Chapter 6
Reinforcement
Problem R-6.1
Describe the main purpose of DNS.
Problem R-6.2
Suppose the transaction ID for DNS queries can take values from 1 to 65,536 and is randomly
chosen for each DNS request. If an attacker sends 1,024 false replies per request, how many
requests should he trigger to compromise the DNS cache of the victim with probability
99%?
Problem R-6.7
Explain how a stateless firewall would block all incoming and outgoing HTTP requests.
Problem R-6.15
Explain why deep packet inspection cannot be performed on protocols such as SSL and
SSH.
Creativity
Problem C-6.6
Explain how it would give a potential intruder an additional advantage if he can spend a
week stealthily watching the behaviors of the users on the computer he plans to attack.
28
Problem C-6.12
The coupon collector problem characterizes the expected number of days that it takes to
get ncoupons if one receives one of these coupons at random every day in the mail. This
number is approximately nln n. Use this fact to compare the number of TCP connections
that are initiated in a sequential port scan, going from port 1 to 65535, directed at some
host, to the expected number that are requested in a random port scan, which requests a
random port each time (uniformly and independently) until it has probed all of the ports.
Problem C-6.13
Describe a modification to the random port scan, as described in the previous exercise, so
that it still uses a randomly generated sequence of port numbers but will now have exactly
the same number of attempted TCP connections as a sequential port scan.
29