From: Christoph Paasch <christoph.paasch@uclouvain.be>
To: Julian Kirsch <kirschju@sec.in.tum.de>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Christian Grothoff <christian@grothoff.org>
Subject: Re: Collecting data to demonstrate TCP ISN-based port knocking
Date: Thu, 15 May 2014 10:23:50 +0200 [thread overview]
Message-ID: <20140515082350.GC5287@cpaasch-mac> (raw)
In-Reply-To: <e322ab1d41b74aa093af558cf3f081f4@UCL-MBX03.OASIS.UCLOUVAIN.BE>
Hello,
On 14/05/14 - 21:55:36, Julian Kirsch wrote:
> some of you might remember the proposal of a patch which implements a
> variant of port-knocking that can be used to check the authenticity of
> arbitrary TCP connections and even can do integrity checking of TCP
> payload data by using a pre-shared key [0]. This patch, as well as a
> research paper describing its inner workings are available on
> gnunet.org under the name "Knock" [1].
>
> As Knock uses two fields in the TCP header in order to hide
> information and we explicitly want to be compatible with machines
> sitting in typical home networks, we need to make sure that this
> information doesn't get corrupted by the majority of NAT boxes out
> there. The lack of hard data on this also was one of the objections
> when the patch was submitted last time. We thus created a program
> which tests if Knock could work in your environment. It would be
> greatly appreciated if some of you were able to execute the program on
> their machines in order to help us to get an estimation of if Knock
> one day could be used in a large scale.
have you looked at
http://www.eecs.berkeley.edu/~sylvia/cs268-2014/papers/deploytcp-imc11.pdf ?
Michio started a second larger measurement campaign 2 years ago. You might ask
him if he has more data now.
Cheers,
Christoph
next parent reply other threads:[~2014-05-15 8:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <e322ab1d41b74aa093af558cf3f081f4@UCL-MBX03.OASIS.UCLOUVAIN.BE>
2014-05-15 8:23 ` Christoph Paasch [this message]
2014-05-14 21:55 Collecting data to demonstrate TCP ISN-based port knocking Julian Kirsch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140515082350.GC5287@cpaasch-mac \
--to=christoph.paasch@uclouvain.be \
--cc=christian@grothoff.org \
--cc=kirschju@sec.in.tum.de \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).