connection from the session to an evil host. The problem is that conventional TCP exchanges do not require any authentication or confirmation that they are the actual hosts involved in a previously established connection. After a session has been established between two hosts, those hosts use the following to reconfirm the corresponding host:

●IP number. The established IP numbers of the hosts must not change.

●Port numbers. Most protocols communicate between established ports only; ports do not change.

●Sequence numbers. Sequence numbers must change predictably in respect to the ISN and the aggregate number of bytes sent from one host to another.

●Acknowledgement numbers. Acknowledgement numbers must change in respect to delivered sequence numbers and aggregate bytes acknowledged from one host to another.

If a hostile user can observe data exchanges and successfully intercept an ongoing connection with all the authentication parameters properly set, he can hijack a session. Imagine the damage that can be done if this hijacked session is one that has root authority. Many complications and considerations are involved in session hijacking. It is not a trivial endeavor, but it is made simpler using the Hunt software.

Summary

A vast and growing number of security tools are at your disposal.You have many tool choices when it comes to monitoring your network. When you decide which tool to use, make sure that the tool provides at least the level of detail that TCPdump offers. Admittedly, TCPdump does not provide especially aesthetic output, but it does give the required amount of detail to make intelligent assessments about traffic activity. If you select a tool that is easier on the eye, but lighter on content, you might not get the whole story.

TCP is the protocol used for applications that require reliable delivery. TCP exchanges follow a prescribed architecture of session establishment, possible data transfer, and session termination, replete with all the mechanisms to ensure delivery and receipt of data. When you observe TCP activity with TCPdump, you can delve into the details, if desired or necessary, or you can observe broader patterns and make more general assessments of the type of activity that has transpired.

TCP is a very robust protocol, and it has been robustly mutated for malicious uses. Carefully analyze it for the unexpected when monitoring TCP activity. As Intrusion Detection Systems (IDSs) and firewalls become more sophisticated in function, so do the hackers' efforts to circumvent detection and shunning. It is important for an intrusion analyst to have a good understanding of TCP, and TCPdump is an excellent instructional tool.

Chapter 3. Fragmentation

At different times, attackers use fragmentation both to mask and facilitate their probes and exploits. Some intrusion-detection systems and packet-filtering devices do not support packet