. They know very clearly in which port to send this packet on. With the use of switches it is not so easy to trace what is happening in the land in some other portion because the switches will not forward those packets towards you. Thank you ma'am. My question is related to the via shark. So, I just want to know what is the scope of the via shark. So, yesterday you told it is being used for capturing and analyzing the network traffic data. So, whether I can modify the data and write it back to the network traffic. And second part of the question is what are the SNIFR programs how they work and can you design an experiment for illustrating TCPIP spoofing in the lab? Okay. So, regarding the first question I had already mentioned this via shark is a very passive tool you it all it does is copy packets both in the upward direction and the downward direction and store them and for you to do you cannot really take packets from it and re-inject it for that you have to write your own program dealing with keep peak cap and so on. So, you have to write a kernel module that is going to take the packets and do whatever it is if you want with it. TCP dump via shark are passive tools all they do is copy the packets and write that information into a file for you to look at. So, you cannot do anything other than that anything else you want to do you have to do kernel programming to do what you want with the packets. Regarding your second question on whether you could demonstrate spoofing as part of a exercise. So, for this I mean you so first of all so this is a security thing you need again it depends upon lot of stuff unless you have full control over your land domain web server whatever it is you could definitely design an experiment to demonstrate it but for example I would not do it at IIT Bombay because there are enough spoof detection software that run and the administrators network administrators will definitely not be happy with me demonstrating things like this to the students because they will do all kinds of mischief and there is also software that runs that catches such kind of behavior and stop it before it happens. So, I will talk a little bit about ARP spoofing sometime later. So, but typically we do not design experiments based on this more as a safety thing rather than but if you are interested in showing you can definitely set up such an experiment but lot of things should be in your control you should have control over the switch control over the web server you cannot generally do it in your come your university's network because the system administrators will not like it. I have a very basic question regarding what is the difference between static IP address and dynamic IP address. Ok. So, static IP address is what again it is a function of the context. So, in the in a generic context what static IP address means you have been assigned this IP address for your use for however long you want and typically the configuration of it is done manually. So, if you are using windows you go to the settings and you can set the IP address within some place there. The dynamic IP address on the other hand will be handled by a DHCP server. So, you can whenever you want an IP address you contact the server often the server allocates the same IP address as it has done before but there is no guarantee you can get another IP address. So, in other words your IP address may change over time though most DHCP servers try to assign you the same IP address. How we get know about the dynamic IP address of a machine? So, if you were so for example this also involves configuration. So, if you are in a windows machine instead of manually setting you will select the protocol called DHCP then it will dynamically assign. If you want to know what is the IP address that got dynamically assigned you can open a terminal and using the CMD command in windows and type IP config it will tell you what is the IP address that has was assigned to you. There is a demo of this as part of DHCP in the course content that I have uploaded. Thank you. Hello, good afternoon ma'am. I just wanted to ask you in windows if you want to send a message to any other computer near you those computers those were connected in LAN. So, we use the messenger service and we use the command net send and what is the command used for sending instant messages on the nearby PC connected in LAN in Ubuntu? So, there isn't any such Ubuntu it doesn't have any such service that it provides as far as I know I could be mistaken though. Yeah, fine. Thank you. Hello. Yes, go ahead. In why is that there is a property tcp.ln and data.ln data.ln what is the difference between them? tcp.ln and data.ln Okay, so tcp.ln I mean I have to actually look at it specifically but tcp.ln probably refers to the tcp payload and the data length may refer to the entire packet unless I actually pull it up I cannot answer offhand. If you look at the sizes you should be able to make out as in when you click on like I mentioned if you click on tcp header it will point out what are all the fields corresponding to it based on the size you should be able to figure this out. I don't I mean unless I look at the option I cannot answer now. Why is that it is also available in Windows? Yes, you can just download it on Windows. Yes. Yeah, this is Soham Singapta a very good afternoon to Dr. Kameswari. So, I was to ask you certain questions but prior to that I would like to tell the participant who was asking the question just before me that this data.ln.tcp.ln that is not directly a part of Weishik rather than that that's a part of WinPC cap that that's a packet capture framework developed by so it's open source and you can explore on it so data.ln I think it's the payload length that the tcp carries maybe what the transport layer carries and tcp.length is something which takes part of the tcp header plus the payload. So now my question comes so I was I have worked a lot on this EIP spoofing so when I work for let's say inside the intranet I have made some my workshop to work on a promise mode so it can capture all these things so given that some of my students I made them sit with a terminal and make some intranet working activity like checking their mail and I captured the MAC address of particular machine on which my student was sitting and I was able to replicate the problem of EIP spoofing with some trick so in a sequel