Use the winpractice file for the following exercises. Capture your filtered traffic to a file. Submit the file (with a .txt extension) and the full command you used. For Snort, submit the entire alert. 1. Use Windump to filter on all echo reply packets. 2. Use Windump to filter on all packets destined for 172.20.42.32. Do not use name resolution. 3. Use Snort to alert on any tcp traffic with only the SYN and FIN flags set. Label the alert packets with an appropriate message.

Use the winpractice file for the following exercises. Capture your filtered traffic to a file. Submit the file (with a .txt extension) and the full command you used. For Snort, submit the entire alert. 1. Use Windump to filter on all echo reply packets. 2. Use Windump to filter on all packets destined for 172.20.42.32. Do not use name resolution. 3. Use Snort to alert on any tcp traffic with only the SYN and FIN flags set. Label the alert packets with an appropriate message.

LINUX+ AND LPIC-1 GDE.TO LINUX CERTIF.

5th Edition

ISBN:9781337569798

Author:ECKERT

Publisher:ECKERT

Chapter12: Network Configuration

Section: Chapter Questions

Problem 2DE

See similar textbooks

Similar questions

The following is a dump of a UDP header in hexadecimal format. 0513000D001DF315 a. What is the source port number? b. What is the destination port number? c. What is the total length of the user datagram? d. What is the length of the data? e. Is the packet directed from a client to a server or vice versa? f. What is the client process?
which of the following files are used by TCP wrappers? ( Choose two.) a) /etc/wrap.allow b) /etc/wrap.deny c) /etc/hosts.allow d) /etc/hosts.deny
The following is a dump of a UDP header in hexadecimal format.CB840045001C001Ca. What is the source port number (you can write it in hexadecimal format)? b. What is the destination port number (you can write it in hexadecimal format)? c. Is the packet directed from a client to a server or vice versa?
If you look at the docker-compose.yml file, you will find the following entries for the malicious router container. What are the purposes of these entries? Please change their value to 1, and launch the attack again. Please describe and explain your observation.
Write a snort rule to generate an alert for the following: search for the word “HTTP” in the first 20bytes of the payload of a packet that is originating in subnet (192.168.34.0/24) and going toyour subnet (192.168.56.0/24). The alert should read: “HTTP detected”. Could you please also include the nmap command used to scan the target?
8.4 One of the non-payload options in Snort is flow. This option distinguishes between clientsand servers. This option can be used to specify a match only for packets flowing in one direction(client to server or vice-versa) and can specify a match only on established TCP connections.Consider the following Snort rule:alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS\ (msg: “ORACLE drop tableattempt:;\ flow: to_server, established; content: “drop table_name”; nocase;\classtype: protocol-command-decode;)a. What does this rule do?b. Comment on the significance of this rule if the Snort devices is placed inside or outside of theexternal firewall.
1. Encode the following message in base64 01010111 00001111 11110000 2. The following is a dump (contents) of a UDP header in hexadecimal format 0045DF0000580000 a. what is the source port number? b. what is the destination port number? c. what is the total length of the user datagram? d. what is the length of the data? e. what is the application layer protocol? 3.Why does the network-layer protocol need to provide packetizing service to the transport layer? 4. List four types of delays in a packet-switch network.
Use a text editor to create Extended Access lists to accomplish the following tasks. Again no Packet Tracer is needed for this lab.: Allow only web traffic to the company web server with IP address 10.1.2.3. Allow connections from from any IP address to access the SMTP port on the email server with IP address 10.1.2.2, but deny any other traffic. Block well-known Distributed Denial of Service tcp ports 6669, 6711,6712,6713,6714, 16660.
Assume a web server can only receive TCP connections on port 80 (HTTP) and 22 (SSH), but not on any other ports. The web server can only establish connection to a database server hosted on private IP 192.168.100.100 on port 3000, but to no other machines inside or outside the network. Imagine this web server is running Linux, and we’re using iptables to define host-based firewall rules for it. Show the set of iptables commands to install necessary rules for this security policy.
I NEED ONLY CORRECT OPTION NO NEED TO EXPLAIN IN DEPTH,PLEASE SOLVE ALL THE QUESTION, DON'T LEAVE ANY QUESTION AND IF YOU DON'T KNOW THE CORRECT ANSWER THEN PLEASE LEAVE IT OTHERWISE I WILL DOWNVOTE IT.... 1. Which of the following statements are correct?I. The User Datagram Protocol (UDP) is used for applications that requires constantdata flow.Il.The header size in Transmission Control Protocol (TCP is small when compared tothe header size of User Datagram Protocol (UDP).I!.The Transmission Control Protocol (TCP) is byte oriented.IV. The User Datagram Protocol (UDP) is used for routing.(a) I, II, and III only(b) II, Ill, and IV only(c) I, Ill, and IV only(d) I, Il, and IV only 2. Which of the following statements are true when the block size in a fixed block size filesystem is increased?1. disk throughput is increased2. disk throughput is decreased3. disk space utilization is increased4. disk space utilization is decreased 3. What is the output of below…
8-Based on the provided capture file: Locate the packet for the first HTTP server response (sorted by Time). Examine the HTTP header. What is the Content-Encoding of the file sent by the server?
An attacker tries to do banner grabbing on a remote web server and executes the following command:$ nmap -sV hackme.com -p 80 He gets the following output:Starting Nmap 7.90 ( http://nmap.org ) at 2020-09-26 22:47 ESTNmap scan report for hackme.com (108.58.137.114)Host is up (0.048s latency).PORT STATE SERVICE VERSION80/tcp open http Apache httpdService detection performed. Please report any incorrect results at http://nmap.org/submit/.Nmap done: 1 IP address (1 host up) scanned in 7.36 seconds What did the hacker accomplish? nmap can’t retrieve the version number of any running remote service. The hacker successfully completed the banner grabbing. The hacker should have used nmap -O host.domain.com. The hacker failed to do banner grabbing as he didn’t get the version of the Apache web server.