Printable View
I was wondering if anyone could tell me how hackers find computers that are behind routers, or even cable modems. I am a network admin, I am trying to learn about security and I cant figure out how a outside attacker could breach a server that is behind a router or a cable modem that provides access to the internet. Cant the hacker only see the address to the cable modem??
You can first map out the network with this nifty program.
http://www.marko.net/cheops/
As far as getting past the gateway. I suppose you can make routed packets with the final hop being the gateway with a destination address being an inside private IP.
Though from what Ive done, it always starts from the inside. Like using nc to push a backdoor.
I was once pondering this very question myself. I did a little research on the topic and found that the router contains the 'public' IP for the net. But let's pretend that a hacker wanted to locate a computer attached to a router....As far as I know...you can do an some sort of ARP query to obtain the LAN IP of a specific PC. But, if you are remote...you must always resolve the LAN IP through the router ARP table first. The packet header usually specifies the 'node' to which it is going. The router just poses as a gateway or hop if you will.
scat
If you know the internal IP ranges of a company it is easy enough to craft an IP packet to access an internal resource, using the router as a gateway.
Part of a true hackers task (not script kiddies) is what is called "fingerprinting" this is basically gathering information about the intended victim.
One good source for IP owner information is a site like Sam Spade which gives you the ability to queiry registration databases for IP range ownership.
Also get yourself some good books on the subject - Hacking Exposed I find is an excellent source of information.
PS - I am an IT Security Manager for a large company - not a hacker :cool:
Golam
MidNyte
Assuming the PCs have what they call an RFC1918 address (non-routable addresses)
Ranges are: 10.x.x.x
172.16.x.x-172.31.x.x
192.168.x.x
There is no way "hackers/anyone" can find the IP of a PC behind a router that is doing either a "Port Address Translation/PAT",which is a many-to-one translation or a "Network Address Translation/NAT", Which is a one-to-one translation.
However with a cable modem, which is really a bridge..your PCs IP is not hidden and is
a registered public address that anyone can portscan..
Also, in the first scenario, if you had a router and you were doing a PAT or a NAT,
even if someone new your RFC1918 address, they cannot initiate an
attack on your PC because all those addresses are blocked on all Internet routers.
(thats why they refer to them as private addresses)
Hope this helps....
Yeah Golam was right you are going to have to forgive me for this has been a little while but, Let's say I get the an IP of your system any, If I telnet to 59 and use Sam I will find just about everything that I need, Another thing about this that is fairly interesting is that if bye chance I were to scan your system and you had 80, 23, 59, 110, 25 open then I could easly get access. Because you have router but your system is still connected to that router so if I hae access to your Router I have access to you entire Network more or less.
As for Hacking Esposed I thought it a bit, remedial all the stuff in those books you could learn in a Query in Google, A book I would have to say is good, Ankit Fadia's The Unofficial Guide to Ethhical Hacking. Pretty good I don't believe that he talks about Routers though.
If you connect to any computer via the "www" or "network" your computer has to know where to send the data 'bits' so it uses a logical address, lets say, "www.yahoo.com" which translates to "216.109.118.72". That ip address is matched up with a "MAC" address that is assigned to your "NIC", network interface card by the manufacturor. All mac address are unique. When you type www.yahoo.com in the url of your web browser your ip address is encapsulated in the data packets around the data being sent.
Very true merrimand, unless that address is the "external" address of a firewall or address translating router. Then you would not see the inside address as it will be changed on the outbound leg by the address translation.
That is the same for your example of Yahoo, I bet dollars to doughnuts that that is not the true address of their web server(s) :)
Golam
merrimand,
You are right all NIC cards have a unique 48 bit MAC address
which is burned in at the manufacturers...
However, Be very carefull with the statement you made unless
I might have misunderstood your comment.
A PC's MAC address will "never ever" be seen on a different
subnet then your own. "Data Link Connections are established locally"
The Ip src and dst of any packet will always be the same no matter how many routers/subnets/hops the packet traverses, however the MAC address will change from subnet to subnet...
MAC addresses are just used to perform the handoff from net to net,,
Ill try to use an anology (hope its not too vague)
It is like if you send a letter to a friend out of state, the From and To
fields will always be the same as the mail is routed from one post office in your
city to the next.. The post office here is like you MAC address..It is just used
for the hand off, and it changes form net to net.
