Citations: Security through IP Packet Filtering

26 citations found. Retrieving documents...

Chapman, B. D. Network (in)security through ip packet filtering. In Third USENIX UNIX Security Symposium (Baltimore, 1992), USENIX, pp. 63--76.

Home/Search Document Not in Database Summary Related Articles Check

This paper is cited in the following contexts:

First 50 documents

Firewalls: Security in Distributed Systems - Peri (2000) (Correct)

....of layer violation, the packet ltering is not purely a network layer security solution. The processing delay can trigger the retransmission timers. Finally, con guration of the rules might be a crucial task. Some of the common mistakes and problems in current technologies are described in article [CHAP92]. 2.3.2 Attacks defeated by packet lters The packet lter can avoid IP spoo ng attacks where packets received by router have changed IP source addresses. For example, if there is a secure host in company s network that only accepts tra c from particular internal computer. Then the attacker ....

Chapman, Brent, D. Network (In)Security Through IP Packet Filtering. Proceedings of the Third USENIX UNIX Security Symposium, Baltimore, MD, September 1992.

Transient Addressing for Related Processes: Improved.. - Gleitz, Bellovin (Correct)

....off if the relevant servers bound only to the the address they are serving. This is more a limitation of BSD, rather than TARP addressing, per se. The security concepts make no contributions to solving problems of inside threats, but this is a recognized limitation of firewalls in general ( Cha92] CB94] Our implementation cannot support more than a single TARP address per interface, and doing so would require extensive kernel modifications. This is for two reasons. First, when faced with an outgoing address decision, the kernel already knows which interface to use, and the ....

D. Brent Chapman. Network (in)security through IP packet filtering. In Proceedings of the Third Usenix UNIX Security Symposium, pages 63--76, Baltimore, MD, September 1992.

The Effects of the Transition to IPv6 on Internet Security - Nixu (Correct)

....only one likely to be examined by IDS or the firewall. Since later fragments are assumed to contain transport layer data, they are passed through without examination. This allows the attacker to sneak malicious datagrams without being noticed. For discussions on ill effects of fragmentation, see [3, 12, 20], IDS evasion mechanisms are discussed in [33] The IP header contains a Protocol field, which specifies the next header following IP. There is nothing to prevent this field from containing the code for IP itself, hence encapsulating one IP datagram within a payload of another, or even within ....

Chapman D. Brent, Network (In)Security Through IP Packet Filtering, Proceedings to the Third Usenix UNIX Security Symposium, 1992

The TAMU Security Package: An Ongoing Response to.. - Safford, Schales, Hess (1993) (10 citations) (Correct)

....To minimize this risk, both the filter and monitor are placed in a controlled access machine room and the monitor is configured for secure network access. The filter is similarly programmed only to respond to secure filter update requests, which are not routeable. Filter (drawbridge) Chapman [1] presented an interesting analysis of the limitations of current filter implementations at the Third UNIX Security Symposium. The drawbridge program, along with its support filter specification language and compiler, address some of his critical recommendations with respect to both functionality ....

....router as the firewall, the filtering function is moved from the router into drawbridge which acts as a bridging filter. Note, however, that figure 3 describes just a typical setup; a router is not a necessary component of a drawbridge configuration. Comparison to Other Filtering Methods Chapman [1] is an excellent source of information about packet filtering issues. He discusses the concepts behind packet filtering and some of the problems associated with it. He also discusses the problems with current implementations of packet filtering found in some current routing products. Some of these ....

[Article contains additional citation context not shown here]

D.B. Chapman. Network (In)Security through IP Packet Filtering, Proceedings of the Third UNIX Security Symposium, September 1992. (available from ftp.greatcircle.com as pub/pkt_filtering.ps.Z)

The TAMU Security Package: An Ongoing Response to Internet .. - David Safford Douglas (1993) (10 citations) (Correct)

The Interaction between SSH and X11 - Thoughts on the Security of .. - Flegel (1997) (Correct)

....users probably want to disable X forwarding on their own. This can be accomplished temporarily by calling SSH with the x option. That may be reasonable if the user is convinced that most of his remote SSH servers are secure and 16 For an introduction on how to set up packet filters see [WC94, CB94, Cha92, CZ95, SH95, GS96]. X access normally is indispensible. Security mechanisms offered by X clients should be activated (e.g. the Secure Keyboard option of xterm) Setting ForwardX11 to no in file .ssh config permanently protects the user s sessions. Users should always make sure all legitimately forwarded ....

D. Brent Chapman. Network (in)security through IP packet filtering. In Proceedings of the Third USENIX Unix Security Symposium, pages 63--76, Baltimore, MD, September 1992.

