Re: TCP/IP skills

From: vulnerable (vulnerable_at_gmail.com)
Date: 07/09/04

  • Next message: Rocky Heckman: "RE: TCP/IP skills" 
    Date: Thu, 8 Jul 2004 19:33:37 -0400
To: pen-test@securityfocus.com

    I'm more interested in what should be classified as 'in-depth
    knowledge' of TCP/IP. You mentioned 3way handshake which seems as an
    intermediate level at best.

    IMO, advanced would be knowing what information belongs at what offset
    in a particular packet or knowing that a certain hex value represents
    a certain combination of flags. I myself have a hard time just
    remembering that TCP is protocol 6.

    But not to get sidetracked (long day, sorry) I think its a given that
    you should at the very least understand the functionality of TCP/IP.
    Things such as threeway handshakes, tcp vs udp, addresses, ports, NAT
    etc. Without this foundation your simply checking boxes in a program
    over and over until you get the results your hoping for..

    And to be longwinded, a few people asked where to find tutorials or
    books. Too at least get a basic foundation I'd recommend looking at
    material regarding the cisco CCNA exam (a free one was recently
    released as .doc by a professor), googling and following .edu links,
    or picking up any security book- the majority of them tend to touch on
    such things. Or if your hardcore, pick up Stevens book "TCP/IP
    Illustrated, VOL 1".

    On Tue, 6 Jul 2004 21:20:46 -0400 (EDT), Don Parker
    <dparker@rigelksecurity.com> wrote:
    > Hello all, I just wanted to comment on what I see as a rather alarming trend in the
    > security industry today. More and more many are becoming reliant upon tools to do their
    > job whilst they ignore core components of their skillset. Specifically in this case an
    > in-depth knowledge of TCP/IP.
    >
    > Knowing TCP/IP at a granular level in my opinion is very much a core skill that must be
    > attained by anyone who wishes to have a successful career in the network security
    > industry today. One cannot become adept by simply using tools, and never knowing how to
    > interpret the output by verifying the packets themselves.
    >
    > It constantly amazes me when I teach a TCP/IP Analysis course that people who are
    > presently in the industy do not know of such basic TCP/IP concepts as the 3 way
    > handshake and how ICMP works. That or being able to wholly dissect a packet and explain
    > the relationships between various metrics.
    >
    > I would be curious to hear of your opinions on this?
    >
    > Cheers,
    >
    > Don
    >
    > -------------------------------------------
    > Don Parker, GCIA
    > Intrusion Detection Specialist
    > Rigel Kent Security & Advisory Services Inc
    > www.rigelksecurity.com
    > ph :613.233.HACK
    > fax:613.233.1788
    > toll: 1-877-777-H8CK
    > --------------------------------------------
    >

  • Next message: Rocky Heckman: "RE: TCP/IP skills"

    Relevant Pages

    • FW: TCP/IP skills
      ... knowing what you want is another of those skills that comes from a greater understanding of security as it applies to network traffic as well as operating system/service stimulus and responses. ... Subject: TCP/IP skills ...
      (Pen-Test)
    • Re: Rather funny; looks like page defacement to me
      ... An admin who doesn't know TCP/IP? ... trained on networking and TCP/IP, security, etc. ... of those poor "draftees" how to protect their enterprise. ... Adjunct Information Security Officer ...
      (Focus-IDS)
    • Re: REVIEW: "Network Security for Dummies", Chey Cobb
      ... Hack Proofing Your Network: ... TCP/IP Illustrated Volume I: ... was compromised in numerous attacks in 2000 and 2002, ... A couple of books I'm thinking of getting are "Network Security Assessment" by ...
      (comp.security.misc)
    • Re: TCP/IP skills
      ... I have taken a few security courses, and have been using Unix for about ... knowledge of TCP/IP. ... >security industry today. ... That or being able to wholly dissect a packet and explain ...
      (Pen-Test)
    • Re: Rather funny; looks like page defacement to me
      ... Unfortunately this message seems to indicate that I said that sysadmins who ... What I said in the first place is that foisting IDS systems are ... An admin who doesn't know TCP/IP? ... trained on networking and TCP/IP, security, etc. ...
      (Focus-IDS)