P.S.
Sorry if I misunderstood your comment...
stupid Opera crashed on me after I'd finished typing my reply, only seconds b4 I hit post :mad:
I'm a newb too, I've got a simple network, no servers except samba server on my linux box. I have cable connection and realise that the cable 'modem' won't hide my computer so I bought a netgear router/firewall.
I was under the impression that the router was going to totally hide my network from 31337 kiddies :confused: I've set it to refuse all incoming requests, but allow all outgoing (software firewall should keep an eye on that)
I'm reading it's logs, and it has done well so far, dropping all incoming requests.. etc
Am I too complacent. I've checked my system with scans from GRC and broadband.com, etc and got total stealth reports. How good are these?
I've nmap-ed some of my freinds and family over the net and helped them to stealth their computers. If I did the same from another computer to my network is this enough?
arthurking
If your router (the linksys) does not have any ports open, you are safe..
assuming the router is doing PAT and not NAT..
and your inside addresses are RFC1918 addresses.
(which they're most likely are)
With PAT, connctions are initiated from the inside
and with NAT, connections can be initiated from outside.
Also, for the price of a Linksys router, you can buy yourself
a Really good Firewall which acts as a router but is more
robust than Linksys.
You can gut yourself "checkpoint" firewall (501 series) a used one off ebay
that acts as a router (just cant turn on routing protocols)
It supports VPN (IPSEC)
Statefull inspection firewall
and protects you from most types of DoS attacks.
see white paper: http://www.clearview.co.uk/docs/nets...irewall_wp.pdf
Just an opinion....
Sounds like you have a reasonably protected connection arthurking. The best test is to go to another connection point on the net (at a friend's house for example) and run a scan from there. I don't put much faith in these scans performed from free commercial sites.
The only thing that you need to check is that you have the correct IP address. You want to check this on the WAN side of your router before you run the scan. Unless you pay for a static IP address from your ISP - your WAN address can/will change.
Just a note on the PAT and NAT comment from gunit0072003.
PAT is Port Address Translation
NAT is Network Address Translation
Both of these can happen in either direction, and can change several times as an IP packet travels between source and destination.
NAT is generally used to either "Hide" internal addresses from an external source, or to allow a private IP address range to communicate over the Internet (private IP address are generally not routable over the Internet.) So a business may use several private ranges within their internal network but only need to pay for one public IP number when connecting to the Internet. NAT swaps the addresses as the IP packet leaves the business network via a router or firewall.
PAT is used generally by proxies to keep track of outbound connections to the WWW.
The process can be differcult to explain - but if you are interested a guick google for proxies and PAT should find some good info. :)
Golam
Golam,
With all due respect, your comments on PAT and NAT are not 100% accurate..
what do you mean by your comments:
1) "Both of these can happen in either direction, and can change several times as an IP
packet travels between source and destination. " and
2) "NAT is generally used to either "Hide" internal addresses from an external source, or to allow a private IP address range to communicate over the Internet (private IP address are generally not routable over the Internet.) So a business may use several private ranges within their internal network but only need to pay for one public IP number when connecting to the Internet. NAT swaps the addresses as the IP packet leaves the business network via a router or firewall."
With respect to your 1st comment, are you implying that connections can be initiated from the outside for PAT as well? cause that is so not the case..NAT is a one to one translation..(connections can be initiated from either outside or inside)
it is static/fixed. and does not change..
Public A--Private A
PublicB---Privcate B
" "
" "
Public x---Private x
However with PAT you have dynamic translation..
The dynamic translation only occurs when the router receives a packet from inside
destined for the outside..
Public F---Private A (along with Random port # "abcd")
Public F---Private AB (along with Random port # "efgh")
" "
" "
PublicF---Private x (along with randon port# "pqrs")
And with respect to your second comment, you are referring to PAT not NAT..
PAT is a dynamic translation of many IP addresses to one address and
NAT is a static translation of one unique address to another unique address
With PAT, you use it if you do not require connections to be initiated from the outside
and only have one public address available.
With NAT you use it if you want to conceal/hide your are inside addresses like hosting a server on the inside/ DMZ that receives connections initiated from the outside...usually referenced by a domain name..
Rule of thumb, NAT your servers (Email, DNS, WEB,etc..) they require unique one to one
translation, and PAT all normal user traffic..
sorry for rambling on....
