1. Term project for CS492 Difference of Security Hazard in wired/wireless 20020409 이찬희 20066057 장재혁

2. Table of Contents  Motivation  Project goal and Scope  Technical Problem  Methodology  Expected Results and Deliverable  Progress

3. Motivation 1.Collecting Information of topic 1 may cause illegal activities. 2.To observe the current condition of security hazard by hand in KAIST seems to be interesting.

4.  Actual numerical data of attacks in wired/wireless  Intruder’s different scanning techniques in wired/wireless Project goal and Scope 1. Goal 2. Scope Obtainable We can understand our current level of security hazard and difference of the level between wired and wireless through the data which will be got after measurement.

5. Technical Problem  Which software are we going to use? (Nmap, Iplog, …) - Since each software can run only in specific OS. -Most of those software run on the linux, but we are not much familiar with that.  Wireless : Many possible places with different network settings - Those environments may effect the result -> Sol) Talk with other teams that have the same subject and Choose different place ( Sampling ) - Also notebook should be safe from being steeled.

6. Methodology  Collecting data (By using specific software)  Wired : Computers in dorms/labs  Wireless : Pick places to experiment in school where our notebook will not be in stake.  Analyzing data  Learn to classify different type of attacks (research/study)  With the above knowledge, process the data  Compare the results of wired case and wireless case, and then conclude something.

7. Expected Results and Deliverable  Since UDP is simple and using port number more significantly than TCP, The percentage of UDP port scanning may be high.  Studying the scanning techniques and then by classifying the data, we can know which type of attack is dominant in both wired and wireless part.  Also we can realize the week points of current protocols in wired/wireless.

8. Progress(1)  사용할 Software : iplog - 포트 scanning 을 logging 하는 툴. - http://ojnk.sourceforge.net/http://ojnk.sourceforge.net/ - Linux, BSD 등에서 실행 가능. ( MS Window 버전은 없음. )  TCP 포트, UDP 포트 scanning, TCP null 스캔, FIN 스 캔,smurf 공격, Xmas 스캔, ping 플러딩, IP fragment 공 격 등을 감지.  procmisc 모드를 지원하여 같은 subnet 으로 들어오는 scanning 감지 및 OS 정보를 숨기기한 목적으로도 사용 가능.

9. Progress ( 2 : Setup )  프로그램 수행 컴퓨터 - Wired : 조원 계정으로 접속한 전산동아리 Haje 의 Server Computer. - Wireless : 수업에서 제공한 LapTop.  Pre-required to install Iplog - 1) flex : fast lex, 스캐너 ( 텍스트 패턴 인식기 ) 를 작성하는 도구. - 2) libcap : POSIX 1e. 능력을 가져오고 설정하는데 사용되는 라이브러리.  설치 방법 - (filename).tar.gz 을 받아 압축을 풀고 설치한다. (flex, libcap, iplog 순 ) # tar xvfz (filename).tar.gz # cd (filename) #./configure # make # make install - iplog 설치 시만 부가적으로 iplog.conf 에서 다음 2 가지를 수정한다. user nobody # default 는 iplog 사용자로 실행함 pid-file /var/run/iplog.pid # default 는 /var/run/iplog/iplog.pid 임

10. Progress ( 3 : 프로그램 실행 )  현재 상황. - 설치 후 실행 시 Logfile 경로 설정의 문제로 에러 발생.