Suppose you want your firewall to block all incoming Telnet connections but to allow outbound Telnet connections. One approach would be to block all inbound packets to the designated Telnet port (23). (a) We might want to block inbound packets to other ports as well, but what inbound TCP connections must be permitted in order not to interfere with outbound Telnet? (b) Now suppose your firewall is allowed to use the TCP header Flags bits in addition to the port numbers. Explain how you can achieve the desired Telnet effect here while at the same time allowing no inbound TCP connections.

Suppose you want your firewall to block all incoming Telnet connections but to allow outbound Telnet connections. One approach would be to block all inbound packets to the designated Telnet port (23). (a) We might want to block inbound packets to other ports as well, but what inbound TCP connections must be permitted in order not to interfere with outbound Telnet? (b) Now suppose your firewall is allowed to use the TCP header Flags bits in addition to the port numbers. Explain how you can achieve the desired Telnet effect here while at the same time allowing no inbound TCP connections.

Comptia A+ Core 1 Exam: Guide To Computing Infrastructure (mindtap Course List)

10th Edition

ISBN:9780357108376

Author:Jean Andrews, Joy Dark, Jill West

Publisher:Jean Andrews, Joy Dark, Jill West

Chapter8: Network Infrastructure And Troubleshooting

Section: Chapter Questions

Problem 8TC

See similar textbooks

Similar questions

In order to implement a DNS amplification attack, the attacker must trigger the creation of a sufficiently large volume of DNS response packets from the intermediary to exceed the capacity of the link to the target organization. Consider an attack where the DNS response packets are 500 bytes in size (ignoring framing overhead). a. How many of these packets per second must the attacker trigger to flood a target organization using a 30-Mbps link? A 100-Mbps link? Or a 1-Gbps link? b. If the DNS request packet to the intermediary is 60 bytes in size, how much bandwidth does the attacker consume to send the necessary rate of DNS request packets for each of these three cases?
Explain succinctly what the following rule will achieve and why it is required when applied to traffic entering a firewall from the Internet. If the status flags tcp syn and tcp fin are both 1, then the proper answer is DENY.
When the FTP client is connected to the FTP server, the Transport Layer protocol TCP created a reliable session. TCP is routinely used during a session to control datagram delivery, verify datagram arrival, and manage window size. For each exchange of data between the FTP client and FTP server, a new TCP session is started as shown in this WireShark screenshot: 1.Identify Three-way handshake packets and write them here? 2.Identify and list the graceful termination of communication between FTP client and server? 3. what is the port number of FTP protocol? 4. Identify the source and distention IP addresses?
Write down two firewall rules on the router using the format below (network interface, protocol, flag, source IP or CIDR, source port, destination IP or CIDR, destination port, action) Rule1: block all of the incoming pings sent to the 172.20.241.0/24 subnet; Rules2: block all of the outgoing pings to any computers outside of the 172.20.241.0/24 subnet. What network attacks can the above firewall rules potentially protect against? Please identify one example of these attacks. Explain how this attack can be conducted and how this attack can be blocked using the rules above. For the file rules in Q4.1, is it for stateful inspection or non-stateful inspection (2pts)? Can a non-stateful inspection firewall detect TCP SYN Flood attack? Why or Why not?
Briefly describe what the following rule will do and why this rule is applicable when applied to traffic coming into a firewall from the Internet. if status_flag_tcp_syn = 1 and status_flag_tcp_fin = 1 DENY
The HSBC.COM server on the other end of your TCP session hijacking attempt has received a valid connection from your desktop PC. You were attempting to establish a connection to the HSBC.COM server, but an attack stopped that from happening. In light of the relevant security standards, please elaborate on how the existence of this attach might endanger the security of your connection.
The following gives some facts about Evasion attack (refer to the following figure which shows the attacking scenario for the facts). Please select the correct order to make this attack work. a. Packet "R" is buffered; b. Packet "EWT" is sent and accepted by NIDS; c. Finish three-way handshake to establish a TCP connection to the destination; d. Packet SYN carrying data "R" is sent; e. Packet "EWT" is accepted by the destination; f. Packet "R" and "EWT" are assembled at the destination . Question 11 options: dabcef dacbef dbacef dcabef
In order to implement the classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 60 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 30-Mbps link? How many per second if the attacker uses a 100-Mbps link? Or a 1-Gbps link?
Assume a web server can only receive TCP connections on port 80 (HTTP) and 22 (SSH), but not on any other ports. The web server can only establish connection to a database server hosted on private IP 192.168.100.100 on port 3000, but to no other machines inside or outside the network. Imagine this web server is running Linux, and we’re using iptables to define host-based firewall rules for it. Show the set of iptables commands to install necessary rules for this security policy.
Consider the SDN OpenFlow network shown in the Figure. Suppose we want switch s2 tofunction as a firewall. Specify the flow table entries in s2 that implements the followingfirewall behaviors for delivery of datagrams destined to h3 and h4. You do not need tospecify the forwarding behavior in s2 that forwards traffic to other routers. [20]a. Only traffic arriving from hosts h1 and h6 should be delivered to hosts h3 or h4(i.e., that arriving traffic from hosts h2 and h5 is blocked).b. Only TCP traffic is allowed to be delivered to hosts h3 or h4 (i.e., that UDP trafficis blocked).c. Only traffic destined to h3 is to be delivered (i.e., all traffic to h4 is blocked).d. Only UDP traffic from h1 and destined to h3 is to be delivered. All other traffic isblocked
Each of the following is true regarding TCP SYN port scanning except_______. a. it uses FIN messages that can pass through firewalls and avoid detection. b. instead of using the operating system's network functions, the port scanner generates IP packets itself and monitors for responses. c. the scanner host closes the connection before the handshake is completed. d. this scan type is also known as "half-open scanning" because it never actually opens a full TCP connection.
Hi Just need answer, no need explanation What kind of firewall only checks packet header information in individual packets to make decisions? Circuit-level gateway Application proxy Guard Screening router What kind of IDS builds a model of acceptable behavior so it can flag exceptions? Signature based Misuse based Host based Anomaly based What kind of firewall operates at OSI Layer 5 and can be used to implement a VPN? Circuit-level gateway Application proxy Guard Screening router What kind of firewall can correlate data across packets? Circuit-level gateway Application proxy Stateful inspection Screening router Software that aggregates security event data from multiple sources across a network is called a(n) ___________. IDS SIEM Honeypot IPS