to this experiment I found that it's very easy to spoof the MAC address of a machine or at the hardware of the machine so from my point of view so if there is a public LAN where a person can spoof the MAC address of another machine by some mode and data of someone else so this is very dangerous so I have discovered a new way to prevent such attacks by augmenting the network layer by creating a new EIP engine which works in accordance with art of cryptology as well as it does not interfere with the existing EIP engine so there is no complete in their traditional internet working but still it works for the people who wish to use them so do you think this can be a new topic if I want to go for a CQARP? Ok first of all I am not a security expert so I don't really know and I also need to know lot more detail as to what exactly you have done but at a very high level if you say that it means changes to any of the switches or individual host they have to install something which doesn't automatically come then it's unless it comes it becomes very popular and Ubuntu is ready to install it as part of its unless it takes on that kind of a role it's difficult to say whether something will catch on or not so I mean I don't have a ready answer for you I need to look at what your method is and whether it is good or bad is a function of I need lot more detail than that and I don't want to get into security in here because that is outside the scope of this workshop So in brief I wanted to elaborate as ways as your identity because it's an operating system in which the network layer and the transport layer resides so if I augment the network layer or the transport layer of course without loss of backward interoperability I don't think it's going to be good for us to get anything which needs a kernel patch no one likes to install I will not install a kernel patch that is coming from some person unless Ubuntu itself tests it thoroughly and installs it within the it's a personal networking for people who want to make their own communication secure that is fine as I said it is there are plenty of ARP spoofing tools that are available integrated as part of switches so unless you demonstrate that yours is something it does better than those tools there is no incentive to try yours and as I said I mean it's a moot because I don't even know what is it that yours does so I need to need a lot more detail for that so in the interest of time I think let's put an end to that I have one more question so as per the landing switches GARP is concerned and GARP is concerned so will it not be very wise to use switches means I am talking about layer 3 switches I am talking about layer 3 switches because they don't have access to the IP addresses so most of the switches we see nowadays they belong to the layer 3 group family so is it very necessary to use GARP for them because they already work as a router they are working at layer 2 but ARP is a layer 2 protocol so most of these switches do make note of see when you generate an ARP you are basically going to it's not that they are looking at the so when I said that it is beneficial for switches this is what I meant it's not that the switches is looking at the IP header it is still looking at the MAC address so for example you are located at some other on some other port and you have moved your machine to some other port right now the fact that you have sent an ARP which will have gracious ARP which is basically going to have information on that your MAC address has changed and thereby the switch can now know on which port that particular MAC address belongs to it need not have been gracious ARP any link layer message you send it would have figured it out based on that but gracious ARP apart from this has other advantages where other machines can clear their cash based on what they are seeing ok one last question yeah 1 3 4 1 good afternoon madam regarding yesterday lab SSH command is not working properly ok what is not working so when I am typed SSH command checker share so when I am typing SSH followed by the IP address it shows that the root sorry there is no root to host some other time the port number refuses to connect the cutler system so typically SSH so again I mean your workshop coordinator should have handled it but to our extent typically SSH there should be an SSH server running on that particular machine listening on that particular port only then will it accept SSH connections so you could test whether SSH open SSHD is installed on all the machines and whether it is listening on the specific port the port 22 on that particular machine you can use net stat if you know how to use that command you can use net stat to see what are all the ports that are active if the port 22 is not listed on that machine that means the server is not running you need to ensure that the server is running for you to be able to do SSH ok in the interest of time I mean we will stop the lab discussions now again as mentioned we have some TAs available to help you with any questions you have about the lab so you can use the chat email on two email addresses bothytree.itb at gmail.com as well as t10kt.itb at gmail.com apart from this we also provided you the helpline information all this information is there on the slides that were shared as part of the Google Drive so under Google Drive look at the overview slides you will know how to contact us so if you have any concerns questions related to the lab write email chat or call us on those helplines so what we will do now is we will answer some concept based questions that were asked by the different remote centers so I will tell what was the question that was asked and I will also provide answer to that particular question so the first question this was asked by remote center 1073 the question was how to calculate the efficiency of a protocol does it depend on transmission rate so for this actually the answer is a function of what the protocol is and what exactly are you trying to measure about the protocol so for example if you have designed a media access control protocol so if you are dealing with MAC protocols which is the media access control protocols their goal is to ensure that the system throughput is pretty high in other words for example you are providing them with a 10 Mbps link and there are 100 users that are going to use this link the quality of the