Chapter 4,

Summary of Abnormal Stimuli

You see that there are many variations of abnormal activity. Different types of abnormal activity have different purposes. Some try to evade the vigilant eye of NIDS or circumvent filtering. Others are blatantly hostile because they attempt a denial of service against a target host.

You must also be aware that sometimes what you might perceive to be hostile activity is actually a response from a host responding to your spoofed addresses. Finally, programs, such as nmap, use unique stimuli to elicit responses with identifying characteristics of the target operating system

Summary

As far as expected responses are concerned, remember there are no absolutes. Not every operating system's TCP/IP stack is from the same mold shaped by a set of identical defining RFCs. Some operating systems do not follow the RFCs' expected behavior. This does not necessarily indicate some kind of mutant response. This is more a reflection of a lack of standardization.

There is a very important point to learn from stimulus-response theory. A common knee-jerk reaction from observing traffic that appears to be some kind of scan or repeated activity directed against your network is to jump to the immediate conclusion that you are under attack from the source IP. You are likely to label the source IP as the aggressor. Take a moment and think before you automatically make such an assessment. Granted, many times you will be correct. But, think about the possibility that this was an elicited response. (There might have even been some kind of catalyst to which the alleged aggressor is responding.) For instance, your source IPs might have been spoofed. This concept is easy to assimilate in theory, but hard to remember in practice.

Conversely, when you get some kind of response activity, such as an unsolicited ICMP echo reply, it is very possible that the source host is indeed the aggressor. As discussed in

the Tribe Flood Network (TFN) attack uses an ICMP echo reply as the communication vehicle between the master and daemons to launch or control a distributed denial of service (DDoS) attack. If you have any doubt about observed activity, the best advice is to examine the entire captured datagram and scrutinize the header fields and payload for anomalies.You have to adopt the attitude that nothing is predictable all the time when you examine network traffic.

Chapter 6. DNS

Why devote an entire chapter to DNS? Isn't DNS used to translate a host name to an IP address and that's about it? Sure, that is a big and important part of DNS, but DNS is much more.

DNS servers are probably one of the most common targets of reconnaissance and exploit efforts. Your DNS server is a cherished prize for a hacker to compromise, so hackers are going to see how vulnerable it is by pounding on it for weaknesses. DNS servers are targeted for the following reasons: