CTCP: Centralized TCP Router

Faculty: Tzi-cker Chiueh

Group Members:

Project Description:

Many solutions to network security problems can be more easily developed in a centralized TCP (CTCP) architecture, in which an organization's edge router transparently proxies every TCP connection between an internal host and an external host on the Internet. This project designs and implements two CTCP router prototypes, one inside the Linux kernel and the other at the user space. By responding to probe packets directly, the CTCP router thwarts all OS fingerprinting attempts. By redirecting traffic targeting at non-existing hosts or non-open-to-public ports to a CTCP socket, the CTCP router defeats most port-scanning attempts. By interacting with remote hosts that attempt to connect to non-existent hosts or ports, the CTCP router is able to identify attacking hosts. By further checking payloads inside packets coming from supposedly attack hosts, the CTCP router can actually indetify buffer overflow attacks in real time. Finally, the CTCP router solves the TCP connection hijacking problem by introducing an additional check on the sequence number field of incoming packets.

Motivation:

Following are some of the major motivations for the CTCP architecture -

Results:

On a 1.1Ghz Pentium-3 machine with giagbit Ethernet interfaces, the throughput of the kernel-based CTCP router is 420.3 Mbits/sec, whereas the throughput of a generic Linux router on the same hardware is only 409.1 Mbits/sec when providing all the protection the CTCP router is designed for.

Publication:

Related Work:

Last modified: 8/11/04