null Pune meet - Understanding TCP/IP and Network Intrusion – By Murtuja Bharmal http://null.co.in

3. The TCP/IP Stack

6. Network Layer (L3) ‏ IPv4 header layout

8. TCP (L4) ‏ TCP header layout

12. UDP (L4) ‏ UDP header layout

14. Idle Scan Host Zombi Target Idle scan completes Probe packet (SYN) IPID =43210 SYN/ACK SrcIP = Zombi/Port = 80 (SYN) SYN/ACK RST, IPID = 43211 IPID =43212 SYN/ACK

15. Exploiting Exchange XEXCH50 -1 2 Exploit Blocked MS05-043 HOST Exchange Server XEXCH50 -1 2 IPS/IDS IF “ XEXCH50 -1 2” DROP XEXCH50 -1 2

16. Evasion Techniques XEXCH50 -1 2 MS05-043 IP Fragmentation HOST Exchange Server XEXCH50 TTL = 10 XEXCH50 TTL = 9 -1 2 TTL = 10 -1 2 TTL = 9 IPS/IDS IF “ XEXCH50 -1 2” DROP

17. Evasion Techniques TTL Expired XEXCH50 -1 2 MS05-043 Resultant String “XEXCH50 JUNK -1 2” Traffic Insertion HOST Exchange Server XEXCH50 TTL = 10 XEXCH50 TTL = 9 JUNK TTL = 1 -1 2 TTL = 10 -1 2 TTL = 9 IPS/IDS IF “ XEXCH50 -1 2” DROP

21. Murtuja Bharmal (bharmal.murtuja@gmail.com)