P.S
Some routers can now even with just one public address, apply a static NAT
address mapped to a specific port, where connections can be initiated from outside....
If I misunderstood your statements I apologize....
Also with respect, what you say about PAT is indeed true if you are using the device to hide many users accessing the Internet from an internal source out on one public IP address. This is how the proxy or firewall maintains a statefull list of connections and can return responses from the web to the correct internal clients.
I manage several firewalls for my organisation and it is possible to change both network address and port number in either direction through the firewall.
Admittedly it is not often used as NAT is generally enough, but some organisations will use different ports other then standard for added security, and rely on PAT to present the service on the standard port “on the outside”
:rolleyes:
Golam
Golam,
I think we beat this discussion to death,,,,,lol
MidNyte got an earfull from the both of us
and probably got more than he opted for,,,
Cheers,,,,
:)
No worries - its been fun
Cheers :)
Golam
First off I am a bit leary of this thread as a Admin you should have full understanding of Public and private IP's. One can usually set that in the IP scope and know it's range. Second usually the scope is not hard to figure out as most are standard procedure. So knowing these two factors a public IP and a scope range beyond it one really need not do more the apply the usual IP scope range to what ever scanner. Problem is really in figuring out now days the firewalls deployed because some can say things that are not true., and the Admin laughs at the pecks there often. I think with all respect to you that this is the problem to many people have gotten that MCSE end up as admin and well your gonna get soaked a few more bucks for catch up classes in the real world. World is full of MCSE people and yet Blaster gets in why? Cause ya buy into the myth of M$ and an MCSE. Think of a MCSE as a starting point to begin to learn and understand, :) ya got your learning papers in order :)
Peace
Funny you should mention that...Quote:
I think with all respect to you that this is the problem to many people have gotten that MCSE end up as admin and well your gonna get soaked a few more bucks for catch up classes in the real world. World is full of MCSE people and yet Blaster gets in why? Cause ya buy into the myth of M$ and an MCSE. Think of a MCSE as a starting point to begin to learn and understand, ya got your learning papers in order
I had a user call me and say that she was thinking about getting her MCSE so she could get a job in computers makeing $60,000 and all she would have to do is spend $20,000 to take the classes and then go take the test... I couldn't help but to laugh. I know people who have come to the US from other countries with the same theory. They took their MCSE and paid $20,000 for the classes and tests... and tried to get a job. They were turned out at the door and told to get some real learning and some experience and then to come back. After they get more learning and experience... the MCSE is no longer valid (because it expires) and they have to take it all over again... silly people listening to the radio ads...
If you can pass this test... you can sign up for the MCSE... LoL
http://www.computertraining.com/start/testindex.html
thnx for the info guys. I've never heard of PAT b4 but I've got a netgear router it does NAT. (and SPI) I have a very limited knowledge of these and will learn more as I get younger. One of the reasons for my home network is to learn more about networks etc, and then linux found its way in here, and if I had room, another couple of boxes running other UNIXes. LOL.
I am considering 'breaking' into the IT sector, my current employment is totally unrelated, and thinking about some courses but not MSCE.......yet.
And let me get this straight. If my router doesn't allow a connection into my network(all ports blocked) a real hacker could still get into my network?
I'm reading some of the logs and one eg. is,
Fri, 2003-08-22 23:50:26 - ICMP packet - Source:elite.haxor.on.net ,[Echo Request],WAN - Destination:my.maybe.vuln.net,LAN [Drop] - [Inbound Default rule match]
how does a hacker get into my system? more importantly how can I stop him.
I try to take care in my network against script kiddies more than the elite types, because I'm thinking hackers/crackers (whatever) will go for big fish types instead of the nobody's like me (I keep no sensitive data on the computer, only on removable media like floppies or cdrw at the moment). So I've got to stop them scanning me? I think I'm going to buy this "hacking exposed" book!!
I need more info.
The IT sector sucks right now. I have been unemployeed since January. The few jobs out there don't pay **** right now. Stay where you are and learn more about IT and wait till this recession is over before you try to change carreers, otherwise your going to wish you hadn't left.Quote:
I am considering 'breaking' into the IT sector, my current employment is totally unrelated, and thinking about some courses but not MSCE.......yet.
