Chapter 5
Reinforcement
Problem R-5.5
Can two network interfaces have the same IP address? Why or why not?
Solution Because of NAT, it is possible to have two network interfaces with the same IP
Creativity
Problem C-5.3
Show how to extend the man-in-the-middle attack described in Section 5.2.3 to intercept
all documents sent to a printer in a local-area network.
Solution Eve performs the man-in-the middle attack on multiple users and the network
Problem C-5.4
Suppose you suspect that your session with a server has been intercepted in a man-in-the-
middle attack. You have a key, K, that you think you share with the server, but you might
be only sharing it with an attacker. But the server also has a public key, KP, which is widely
known, and a private secret key, KS, that goes with it. Describe how you can either confirm
you share Kwith the server or discover that you share it only with a man-in-the-middle.
Also, be sure your solution will not be discovered by a packet sniffer.
Solution Ask the server to digitally sign your shared key, K, using his private key, KS,
Problem C-5.6
Describe a data structure for keeping track of all open TCP connections for a machine. The
data structure should support efficiently adding and deleting connections and searching by
host, source port, and destination port.
25
Problem C-5.7
Most modern TCP implementations use pseudo-random number generators (PRNG) to
determine starting sequence numbers for TCP sessions. With such generators, it is difficult
to compute the ith number generated, given only the (i−1)st number generated. Explain
what network security risks are created if an attacker is able to break such a PRNG so that
he can in fact easily compute the ith number generated, given only the (i−1)st number
generated.
Solution First, the attacker initiates a TCP connection to the server to get a sequence
Problem C-5.10
You are the system administrator for a provider that owns a large network (e.g., at least
64,000 IP addresses). Show how you can use SYN cookies to perform a DOS attack on a
web server.
Solution The rogue administrator initiates a large number of TCP connections to the
web server spoofing source IP addresses from his network. Also, he intercepts the SYN-
Problem C-5.11
Show how to defend against the DOS attack of Exercise C-5.10.
Problem C-5.12
Describe how to modify a NAT router to prevent packets with spoofed IP addresses from
exiting a private network.
26
Problem C-5.15
Johnny just set up a TCP connection with a web server in Chicago, Illinois, claiming he
is coming in with a source IP address that clearly belongs to a network in Copenhagen,
Denmark. In examining the session logs, you notice that he was able to complete the three-
way handshake for this connection in 10 milliseconds. How can you use this information to
prove Johnny is lying?