MAC protocol or the efficiency of the MAC protocol can be along different metrics one is you could see how much of this 10 Mbps is being used this is called system throughput in other words if out of 10 Mbps counting all the packets that got transmitted independent of who they belong to you see that I am able to get 9 Mbps that is pretty good utilization of the link so but this is system throughput now you could maintain very high system throughput by giving all the bandwidth to just one single user and starve all the other users but that is not a good thing your system throughput may be very high but the fairness across the users is not going to be good so another metric which is often used in here is fairness where you will measure what are the throughputs that individual users are getting so if there are let us make it 10 for ease if there are 10 users you want each user to be getting one Mbps provided he has the same so when you are designing MAC protocols you will evaluate them based on this but on the other hand if you are do dealing with routing protocols by the way within this the transmission speed has a role to play but when you are designing routing protocol what you may want to design is protocols that have less overhead in other words in order for you to determine the paths for each of the destination how many messages were exchanged as part of the routing protocol for example in order to determine routes to all the nodes if one protocol is taking 1000 packets whereas other protocol is taking only 100 packets the second protocol is better not only that you may also want to quantify what the protocol convergence time is in other words to determine the routes is it taking 10 seconds or is it taking 1 second again based on that you will evaluate the protocol so in summary the effectiveness of a protocol is dictated by what the protocol is and accordingly you define matrix to measure the performance of the protocol so 1073 center does that answer your question whoever your question or you have anything specific regarding white shark so this question came from your center so I just passing back control to you to ensure that does it answer your question or if you have any follow up question based on this I don't want to take other questions I understood your concept these questions anything else as I said write to us by email or chat and we will answer so another question again dealing with the protocol stack is we always follow the TCP IP model in computer networks so what is the use of OSI model so again this has some precedence so OS so when people started working on the internet in the academia they were working on this TCP IP protocol stack and then there was a major standardization effort which thought that all these layers which are the 7 layers are necessary and they came up with this OSI protocol stack but academia was focusing on the TCP IP and they came up with only 5 layers and they had already implemented them on many machines which people were using so later when OSI standardized it and wanted people to use it it was very difficult for them to push their model because the current implementations had this 5 stacks already so OSI never caught on not only that it was also felt that lot of the functionality which is the presentation and session layer of OSI could be subsumed within the application layer itself so there wasn't any real need for those 2 separate layers so this has led to OSI not being used and TCP IP being used so that is the answer this question has come from center 1325 hello yes I can hear you speak I would like to ask you one question if we do not have a direct indication of the connection establish if we compare with the client and server program then we have the direct indication in the client program that there is indication of the connection but we do not have the connection establishment in the SSS terminal or the SSS session so if you are able to SSH there is traffic running out so when you run TCP dump you will notice that as because as soon as you type SSH some IP address you will see that a TCP connection will be established to that particular IP address and you will have the TCP handshake followed by the SSH data and it will ask you for a password so that means the connection is being established if you are not able to there is no SSH server running on the other end the very first TCP packet that you send after that you will not get any more you will get that ICMP error message or some SS some error message which gets displayed to you ma'am there is one another question from last exercise we have done in yesterday suppose we run the TCP dump and give a ping command to google.com and we capture some packets and with the help of that packets how we came to know what is the MAC address of google.com or relevant IP of this google you cannot know you cannot determine the MAC address of google because it is not within your same subnet whatever messages you are sending are going to your router so router is hiding everything else from you so you cannot know the connection address we came to know that what is the next MAC address of next hop node and that is the router but we are not able to find the MAC address of google.com okay thank you okay so going back to the questions so another question that was asked is why should layers work under isolation in TCP IP protocol stack it is not very clear to me what is this isolation so if it means that there are different layers which have very specific tasks and you are providing an interface between them so the reasons for this were discussed as part of the course itself there are multiple advantages of using this kind of layering and we talked about modular the complex task into some simple tasks and then there is reuse in other words the same module could be used by multiple higher layers for example if you create a TCP module the same TCP can be used by web it can be used by email it can be used by FTP so on so forth so this leads to reuse of a specific module and not only that it also leads to this abstraction concept where tomorrow you change some routing protocol you do not have to change TCP similarly you change your physical layer you do not have to change your link layer so this kind of reuse is extremely important when you are dealing with such a complex network so that is the reason why there are isolated this question had come from 1161 so any follow up for this specific question I clear with the idea I clear with the concept with the answer the thing is suppose if the protocols if they are developed under object oriented and where we can have this modularity abstraction and all and suppose if the protocols were implemented with the C programming but how we can expect that the modularity abstraction and reusability can be seen in the protocol so the idea that you are going to implement as I said as long as you specify that the interfaces are well defined what is internally implemented is a black box you do not have to care how exactly they are implemented according to my terms the isolation here is each and every layer is working unaware of the other layer and that is my intention in keeping it as an isolation yeah that is what that is a good thing because of these three advantages that I have mentioned but there are a few disadvantages with respect to this also and these disadvantages are more apparent when you deal with wireless networks where there is lot of emphasis on cross layer optimization in other words sometimes it makes sense for you to know what is happening at the lower layers so for example the network layer may want to know what the error rate is at the physical layer so that it can choose paths differently so this is called cross layer optimization currently it is not supported by this TCP IP protocol stack but going forward there are some so it is not very strict layering some information does get passed up and down but kind of orthogonal to this so the layering is good for many reasons but there are certain reasons where layering is not that good also ok so this question is from remote center 1321 so what was asked is can you suggest some of the interesting pedagogy to explain the physical layer concept actually wait let me ask another question before that so this question is from remote center 1136 which was PR computer science engineering background is it necessary to read physical layer protocols so this is from 1136 so normally when I teach computer networks the amount of time I spend on the physical layer is very little so as you can see even from the concepts that were provided only 3 concepts were provided about the physical layer rest all were at the higher layers that said I think it is important to understand what happens at the physical layer that way you get a complete knowledge of what is happening in computer networks you may not have to well win deep into the physical layer but at least what does it do what are some of the common things it employs is something I think it is useful to know so I mean whatever I have covered I think is the bare minimum which will help you put the entire perspective of computer networks in place including the physical layer so 1136 so does that answer or is there anything else you would like to ask ok I will take it to mean that it answers so now let us get back to the earlier question which was 1321 remote center can you suggest some of the interesting pedagogy to explain physical layer concept by which I mean animation clips are simulator so physical layer as I said we do not cover in too much detail but Bhaskar was also mentioning this so at IIT Bombay we use this experiment where we use this torch lights to enable communication so this kind of deals with the physical layer as well as the link layer concepts where the students are basically given so there are two groups each group is given a torch light and I give them a sequence of bits let us say 8 bits or depending upon 30 bits whatever it is and ask them to convey this bits building a framework using torch lights and at the other end I check whether whatever bits the other end receives matches the bits that they had sent so this tests many concepts including how do they encode so what does one mean does it mean light on for certain duration off for certain duration or do they have something even clever it also tests the framing concept which is more or less link layer but I think it is important how do you distinguish so I may give random bits sometimes I may give 8 bits sometimes I give 30 bits so you have to divide up the bits and accordingly send so how do you know when is the start when is the end of a particular frame what if you did do something but the other end interpreted one as a 0 and 0 as a 1 in which case what kind of error recovery would you do so all these aspects are covered as part of this particular design and they also tend to appreciate how communication actually works where by they design all the necessary framework to enable this communication so that is an example of a pedagogical thing that we employ other than that unless you get into lot of detail so there is a lot of modulation there is simulators for it animations for it but I do not get into that level of detail for an undergrad computer science electrical maybe you can get into but for computer science we do not get into that level of detail can you transfer it to 1 3 2 1 any questions from the center actually we have a doubt in simulator oriented teaching which simulator you prefer to teach network delay and network delay oriented configuration which by which simulator we can concept behind network delay I mean NS2 will you can show some of these things via network simulator too which in fact there is an exercise on NS2 which does capture some of these things so wait till the exercise there is any simulator is available like Cisco packet tracer it is a more graphical user interface simulator in open source so when you I do not understand what you mean simulator or emulator or actual implementation the TCP dump type of thing it is not clear to me what you are asking packet tracer is something like TCP dump kind of a thing or it could be a tool that is trace root is a tool that will tell you what are is the path being taken by a packet so it is not clear to me what exactly you want actually we have worked with the Cisco packet tracer is more user friendly for us we can able to develop or set a network with packet tracer we are familiar with that but Cisco packet tracer is not open source is there any open source simulator or emulator whatever it may be is there anyone is there any tool available for doing that kind of job so you tell me what your intended goal is I do not know what Cisco packet tracer does because I have never used it so you tell that this is what I want to achieve and then I can tell whether there is any open source tool for it actually in packet tracer we can set a network we can develop a unique network and we can do subnetting we can assign IP address for different systems we can do routing also graphically so this is all you create the topology and you so this is all being done on the same machine there is no implementation component to it right actually we have I mean macOS command also by that we can set a network in packet tracer that is what that network is residing on a single machine it is just a simulated network is that right okay like that is it possible to do with any open source one yeah NS3 also NS2 is there NS3 is a recent one NS3 is open source you can create topologies I think NS3 is supports some graphical user interface also but it may not be as sophisticated as your Cisco thing but NS3 is something you can check out platform you prefer for NS3 platform you mean windows or linux or what NS3 I think works on both so you can use it on either in windows also possible to install NS3 okay this question is from center 1309 so what was asked is during communication between two systems presented two different locations how does one measure the drifting of clocks for synchronization purpose so the answer for this is you do not necessarily have to measure drifting of clocks because measuring drift is not an easy task often done is you re-synchronize the clocks periodically so basically you send a synchronizing bit pattern which could be alternating ones and zeros periodically so that based on that you are re-synchronizing the receiver with the sender that way your drift again gets back to 0 and from that point on you will again start using again after sometime you re-synchronize yourself with the sender by sending the synchronization bits which typically are a sequence of ones and zeros so if you see many of the link layer headers the first few bits are the synchronization bits okay this is the last question for today so this question is from 1224 where asked was does interframe space matter the size of the frame is there any relation between the interframe size interframe space and frame size then what is it or how so that was the question that was asked so this interframe spacing is a concept that is part of many link level technologies so let us focus on Ethernet so Ethernet requires that one maintain interframe space of 96 bit durations I do not know if it is 96 bits but when you are dealing with 10 Mbps Ethernet it expects you to maintain an interframe space of 96 microseconds let me just check the value so Ethernet expects that 10 Mbps Ethernet expects to maintain an interframe space of 9.6 microseconds what this means is you send a transmitted a frame by the time the frame ends before you can send after you receive the last bit of that particular frame before you transmit you have to wait for this much duration which is the interframe space before you can start transmitting again the reason why the space is there is for example you are a transmitter and you have transmitted so this is where you have transmitted the last bit and supposedly there is another host that is starting to send data for you and if you did not maintain this interframe space let us say that started transmitting before this interframe space somewhere here then you have just now finished transmission you need to switch to reception so there is a different circuitry that is used for reception and to switch from transmission mode to reception mode is going to take some time for the circuit to ramp up ramp down so on so forth so this interframe spacing allows for that switch especially for the transmitter you in order for you to switch from transmission to reception you need this interval so this interframe spacing is mainly to help for that interframe space has got no relation with the frame size frames can be as long as they want but the spacing between two successive frames there should be at least this interframe space gap so for 10 mbps it is 9.6 microseconds but if you are dealing with 1 gbps ethernet it is 96 nanoseconds is the interframe space so going to the remote center which is 1224 suppose if the receiving goes to do not reply back to the sender the ack is not there if there is no ack from the receiving goes to the sender no if there is no ack there is no reply if there is no acknowledgement from receiver to the sender ethernet does not support acknowledgments so there are no acknowledgments in ethernet yeah that's why in such cases there is no need to switch over from receiving mode to the send transmission mode no but why should you purposefully so for example if this packet was destined for this particular transmitter then why do you want to purposefully lose that particular packet fine there are no acknowledgments at the link layer that doesn't mean the packet is not lost you have to recover it at the tcp layer then you should never design a system where you know if you did this you are purposefully going to corrupt packets then this IFS is only for switching over from one transmitter mode to receiver mode yeah in a given host to switch from transmission to reception there is some delay involved so this IFS takes care of the delay in other words you just transmitted a packet and someone else is sending a packet to you if you don't give this time you cannot receive that packet okay then one more thing is the we said that for 10 mps to align IFS is 9.6 microseconds yes yeah if I use a large buffer in receiving a host can I play with using buffer can I reduce the interface sorry interframe spacing as I said is a function of how much time it takes for the circuitry to switch from transmitter to receiver it has got nothing to do with buffers so it is a function of the hardware your hardware should be fast typically when you are transmitting there is a power ramp up and a power ramp down once you finish so your transmitter design should be such that it can quickly ramp down as soon as finishes transmission that is a function of the capacitors you are using whatever it is so that is what is going to dictate this it's a function of the hardware so if you are going for let's say one GBP the hardware is more sophisticated that it can actually do the switching in 96 nanoseconds so we will end here it's already one so it's a lunch break