Borman, D., Editor, "Telnet Linemode Option", RFC 1116, Cray Research, August 1989.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....the monitor s analysis load, and or to generate a huge number of false positives, in order to mask a true attack. Three possible filtering criteria for backdoor detection are: Packet size. Keystroke packets are quite small. Even when entire lines of input are transferred using line mode [Bo90], packet payloads will tend to be much smaller than used for bulk transfer protocols. Therefore, by filtering packets to only capture small packets, the monitor can significantly reduce its packet capture load. Directionality. In general, an interactive connection such as Telnet is initiated ....

D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, Oct. 1990.

....client modified to send a large number of do nothing Telnet options along with each keystroke or line of input. The main likely filtering criteria for stepping stone detection is packet size. Keystroke packets are quite small. Even when entire lines of input are transferred using line mode [Bo90], packet payloads tend to be much smaller than those used for bulk transfer protocols. Therefore, by filtering packets to only capture small packets, the monitor can significantly reduce its packet capture load (for example, by weeding out heavy bulk transfer SSH sessions while keeping interactive ....

D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, Oct. 1990.

....the monitor s analysis load, and or to generate a huge number of false positives, in order to mask a true attack. Three possible filtering criteria for backdoor detection are: ffl Packet size. Keystroke packets are quite small. Even when entire lines of input are transferred using line mode [Bo90], packet payloads will tend to be much smaller than used for bulk transfer protocols. Therefore, by filtering packets to only capture small packets, the monitor can significantly reduce its packet capture load. 2 ffl Directionality. In general, an interactive connection such as Telnet is ....

D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, Oct. 1990.

....client modified to send a large number of do nothing Telnet options along with each keystroke or line of input. The main likely filtering criteria for stepping stone detection is packet size. Keystroke packets are quite small. Even when entire lines of input are transferred using line mode [Bo90], packet payloads tend to be much smaller than those used for bulk transfer protocols. Therefore, by filtering packets to only capture small packets, the monitor can significantly reduce its packet capture load (for example, by weeding out heavy bulk transfer SSH sessions while keeping interactive ....

D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, Oct. 1990.

....in packets. One generally assumes that each TELNET originator packet conveys one byte of user data, corresponding to a keystroke. Often, however, a packet carries more than one byte, either due to effects of the Nagle algorithm [N84] or because the TELNET connection is operating in line mode [B90] or line at a time mode [PR83, S94] For example, the LBL PKT 2 TELNET originator traffic comprised about 85,000 packets carrying 139,000 user data bytes. Given these difficulties, we attempted to fit the observed TELNET connection sizes (in packets) with another simple analytic distribution. We ....

D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, October, 1990.

No context found.

Borman, D., Editor, "Telnet Linemode Option", RFC 1116, Cray Research, August 1989.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC