You are here: silicon.com > Resources > White Papers > Networking and Communications > LAN - WAN > Switching

Switching White Papers

Feasibility of Detecting TCP-SYN Scanning at a Backbone Router

Tags:
switching

Overview IP address and TCP/UDP port scanning are critical components of many network attacks. Such scanning allows attackers to spread a self-propagating worm or collect detailed information about end-hosts in preparation for attacks. This paper investigates an algorithm to detect TCP-SYN scanning. Special care is taken to detect even stealthy scanners. Attackers are detected by tracking the number of half-open connections generated by each source. However, a source is only tracked until it is clear that it is not currently scanning. The computational load of this method is analyzed and it is found that the method is not computationally intensive and is suitable for online detection of scanning even on backbone links.

Further White Paper Details
Publisher	University of Southern California	File Format	PDF
Date Published	June 2004
Format	White Papers
Topics	Switching, TCP - IP

Did you find this white paper useful? 3 out of 4 users found this white paper useful

802.11n Access Points and Power over Ethernet: Key Considerations

Publisher:
Siemens

Practical Considerations for deploying 802.11n whitepaper

Publisher:
Siemens

Latency Equalization: A Programmable Routing Service Primitive

Publisher:
Association for Computing Machinery

Tags:
switching

Ethernet: The High Bandwidth Low-Latency Data Center Switching Fabric

Publisher:
Force10 Networks

Tags:
ethernet

Foundry Helps EEC Deploy Internal and External Network

Publisher:
Foundry Networks

Tags:
ethernet

Signing up the competition - have digital signatures met their match?

It certainly takes longer to detect a hack than a virus, because viruses are spread between machines and they usually crash them. Marc Dacier, manager of IBM's Global Security Analysis Laboratory in Zurich, explained: "We have developed a prototype...

Channel:
Comment & Analysis

The best of 'Reader Comments': Viruses, viruses, viruses

An ISP offering a virus scanning service as part of the deal might clean up. So far the only two affects I've seen result from this worm, are that the AV companies' websites are overloaded and my mailbox is full of virus warning messages.

Channel:
Comment & Analysis

Sun donates 'SSL-lite' to open source group

The product will filter out undesired network traffic, detect intrusions and screen for viruses. Small gadgets are the most obvious place to use it," Diffie said, but once the technology is built, it likely will spread farther.

Channel:
Security Strategy

Is this the worst virus ever?

The worm attempts to break into machines by generating fake IP addresses and scanning them for a listening TCP port 445. A new Windows worm has appeared on the scene, but is so poorly designed that it is unlikely to spread, according to security...

Channel:
Security Strategy

IE flaw opens door to latest MyDoom

The program sneaks past antivirus applications that detect malicious software by scanning email messages with attached programs. A new version of MyDoom uses an unpatched flaw in Microsoft's Internet Explorer to spread, antivirus companies warned...

Channel:
Malware

Warning: The Storm still rages on

Security vendor Symantec has warned that the Storm worm, the malware which contributes to the Storm botnet, is continuing to evolve and now has two further possible avenues of attack. The original Storm worm code, which appeared on 19 January 2007...

Channel:
Malware
Tags:
malware,
botnet,
storm

Live Webcast: Telecoms 2.0 - Where is telecoms heading?

In this webcast, our panel of experts will review where we are with next generation telecoms in the UK, working through the concept of 'Telecoms 2.0': - Realising the potential of Next Generation Networks - why it isn't just about the technology? - What attributes should firms be looking for in their telco partner? - Is the relationship between telco provider and customer changing? - What things need to happen to make next generation services a reality? - You say you want the supplier to change. Do you want to change too? - What is Telecoms 2.0?

Publisher:
ZDNet UK

Telecom 2.0: Mind over matter

ntl:Telewest Business believes that the role of the telco is evolving. Gone are the days when it was enough to simply focus on circuits and minutes, customers now need a far higher degree of interaction and look for suppliers who will talk business solutions with them.

Publisher:
ntl:Telewest Business

IBM Information Server Change Data Capture

In today's fast-paced world, access to real-time data has never been more important. To be successful, organizations need to be able to report and analyze corporate data quickly and easily, regardless of what applications created the data, what platform they're running on, or what database they're stored in.

Publisher:
IBM

An examination of server consolidation: the trends that can drive efficiencies and help businesses gain a competitive edge

This white paper provides a starting point for organizations contemplating server consolidation. It includes an overview of server consolidation concepts and techniques and provides guidance on methodologies. It also looks at the potential cost savings associated with server consolidation and offers information on how organizations can sustain the advantage they have gained by consolidating their servers.

Publisher:
IBM

Also on silicon.com

Site Navigation:

Switching White Papers

Feasibility of Detecting TCP-SYN Scanning at a Backbone Router

Quick Sitemap Links:

About Us

Search

Blogs

Verticals

Advertising Features

CNET Networks in Europe

CNET Networks in the United States

CNET Networks in Asia Pacific