This paper presents a critical analysis on the

This paper presents a critical analysis on the web packets’ provided for the intent.

1: Packages Overview

Hire a custom writer who has experience.
It's time for you to submit amazing papers!

order now

The tabular array below nowadayss a brief overview on the contents of the packages sequence provided

Packet Number


1 and 2

This is the typical Address Resolution Protocol ( ARP ) protocol that maps the MAC reference of the computing machine to its IP reference in the given web. This is necessary for the computing machine to place itself in a given web so as to enable communicating with another computing machine ( s ) targeted.

3 and 4

This is the phase where the beginning computing machine of IP reference purposes to reassign informations to another computing machine in the web The default port for the communicating is through 137 in this instance. The connexion nevertheless is non established as shown in the response package 4.

5 & A ; 6 and 7 & A ; 8

These sets of packages represent the scenario described for the packages 3 & A ; 4. A UDP protocol for informations transportation can non be established through port 137 between the pass oning computing machines.


In this package the computing machine is taking to set up connexion through one of its local ports ‘port 39886’ . As the above scope of ports usually fall under the IP-local port scope for surpassing traffic in Linux Operating System ( Ball and Duff, 2003 [ 1 ] ) , we can state that the computing machine is running Linux runing system.


The communicating in package 9 besides established a connexion to pass on through port 80 of the computing machine. The content of package 13 is simply the recognition from the port for communicating to a Windows platform mark computing machine.

11 to 14

This is communication packages sequence is the procedure of communicating established through IP local ports of the arising computing machine with IP reference

2: About the sequence of packages

Connectionless protocol

From the packages transfer sequence provided ( packages 3 to 8 ) it is apparent that the protocol used for communicating is the User Datagram Protocol ( UDP ) . This is a connexion less protocol ( Todd and Johnson, 2001 [ 2 ] ) which makes it clear that the information transferred is either portion of an earlier connexion established or the packages are sent independent of each other until the recognition is received from the recipient/target node.

One should appreciate that in instance of UDP protocol used for communicating at the conveyance bed of the TCP/IP protocol stack poses a important degree of security menace owing to the fact that a connexion is non established between the pass oning computing machines prior to informations transportation. This deficiency of connexion non merely poses security menace in footings of unauthorized entree to data communicating but besides the menace of confronting malicious information transferred to the target/originating computing machine by a adept hacker. The deficiency of handshaking to set up a connection-oriented communicating ( fig 1 ) that will end when the connexion is broken although airss a important degree of disadvantage, the usage of UDP protocol for transportation of big informations sections that are non sensitive is still prevailing over the Internet.

Fig 1: An illustration for the connection-oriented communicating utilizing TCP/IP.

The figure above is the conventional representation of the handshaking procedure for TLS ( Transport Layer Security ) protocol

( Source – Johnston, 2006 [ 3 ] , P.110 )

The usage of port 137 by the beginning computing machine to pass on with the mark computing machine besides leads us to infer that the arising computing machine is taking to garner the NetBIOS information of the mark computing machine. This procedure is usually similar to the DNS within a Microsoft Windows environment ( Conway, 2004 [ 4 ] ) . However, the connection-less attack utilizing the UDP protocol has prevented the aforementioned as either the platform/operating system between the computing machines vary or the mark computing machine treats the beginning as an attacker/un-authorised user. The ICMP response sent back to the arising computing machine reveals that the mark computing machine is non leting communicating through port 137 for a connection-less protocol. In other words a connexion must be established utilizing robust communicating protocol architecture at the conveyance bed prior to communicating. This is apparent from packages 9 to 14 where the communicating uses a connection-oriented attack with the TCP protocol as opposed to the UDP.

Port 80

The communicating in packages 9 to 14 besides reveal that the TCP protocol used purposes to pass on to the mark computing machine through the default incoming TCP communicating port. This makes it clear that the mark computing machine must be runing a web-service or related communicating architecture in order to provide for the request-response strategy for the connection-oriented conveyance bed protocol ( TCP ) .

The instance of port 80 besides reveals that the mark computing machine runing system utilises the standard communicating set-up for entrance and surpassing TCP packages that is common among Microsoft Windows Operating Systems. This farther makes it clear that the communicating to port 80 through port 39886 and 54955 of the beginning that the pass oning computing machines may be running on different runing systems. The above tax write-off is owing to the fact that port 80 is usually used for incoming and surpassing TCP packages in instance of the Microsoft Windows Platform whilst the usage of other surpassing ports for TCP packages is common in Linux platforms and besides in instance of dedicated applications that use specific communicating ports within the waiter computing machine. For case, the JobServer of the Business Objects Data Services XI R3 ( Business Objects, 2008 [ 5 ] , p2474 ) uses ports 3500 to 4000 or above in order to provide for petition response to the client computing machines in a given web. This is the default set-up for the application regardless of the platform on which it is running. As the endeavor calculating landscape of a given organisation must provide for diverse operating capablenesss, the instance of the computing machine utilizing port 39886 or 54955 possibly the demand of a specific web application running on the computing machine as opposed to the operating system itself. Hence the possibility of either the computing machine running on Linux platform is strong but non wholly certain.

3: Degree of Security of the Computer System

From the packages 3 to 8 the ICMP responses of failure to set up connexion may take to the decision that the computing machine is the victim of a discrepancy of the ICMP implosion therapy onslaught ( Johnston, 2006 ) . However, the fact that the computing machine stopped utilizing the UDP protocol for communicating after three efforts proves that the computing machine has a dependable degree of web security in topographic point to forestall such onslaughts.

The usage of port 80 to pass on to through another surpassing port poses the menace of the mark computing machine being the victim of port 80 onslaughts ( Bellamy, 2002 [ 6 ] ) . If this is the instance the arising computing machine does non hold a dependable agencies to observe the security breach therefore going vulnerable for client-side onslaughts on the waiter computing machine ( or arising computing machine ) . Alongside, it is besides indispensable to appreciate that the communicating to port 80 of the mark computing machine by airss the menace of typical TCP onslaughts like the Blind throughput decrease onslaught ( Johnston, 2006 ) , Blind Performance debasement onslaught Blind Connection-reset onslaught ( Conway, 2004 ) , Denial of Service ( DoS ) and Tiny Fragment Attacks ( Miller, 2001 [ 7 ] ) .

Although the above onslaughts are plausible on the beginning computing machine due to the use of the port 80 for communicating of the TCP protocol, counter-measures for each onslaught are published and implemented as portion of the protocol algorithms. Hence the exposure is significantly low but non wholly eliminated. This is because of the fact that a protocol is merely every bit strong as the following unhandled exposure that is identified by the hacker and left unhandled by the developer ( s ) .

John Carey (2006)<< >>In this short paper we are going to discuss

About the author : admin

Leave a Reply

Your email address will not be published.