Blocking your ports is enough to keep script kiddies out. As for the real hackers, you only have to worry about them if they have a reason to attack you. But there are ways to get past NAT and PAT. There are things like firewalking and ASMmutate (I believe that was the name, been a while since I looked at it). Then there are always vulnerablitites in firewalls. If a firewall was never vulnerable, why would you have to update it? If NAT was enough to keep out everyone, why don't companies all just put a linksys router on their gatway and end up being safe? Anyone that tells you that NAT or PAT is enough to secure your network is either full of ****, only thinking about script kiddies, or doesn't know the real world.
arthurking ,
I dont blame you for getting confused with all feedback you got.
It seems like everyone including myself went off tangent a bit.
Let me try and keep it simple..
A few thing you need to understand:
1) If your router is blocking all ports (all ports closed on your router)
it does not mean your router is blocking connections to your PC..
It only means your router is blocking connections to itself..
2) Look at following diagram:
And see the difference between PAT and NAT
(I didnt include default gateway of PC,cause its irrelevant to discussion)
[inside]-----------------------------------[outside]
||pc||------------------------||Router||--------------------------|||Internet|||
a.b.c.d -------------------------------------e.f.g.h
(private address)------------------------(public address)
This is what happens with NAT:
When your Pc goes out w/src a.b.c.d the src changes by router to e.f.g.h
and when requests come in from the Internet to dst e.f.g.h,
the router forwards to a.b.c.d.. (static translation always exists on router,
whether you initiate connections from inside or not))
This is what happens with PAT:
When your Pc goes out w/src a.b.c.d the src also changes by router to e.f.g.h,
however it does so dynamically on as need by basis..meaning the router does a translation
only and only when the PC initiates a connection..when pc terminates connection
the router terminates the translation.
This is very important to understand because now if someone tries to initiate a connection from internet to e.f.g.h, requests go directly to your router and only your router...cause you did not initiate a connection from the inside for a translationtable to exist..
In summary:
If your router is doing a PAT, no one can scan your PC directly cause
a) you router does not have a translation table to forward requests to your PC and
b) you are most likely using a private address that is non-routable on internet
If your router is doing a NAT:
a) all requests destined to the public address( scans/hacks/trusted..etc) always
get forwarded to your PC.
Also remember , closing ports on your router has nothing what so ever to do
with closing ports or protecting your PC, it does not mean you are performing
any filtering onyour router, it only means your router is blocking connections to
itself....
Hope this helps, and I promised myself this will be my last response on this subject,,lol
good luck
cheers
http://www.cisco.com/en/US/tech/tk64...800e523b.shtml
Thats a pretty good comparison between NAT and PAT.
and btw...
that depends on the setup of your NAT. A NAT can have 10,000 machines behind 1 NAT router and that router is not going to forward the packets to every machine behind the router. As a matter of fact, unless you specifically tell the router to send the packets on, the router will drop connections that are iniated from outside the network.Quote:
f your router is doing a NAT:
a) all requests destined to the public address( scans/hacks/trusted..etc) always
get forwarded to your PC.
gunit, that's starting to make sense the way you've described it, and that's why I got a software firewall running on mypc's too.
souleman, that's what the router is saying its doing, when I view the logs.
I've read that if I have ports open on a PC, that I can set the router to forward connections to that port number to a virtual machine that doesn't really exist. So if I have 2 pc's at address's a.b.c.d and a.b.c.e, I can set the router to forward port 113 to a non-existent pc @ a.b.d.z, and this will drop the connection because no pc at that address exists on my network. This had something to to with ident running on linux which I sorted using a firewall anyhow.
OK thanks for all the info.
wow, the responses you guys gave is great! I have not posted here is a while and its nice to see some intelligent conversation. I am still a little confused as to how intruders break through firewalls or routers to attack internal machines but now i have some info to check up on to help me learn. I just want to say thanks.
MidNyte
This is such a large topic I will only say a few things,first off some protocols are portless and therefore cannot be blocked by ports, also your IP can be found out even if you are using NAT/PAT its just tricky, sometimes the oringinal packet is just "wrapped" (often times the source app will leave no-no's in here) in a new packet and payload inspection can reveal internal architecture. Because NAT/PAT uses original source IP and Port to create routing tables this can make identifing how many hosts are behind the NAT/PATer if traffic can be sniffed at the router (once again this only applies to protocols with ports, for portless prototcols PAT/NAT can be messy)There is also DNS information to be considered as well as router quality and vulnerabilities. Also routers not configured to drop incoming packets from reserved address space are vulnerable to spoofing which can sometimes yield results although it is fairly difficult. Also the MAC address is mapped to an IP using ARP and other tables which can be posioned or manipulated to "steal" or obtain an IP on the internal network(man in tha middle attacks use this frequently) and many devices also allow MAC address cloning (aka they will set themeselves to any MAC you like, so you CANNOT gaurantee uniqueness) So, just because you are filtering TCP/UDP does not mean other methods or protcols cannot be used for information gathering and although it is a good start it is far from foolproof or un-hackable.
