Reference Material

1
1
Network Traffic Analysis
Using tcpdump
Judy Novak
Judy Novak
Johns Hopkins University Applied Physics Laboratory

Reference Material
All material Copyright  Novak, 2000, 2001. All rights reserved.
2
2
References
This page intentionally left blank.
3
3
Reference Material
W. Richard Stevens, TCP/IP Illustrated, Volume 1 The
Protocols, Addison-Wesley
Eric A. Hall, Internet Core Protocols
, O’Reilly
Craig H. Rowland, “Covert Channels in the TCP/IP Protocol Suite”,
www.psionic.com/papers/covert/covert.tcp.txt
Ofir Arkin, “ICMP Usage in Scanning”, www.sys-security.com
Fyodor, “Remote OS detection via TCP/IP Stack FingerPrinting”
www.insecure.org/nmap/nmap-fingerprinting-article
Thomas Ptacek, Timothy Newsham, “Insertion, Evasion, and Denial of Service:
Eluding Network Intrusion Detection”, www.robertgraham.com/
mirror/Ptacek-Newsham-Evasion-98.html
Rain Forest Puppy, “A look at whisker’s anti-IDS tactics”, www.wiretrip.net/rfp
This page intentionally left blank.

4
4
Referenced Links
•
www.nswc.navy.mil/ISSEC/CID
Site to obtain Shadow software
•
www.map2.ethz.ch/ftp-probleme.htm
Site for list of initial TTL’s by operating system and protocol
•
www.phrack.com
Site to find out more about the loki exploit
•
ftp.su.se/pub/security/security/tools/net/tcpshow
Site to download source code for tcpshow
•
www.cisco.com/warp/public/770/nifrag.shtml
Site to read about a particular denial of service using
fragmentation against Cisco routers
This page intentionally left blank.
5
5
Referenced Links
•
www.cert.org/advisories
Site to read about CERT advisory concerning an inverse
query exploit, ToolTalk exploit
•
ftp.isi.edu/in-notes/iana/ assignments/
Information about protocols, reserved address spaces

•
ftp.ee.lbl.gov/tcpdump.tar.Z
ftp.ee.lbl.gov/libpcap.tar.Z
netgroup-serv.polito.it/windump
netgroup-serv.polito.it/winpcap
www.tcpdump.org
Sites for tcpdump and support software
•
www.whitefang.com/rin
Site for article on “Raw IP Networking FAQ”
This page intentionally left blank.