Flexible Internet Secure Transactions Based on Collaborative.. - Solana, Harms (1997) (1 citation) (Correct)

....at network level. The hierarchical structure of E mail addresses (in both SMTP [21] and X.400 [22] protocols) permits to stipulate domain based routing criteria. Furthermore, the notion of domain appears when a set of equipments or a private network need to be protected behind firewalls ( 23] [24]) or as a means to facilitate the deployment of access control policies ( 25] 26] 27] The architectural and naming aspects of a domain inside an organization have been extensively developed by M. Sloman [28] Consequently, in our work, we assume that the criteria to compose domains (for ....

D.B. Chapman. Network (in)security through IP packet filtering. Proceedings of the Third USENIX UNIX Security Symposium, pages 63-76, Baltimore, September 1992.

The TAMU Security Package: An Ongoing Response to Internet.. - David Safford (1993) (10 citations) (Correct)

Proper Care and Feeding of Firewalls - Muffett (1994) (Correct)

.... source and destination hosts (or networks) but it is also vitally important to note that the firewall s checking must be done against both ends of a connection, and must take into account the service port numbers at each end of the connection, otherwise the firewall may be trivially subverted[Cha92]. Connectionless protocols 2 like UDP cause so many headaches in this area that it is not uncommon for packet filtering firewalls to drop all UDP traffic, regardless of destination. This step appears exceptionally draconian at first glance, since it blocks access to some network services such ....

D. Brent Chapman. Network (In)Security through IP packet filtering. In Proceedings of the third USENIX Unix Security Symposium, 1992.

The TAMU Security Package: An Ongoing Response to.. - Safford, Schales, Hess (1993) (10 citations) (Correct)

The TAMU Security Package: An Ongoing Response to Internet.. - David Safford (1993) (10 citations) (Correct)

A Reference Model for Firewall Technology and its Implications .. - Lyles, Schuba (1996) (1 citation) (Correct)

....In particular, we are investigating what basic mechanisms need to be available in their supporting signaling protocols. 1.1 Previous Work The value of firewall technology has long been recognized. Several research papers describe the different approaches ( 2] 1] 14] 16] 21] 26] 10] [8], 13] and [4] In the past two years a few text books on the topic have been published ( 5] 23] and [9] Little has been published on firewall issues in connection oriented communication networks. In a standards contribution, Lyles ( 17] motivates the development of authenticated signaling ....

D. Brent Chapman. Network (In)Security Through IP Packet Filtering. In Proceedings of the Third USENIX UNIX Security Symposium, Baltimore, MD, September 1992. USENIX.

The TAMU Security Package: An Ongoing Response to Internet.. - David Safford (1993) (10 citations) (Correct)

Assessment of Packet Filter Technology - Seifert, Welch, Komisarczuk (2006) (Correct)

No context found.

Chapman, B. D. Network (in)security through ip packet filtering. In Third USENIX UNIX Security Symposium (Baltimore, 1992), USENIX, pp. 63--76.

Hardware Assisted Packet Filtering Firewall - Wasti (Correct)

No context found.

Chapman, D. B. (1992). Network (in)security through IP packet filtering. In Proceedings of the Third USENIX UNIX Security Symposium. 9

Support for Automated Passive Host-Based Intrusion Response - Gehani (2003) (Correct)

No context found.

D. Brent Chapman, Network (In)Security Through IP Packet Filtering, Third Usenix Security Symposium, September 1417, 1992, Baltimore, MD, pp. 63-76.

NIST Special Publication 800-7 - Computer Systems Security (Correct)

No context found.

D. Brent Chapman. Network (In)Security Through IP Packet Filtering. In USENIX Security Symposium III Proceedings, pages 63--76. USENIX Association, September 14-16 1992.

Performance Characteristics of BDD-Based Packet Filters - Attar (2001) (Correct)

No context found.

D. B. Chapman. Network (In)Security Through IP Packet Filtering. In Proceedings of the Third USENIX UNIX Security Symposium, pages 63--76, Baltimore, MD, September 1992.

Management by Delegation in ISDN-based Remote Access.. - Payer, Leitold, al. (Correct)

No context found.

Chapman, D. B. (1992) Network (In)security through IP Packet Filtering. Proceedings of the 3rd USENIX UNIX Security Workshop, pp. 63-76.

Keeping Your Site Confortably Secure: An introduction to.. - Wack, Carnahan (Correct)

No context found.

D. Brent Chapman. Network (In)Security Through IP Packet Filtering. In USENIX Security Symposium III Proceedings, pages 63--76. USENIX Association, September 14-16 1992.

First 50 documents

Online articles have much greater impact More about CiteSeer.IST Add search form to your site Submit documents Feedback

CiteSeer.IST - Copyright Penn State and NEC