-Maestr0
I know I promised not to say too much more on subject however, since I dont have a life I wanted to comment a bit on Maestros response,,,Here goes,,Sorry for the long response, I wanted to break it up a bit and be specific..
YOUR COMMENT:
“This is such a large topic I will only say a few things, first off some protocols are portless and therefore cannot be blocked by ports”
MY RESPONSE:
You are right, not all application use TCP or UDP (protocols 6 and 17) and are associated with a port number. Some applications use other protocol numbers and work on layer 3 of OSI model.
(an example is Cisco’s proprietary IGRP (interior gateway routing protocol/protocol 9), but there are others that are part of the TCP/IP suite..
Let us examine the IP header
Courtesy of RFC 790: (www.ietf.org) This RFC "might have been updated" but the point is same..
ASSIGNED INTERNET PROTOCOL NUMBERS
In IP there is a field called the Protocol field which is an 8 bit field that corresponds to a particular application. The 8 bit gives us 256 different possible protocol numbers that may correspond to an application.
Assigned Internet Protocol Numbers
0 and 255 are reserved,
2,8,21-62,66-68,70,72-75 and 80-254 are unassigned..
1 is ICMP
3 is Gateway-to-Gateway
4 is CMCC Gateway Monitoring Message
5 is ST
6 is TCP
7 is UCL
9 is Secure
10 is BBN RCC Monitoring
11 is NVP
12 is PUP
13 is Pluribus
14 is Telenet
15 is XNET
16 is Chaos
17 is UDP
18 is Multiplexing
19 is DCN
20 is TAC Monitoring
63 is any local network
64 is SATNET and Backroom EXPAK
65 is MIT Subnet Support
69 is SATNET Monitoring
71 is Internet Packet Core Utility
76 is Backroom SATNET Monitoring
78 is WIDEBAND Monitoring
79 is WIDEBAND EXPAK
If any of those protocols/applications other than ICMP, TCP and UDP are turned on TCP/IP stack of Linksys router, then yes there lies a vulnerabilty….
YOUR COMMENT:
“also your IP can be found out even if you are using NAT/PAT its just tricky, sometimes the oringinal packet is just "wrapped" in a new packet and payload inspection can reveal internal architecture”
MY RESPONSE:
If you are referring to the internal private IP that is natted or patted is somehow encapsulated in the data field, then your statement is incorrect. There is no such thing. Translation table remains in the router..You might be referring to VPN here where original IP header is encapsulated and tunneled through, not NAT or PAT,,,
YOUR COMMENT:
“Because NAT/PAT uses original source IP and Port to create routing tables this can make identifing how many hosts are behind the NAT/PATer if traffic can be sniffed at the router (once again this only applies to protocols with ports, for portless prototcols PAT/NAT can be messy)”
MY RESPONSE:
Routing tables have nothing to do with NAT or PAT and have nothing to do with Port numbers.. Routing tables are created by the router through the process of acknowledging its interfaces are in an up state and through running some type of routing protocol (either static or dynamic).
YOUR COMMENT:
“There is also DNS information to be considered as well as router quality and vulnerabilities.”
MY RESPONSE:
You lost me on this one ??????????
YOUR COMMENT:
“Also routers not configured to drop incoming packets from reserved address space are vulnerable to spoofing which can sometimes yield results although it is fairly difficult”
MY RESPONSE:
Yes you are right, this can happen. Vendors of “real” routers can stop this by turning off what they refer to as “IP source route”
YOUR COMMENT:
“Also the MAC address is mapped to an IP using ARP and other tables which can be posioned or manipulated to "steal" or obtain an IP on the internal network(man in tha middle attacks use this frequently)”
MY RESPONSE:
I don’t follow you here either,,,Data link connections are established locally…Any MAC on internal LAN stays within internal LAN. MAC of internal user will never be seen behind a router.
