Filters proveabale attack packets.

Ingress is incoming packets (likely to carry attack packets, 99% attacks

are from ingress) come into a site and egress is outgoing packets go out from the site. Firewall drops and
log that attack packets. Ensure that the packets are actually the attack packets otherwise self-Denial-of-
Service has been created by dropping legitimate traffic. Firewall must be able to handle traffic at wire
speed (maximum speed of data coming into port).
As processing power increases, we can have UTM for have more sophisticated filtering that includes IDS,
IPS, AV filtering, spam filtering which traditional firewalls do not do this.
Most common firewall filtering mechanism is Stateful Packet Inspection (SPI).
STATIC PACKET FILTERING: Examines packets one at a time. Dkhe ga k jo packet aya h kya wo
ACK packet h, to wo agay bhj dy ga. To oski provability 1 hgi.
Sync attack, sync msg sent, again sync msg sent by the attacker. Sync Flooding Attack (Decision of 1s
and 0s). Used as a Secondary Filtering Mechanism.
Static packet filtering m every sync attack is monitored in isolation. I can’t be the provable attack packet
because we see it in isolation, and it will be considered as the legitimate response. Then next sync packet.
We cannot monitor the states, we just monitor every single packet. So SPF not finds out some forms of
attack packets.
It can stop certain attacks very efficiently. If we want to block some source address, then we can ask to
firewall that stop this source IP address, and so this SPF done well in this case. As it has a decision of 1
and 0. Echo packets are also from some source. SO it also blocks this. IP address fragmentation ko b
block krega. Applying filtering on header field, then SPF works well.
Also may be implemented in border routers, which lie between the Internet and the firewall
Stops simple, high-volume attacks to reduce the load on the main border firewall
STATEFUL PACKET INSPECTION (SPI)
Check states that one connection is in which state (Connection Opening, Ongoing Communication,
Connection Closing. Important is first two states.
Connection Opening State is very important. If we rightly filter the connection opening state, then lots of
attack packets are getting filtered, By writing the created state in the log that were rightly created. If any
attack packet comes there, then we can compare it with out logs. Like, A wants to communicate with B,
then in logs, if it has permission then we can easily identify it, otherwise we blocked it.
Connection opening state is 1% of the overall traffic. If 1% of the traffic is rightly decided then 99% of
the traffic is rightly managed.
Connection opening m b 0.5% internal to external connection-opening h. No issue with this internal as
they are our protected people.
0.5% traffic is externally initiated connection-opening attempt (very critical scenario), filter that
outgoing traffic that wants to communicate with your internal network from outside. If we properly filter
this and log this, then our decision is improved on our 99% traffic. Exceptions are ACLs for outgoing
communication.
If that connection already exists and in the logs of firewall then allow it, otherwise if it is not in logs then
drop this (like the spoofed packet from the attacker). Like in our corporate they are in our database.
ACL
Router permit/deny. Standarad/ Extended ACL. Sequential TOP-DOWN approach.
All ACLs end with Implicit Deny All statement.
Standard ACL are from 1-99. Extended are from 100-199.
Each router has two ACLs (Inbound and Outbound)
Inbound: Filter packets coming from outworld traffic and entering the router’s interface.
Outbound: Filters the traffic that is now leaving from the interface of the router.
Application Proxy:
Proxy is app-layer, it is above TCP/UDP. HTTP is App layer web protocol. Packet is examined in proxy
(ftp, e-mail), a software program for filtering a particular application. Packet goes to application layer and
decision applies there. There are generally the applications that were used App-Email, App-webpage,
App-Voip, ftp, telnet. Packet goes to application layer and it http/ftp/sftp proxy. Servers pr proxy lgi hui
hti h. Corporate network m proxy lgate h.
Proxy k through jane ka (as an admin) ye faida h k ye wala protocol allow kre gy k is protocol k through
traffic jay like srf http ki traffic allow kr ra hn with port 80. Drawback is the configuration on every
computer that is on network, if any user wants to connect with your company, then he must have to apply
proxy. So, configuration effort.
Diagram Example: Is webserver pr siwaye http protocol k ilawa r koi traffic nai ae ga. Just HTTP goes
there.
Proxy m ye possibility h k two connections are handled. Indications of SQL injection attacks.
ASSEX, SUSSEX Examples
 Automatic Protections (slide 55)
TOR ROUTING:
TOR Network is a specialized network. Onion Network. Tor browser can be downloaded free. Version of
Peer to Peer Network. Jin jin logon n ye client browser install kia hua hga, they basically forwards the
packet. Torrent application. Torrent k peer to peer network pr hm connect hojae gy where every other
in world is also connected. Files that are shared by me can be seen by the others and vice versa.
Difference between Torrent and this is to, it also sents the encrypted traffic. Basically we are client
where my traffic is forwarded with that other users traffic is also forwarded from my user. You agreed
to become a node of tor as long as you are client. Traffic encrypted over the network. Layer by layer
encrypted. Whatsapp pr client to client encryption. Tor m b traffic over the internet encrypted hti h till
the TOR. Google pr though TOR jana chahte h egress router to the google server, google k webserver
pr un-encrypted hgi apart from HTTPs. Agr HTTPS h to hm aur zyada safe h.
Real time services are not recommended.