MonNet – a project for network and traffic monitoring Detection of malicious Traffic on Backbone Links via Packet Header Analysis Wolfgang John and Tomas Olovsson Department of Computer Science and Engineering Chalmers University of Technology Göteborg, Sweden

TNC 2008 Introduction Traffic filtering is often done locally Backbone provides broader view What is happening „in the wild“? –Old, well known attack types? –Distributed attacks to several hosts/networks? –What to expect on ingress hosts? How good is pure packet header analysis?

TNC 2008 Introduction: Outline 1.Packet headers considered Fields and potential problems 2.Dataset Measurement location Transport protocol breakdown 3.Anomalies observed IP (+fragmentation), TCP, UDP, ICMP Discussion and highlights 4.Summary and Conclusions

TNC 2008 Packet Headers IP header structure

TNC 2008 Packet Headers (2) TCP header structure

TNC 2008 Packet Headers (3 ) UDP header structure ICMP header structure

TNC 2008 Outline (2) 1.Packet headers considered Fields and potential problems 2.Dataset Measurement location Transport protocol breakdown 3.Anomalies observed IP (+fragmentation), TCP, UDP, ICMP Discussion 4.Summary and Conclusions

TNC 2008 Dataset: Measurement location Internet Regional ISPs Göteborg Stockholm Other smaller Universities and Institutes Göteborgs Univ. Student- Net 2x 10 Gbit/s (OC-192) capturing headers only IP addresses anonymized 554 traces in late min. intervals during 3 months Chalmers Univ.

TNC 2008 Dataset (2) Transport protocol breakdown CAIDA‘s DatCat: SUNET fall IP Original Datagram IP Segment 1 IP Segment 2 IP Segment 3 IP Seg. 4 Fragment 1 Fragment 2 Fragment 3 Fragment 4 Fragment Series

TNC 2008 Outline (3) 1.Packet headers considered Fields and potential problems 2.Dataset Measurement location Transport protocol breakdown 3.Anomalies observed IP (+fragmentation), TCP, UDP, ICMP Discussion 4.Summary and Conclusions

TNC 2008 Anomalies observed IP header anomalies Two intervals with one million packets to four destinations Source IP of private class C ( /16) ICMP echo replies, 228 bytes DoS attack? No exploits of IP source route Land attack

TNC 2008 IP fragmenation inconsistencies IP ID values of zero are over-represented! one host inside a University five campaigns to five destinations with series of 6-7 fragments Iterating over entire port range half of the series with inconsistencies (holes etc.) hijacked host performing DoS (Frag attack!) 42 hosts are the main target 1/5 of all fragment series to these hosts are incomplete many gaps only 8 byte long! DDoS? Or just packet loss? 35 different times and different hosts! Not only overlaps, but also gasp Overlapping fragments fill gaps – on wrong places! 8 – 48 bytes overlapping fragments on consistent offsets Hardware/Software error? Common attack tool? Anomalies observed (2) Good news: Ping-of-death, sPing, IceNewk etc. not observed!

TNC 2008 Anomalies observed (3) TCP header anomalies Two or more field anomalies within the same TCP header 21 % in RST/ACK packets from port % in SYN/ACK packets …. SYN/ACK attacks? source and desination ports of zero equally shared mainly SYN packets in host scanning campaigns Mahoney et al: FIN without ACK can reveal port-sweeps Not supported by our data!! Mainly to P2P ports – pure FIN after SYN connection attempts

TNC 2008 Anomalies observed (4) UDP header anomalies From UDP port zero: around 30 scanning campaigns of /24 ranges to port numbers 1025 and 1026 Windows messenger spam!

TNC 2008 Anomalies observed (5) ICMP header observations two hosts sending 46 million “host redirects” during 12 days DoS attacks like Winfreez

TNC 2008 Anomalies observed (6) ICMP header observations contd. –No Ping-of-Death type attacks –No obvious attack with ICMP dest. unreachable (Smack) –No ICMP timestamp attacks (like moyari13) –No large scale usage of invalid ICMP types (Twinge or Trash attacks)

TNC 2008 Outline (4) 1.Packet headers considered Fields and potential problems 2.Dataset Measurement location Transport protocol breakdown 3.Anomalies observed IP (+fragmentation), TCP, UDP, ICMP Discussion 4.Summary and Conclusions

TNC 2008 Summary and Conclusions Systematic listing of header anomalies Occurences in real backbone traffic Many old attacks still out there –but some formerly popular attacks vanished Constant ”noise” of anomalous packets Some major campaigns of malicious activities detected

TNC 2008 Summary and Conclusions (2) Pure packet header analysis reveals a substantial amount of malicious activity Watch out for –IP ID of zero –port numbers of zero –Strange TCP flags –Reserved IP addresses –Unusual ICMP activity

TNC 2008 Summary and Conclusions (3) Next steps –Study potential of IP ID, SEQ and ACK numbers and port numbers for detection –Get access to payload data / broadcast addr. Anomalous applications headers? Malicious code? –Correlate packets (flows) Scannings, DDoS campaigns? What happens before? After?....

MonNet – a project for network and traffic monitoring More Information: or Questions?