ACL
Access control tabulation. A group forces the implementation the security policy. The access control tabulation in this paper uses in the network strategy specially.
Router/gateway
Refers to the establishment to retransmit the IP data stream the multi-network interface main engine. Possibly has or possibly does not have the data packet to filter ACL to prevent certain network service.
Inputting correspondence
Uses in describing from the network outside, the goal for the network internal network service.
Outputting data flow
Uses in describing from the network interior, the goal for the network exterior network service.
Firewall
Refers to the establishment to retransmit the IP data stream, the multi-network interface, and used the data packet to filter ACL to process the network service the main engine.
ii. Example annotation
Has been selected several traceroute output examples in this article. The intelligent reader will discover IP address will be lists in RFC 1918 [1] may not the route (non-routable) interior network address. In order to avoid the nonessential trouble, this article the IP address which will use in the actual test will replace with this kind of interior network address.
This article will introduce one kind of named” Firewalking” technology. This kind of technology can use in gaining the far-end network material which is protected by the firewall. This article primary intention is showed that this kind of technology the risk which brings to the network. This article faces the object is the familiar network architecture system and the TCP/IP data packet structure high-level reader.
The Firewalking use is similar in the route tracks (traceroute-like) the IP data packet analysis method, determines a special data packet whether can transmit from aggressor's main engine after being located at the data packet filter plant's goal main engine. This kind of technology can use in the detection network closing opens (`open') or the permission passes (the `pass through') port. The further place, it can determine has each kind of control information data packet whether can through assign the gateway. Moreover, through this kind of technology, an aggressor can survey after the data packet filter plant's router. Must understand that this kind of technical the principle of work, first needs to understand how the route does track (traceroute) is works. This article also provides about the route tracks (traceroute) the synopsis.
II. The route tracks (Traceroute)
The route tracks (Traceroute) [2] is network debugging aids, uses in analyzing or discovering arrives in specific goal main engine's route's all main engines. The Traceroute key job principle is transmits UDP or ICMP the echo data packet to the goal main engine, simultaneously after each wheel (default is the survey which three data packets) succeed in IP Baotou's TTL (Time To Live, lifetime) the territory increases progressively 1. If the route track uses the UDP data packet, then the goal port increases progressively in each data packet 1.
You are here: hacking technology
> firewall
> Content
Category: Home
> firewall