YOUR COMMENT:
“and many devices also allow MAC address cloning (aka they will set themeselves to any MAC you like, so you CANNOT gaurantee uniqueness)”
MY RESPONSE:
I don’t see how cloning a MAC is relevant to discussion of identifying internal PC’s Ip address..especially since internal PCs MAC stays internal and is not revealed to external/outside LAN…
Cheers..
gunit007,
I had not intended originally to go into detail but rather mention a few possibilities in response to the original question, however since you have brought up some good points I will respond:
YOUR COMMENT:
“also your IP can be found out even if you are using NAT/PAT its just tricky, sometimes the oringinal packet is just "wrapped" in a new packet and payload inspection can reveal internal architecture”
MY RESPONSE:
If you are referring to the internal private IP that is natted or patted is somehow encapsulated in the data field, then your statement is incorrect. There is no such thing. Translation table remains in the router..You might be referring to VPN here where original IP header is encapsulated and tunneled through, not NAT or PAT,,,
- On the contrary the statement is entirely correct. Sometimes a particular protocol is encapsulated in order to function properly with NAT. One example of this is UDP encapsulation for IKE/IPsec, granted this traffic is encrypted but that is not my point, other software has used similar approaches to cope with problems with NAT.
see http://www.ietf.org/internet-drafts/...-encaps-06.txt
You will also note in my statement this information leak can also be in the form of data about the orginating host leaked by the source application and will be in the payload,also the number of hosts is possible to guess by analyzing the traffic.
see http://www.sflow.org/detectNAT/
http://www.research.att.com/~smb/papers/fnat.pdf
YOUR COMMENT
“Because NAT/PAT uses original source IP and Port to create routing tables this can make identifing how many hosts are behind the NAT/PATer if traffic can be sniffed at the router (once again this only applies to protocols with ports, for portless prototcols PAT/NAT can be messy)”
MY RESPONSE:
Routing tables have nothing to do with NAT or PAT and have nothing to do with Port numbers.. Routing tables are created by the router through the process of acknowledging its interfaces are in an up state and through running some type of routing protocol (either static or dynamic).
- Once again the statement is correct although I can possibly see that I misused routing table instead of port mapping table (I will point out you refer to it as a translation table so... I believe we're even on that one. :) ) but as I said it wasnt meant to be a technical essay but I concede that point. As far as the notion that it does not have to do with port numbers, well I'm not sure how you think NAT works without tables or ports because thats exactly how it works.
see http://www.internet-sharing.com/nat_...perations.html
YOUR COMMENT:
“There is also DNS information to be considered as well as router quality and vulnerabilities.”
- The point is your hosts are not particularly hidden if your DNS server (often located outside a router or firewall) allows me to do a zone transfer or have free reign on the entries, a compromised DNS server will lead to a compromised network. As to the second half improper handling of crafted packets by routers or routers which fail open etc,etc,etc. Owned routers also lead to owned networks.
YOUR COMMENT:
“Also the MAC address is mapped to an IP using ARP and other tables which can be posioned or manipulated to "steal" or obtain an IP on the internal network(man in tha middle attacks use this frequently)”
MY RESPONSE:
I don’t follow you here either,,,Data link connections are established locally…Any MAC on internal LAN stays within internal LAN. MAC of internal user will never be seen behind a router.
-Although it requires a machine with a interface on the LAN, the amount of trouble which can be caused here is immense.Since most 802.11 devices act as MAC bridges I think this is a very real threat, also a compromised DNS machine or anything in a DMZ would do nicely to abuse ARP.
see http://www.watchguard.com/infocenter...ial/135324.asp
see http://www.securityfocus.com/bid/3460/discussion/
and lastly, no I admit MAC cloning is not particularly related only that I saw someone comment on them being unique, I merely stated you cannot rely on that.
-Maestr0
Maestr0,
THE PAPERS
http://www.sflow.org/detectNAT/ and http://www.research.att.com/~smb/papers/fnat.pdf]
talk nothing about determining the IP of the natted or patted address. It merely talks about determining wether a router is performing NAT or PAT and determining the number of hosts that may be natted or patted.
(unless I’ve missed something, if I did I apologize)
However with all due respect, what is your point here, we do not need a white paper to tell us that the average Internet user is natting or patting his/her IP. That’s a given….I didn’t think this was relevant to topic of discussion. (maybe I was worng?)
--------------------------------------------------------------------------------------------------------------------------------------
THE PAPER:
http://www.ietf.org/internet-drafts/...-encaps-06.txt talks about UDP Encapsulation of IPsec Packets.
Im not going to touch that…I’ve stated before if you are doing VPN/some type of encryption then ofcourse this is the case..
We were talking about strictly using NAT or PAT. Give me an example of an application that someone can be using over the Internet and that encapsulates his RFC1918/internal private address in data field through PAT or NAT.
---------------------------------------------------------------------------------------------------------------------------------------
WITH REGARDS TO YOUR COMMENT:
” Once again the statement is correct although I can possibly see that I misused routing table instead of port mapping table (I will point out you refer to it as a translation table so... I believe we're even on that one. ) but as I said it wasnt meant to be a technical essay but I concede that point. As far as the notion that it does not have to do with port numbers, well I'm not sure how you think NAT works without tables or ports because thats exactly how it works.
see http://www.internet-sharing.com/nat....ations.html”
MY RESPONSE TO YOU IS THIS:
Let us for a moment forget about using the Terms PAT and NAT and review together what the router can do for concealing addresses.
1. A router can statically perform a one to one translation where a certain number of public addresses are
statically assigned to a same number of private addresses (predefined) .
2. A router can dynamically perform a one to one translation (1st come 1st serve) where the total number of
available public addresses equals the total number of private addresses.
3. A router can perform many to one translation and this is done dynamically of course using 1 public address
along with random port numbers.
4. A router can do the same as stated in 2) however should the total number of private addresses exceed the total
number of available public addresses, then the router will perform the translation using random port numbers
along with the last available public address.
Although what we call the different methods doesn’t matter as everyone seems to have their own definition, I will however share mines.
1) I refer to as static NAT
2) I refer to as dynamic NAT
3) I refer to as PAT (aka NAT over-loading)
4) I refer to as static NAT with over-loading feature
Now with all that said, the only thing that can be exposed to outside/external LAN after translation occurs are the random port numbers when performing PAT or NAT overloading. This again just provides what your first paper outlined. (Internal address is still concealed)
---------------------------------------------------------------------------------------------------------------------------------------
WITH REGARDS TO YOUR COMMENT:
“The point is your hosts are not particularly hidden if your DNS server (often located outside a router or firewall) allows me to do a zone transfer or have free reign on the entries, a compromised DNS server will lead to a compromised network. As to the second half improper handling of crafted packets by routers or routers which fail open etc,etc,etc. Owned routers also lead to owned networks”
MY RESPONSE TO YOU IS THIS:
You are right, if you compromise the ISPs DNS server, then of course there exists vulnerabilities just as if you compromise an ISPs router you can have similar vulnerabilities..
---------------------------------------------------------------------------------------------------------------------------------------
WITH REGARDS TO YOUR COMMENT:
“lthough it requires a machine with a interface on the LAN, the amount of trouble which can be caused here is immense.Since most 802.11 devices act as MAC bridges I think this is a very real threat, also a compromised DNS machine or anything in a DMZ would do nicely to abuse ARP.
see http://www.watchguard.com/infocente...rial/135324.asp
see http://www.securityfocus.com/bid/3460/discussion/”
MY RESPONSE TO YOU IS THIS:
As you stated, it requires a machine with a interface on the LAN.
Cheers.
P.S
I hope no one including yourself, maestro takes any of this feedback in a negative way.. I do appreciate all the feed back I get myself (positive or negative) My only objective is really to just gain knowledge. Greeenies/positive pts/negative pts/newbie status/senior status/etc…Its all great, but Its just the knowledge I’m interested in. I appreciate constructive criticisms as well as being able to dish it out. I think it only betters us all as long as its done in good taste.
:)
"hope no one including yourself, maestro takes any of this feedback in a negative way.. I do appreciate all the feed back I get myself (positive or negative) My only objective is really to just gain knowledge. Greeenies/positive pts/negative pts/newbie status/senior status/etc…Its all great, but Its just the knowledge I’m interested in. I appreciate constructive criticisms as well as being able to dish it out. I think it only betters us all as long as its done in good taste."
I agree 100%, I would not have responded if I had not thought your post to be fairly written and contain a number of good points.
-Maestr0