Common Network Attacks

Network attacks that are directed by a hacker are called directed attacks. For example, a Win-
Nuke packet (generated by the WinNuke utility, discussed later in this chapter) sent by a hacker
to a specific machine is considered a directed attack. Viruses are traditionally not directed attacks. The virus is unknowingly copied from user to user. Viruses are some of the most prevalent attacks used on the Internet. In the following sections, we’ll discuss some of the techniques that hackers commonly use to attack a network. Then we’ll discuss some tools and procedures you can use to defend against them.
IP Spoofing
IP spoofing is the process of sending packets with a fake source address, pretending that the packet is coming from within the network that the hacker is trying to attack. The address can be considered stolen from the hacker’s target network. A router (even a packet-filtering router) is going to treat this packet as coming from within the network and will let it pass; however, a firewall can prevent this type of packet from passing into the secured network. Figure 8.6 shows
a hacker attempting an IP spoof. Notice that the hacker with the spoofed IP address is denied access to the network by the firewall.
The Ping of Death
The Ping of Death is a type of denial of service (DoS) attack. A DoS attack prevents any users,
even legitimate ones, from using the system. Ping is primarily used to see if a computer is responding to IP requests. Normally, when you ping a remote host, four normal-sized Internet
Control Message Protocol (ICMP) packets are sent to the remote host to see if it is available. In
a Ping of Death attack, a very large ICMP packet is sent to the remote host, whose buffer is flooded by this packet. Typically, this causes a system to reboot or hang. Patches to prevent a
Ping of Death attack from working are available for most operating systems.
SYN Flood
A SYN flood is also a DoS attack because it can barrage the receiving machine with dozens of meaningless packets. In normal communications, a workstation that wants to open a TCP/IP communication with a server sends a TCP/IP packet with the SYN flag set to 1. The server auto
matically responds to the request, indicating that it is ready to start communicating. Only new communications use SYN flags. If you are in the middle of a file download, SYNs are not used. A new SYN packet is used only if you lose your connection and must reestablish communications.
To initiate a SYN flood, a hacker sends a barrage of SYN packets. The receiving station normally can’t help itself and tries to respond to each SYN request for a connection. The receiving device soon expends its resources trying to reply, and all incoming connections are rejected until all current connections can be answered. The victim machine cannot respond to any other requests because its buffers are overfilled, and it therefore rejects all packets, including valid requests for connections. Patches that can help with this problem are available for the various network operating systems.

Reset the Network Interface Card NIC

Before you factory reset the NIC, we recommend that you print a configuration page

To reset the NIC please follow the instructions below :

Via The Test Switch (if applicable)

If your printer has a test switch perform the following steps :

1. Switch on the printer.
2. Locate the NIC.
3. Locate the TEST switch at the rear of the NIC.
4. Press and hold down the TEST switch fo up to 20 seconds.
5. The NIC has reset when the LEDs stop flashing and then start to flash again.
6. Please note that the LEDs only flash if the print server is connected to a live Ethernet network.

Via The Bradmin Profesional Application Software

You can also factory reset the NIC using the BRAdmin Professional application, to do this follow these steps :

For BRAdmin Professional ver.2.xx Users>

1. Start the BRAdmin Professional utility, by clicking Start => All Programs or Programs => Brother Administrator Utilities => Brother BRAdmin Professional Utilities => BRAdmin Professional.
2. From the main BRAdmin screen double click the appropriate printer.
3. Enter the NIC password (The default password is "access").
4. Click the Control tab
5. Click the Restore Factory Defaults button
6. Click the OK button when you have read the warning message.
7. The NIC will then reset back to its default values.
   

For BRAdmin Professional ver.3.xx Users

1. Start the BRAdmin Professional utility, by clicking Start => All Programs or Programs => Brother Administrator Utilities => Brother BRAdmin Professional 3 => BRAdmin Professional 3.
2. From the main BRAdmin screen double click the appropriate machine.
3. Enter the NIC password (The default password is "access").
4. Click Network Configuration tab, Control Panel and select Set Default.
5. Click on Submit button.
6. The NIC will then reset back to its default values.
   

Via a Web Browser

Because web based management requires the TCP/IP protocol for communication, any reset option you see when managing the printer with a web browser will not reset the IP address details. If you wish to totally reset all the NIC parameters we recommend you reset the NIC using the TEST button or by using the BRAdmin application.

To reset the NIC (excluding TCP/IP parameters) follow these steps :

1. Connect to the NIC using a web browser.
2. Click the "Network Configuration" page or the "Properties" page.
3. Enter the NIC password (the NIC password is detailed in the user guide for the NIC) if applicable.
4. Click the "Set Default" link or press the "Restore Settings" button.
   

Via The Prineter Control Panel (only for HL-5000/HL-5100 series Users)

1. Switch off the Printer.
2. Make sure that the front cover is closed and the power cord is plugged in.
3. Hold down the Go button as you switch the printer on. All the LEDs light up. Keep the button pressed down until the Toner LED lights. When the Toner LED lights, release the GO button.
4. Hold down the Go button until the Yellow Status LED lights. When the status LED lights, release the Go button.
5. When all the LEDs light, the printer will start warming up. The NIC has now been reset to its factory defaults.
   

Via The Prineter Control Panel (only for HL-8050N/HL-2700CN Users)

1. Turn off the printer.
2. Hold down the + button as you turn on the power switch. Keep the button pressed until the LCD displays shows --MENU-- on the top row.
3. The NIC has been reset to its default factory settings.
   

Network Characteristics

The following characteristics should be considered in network design and ongoing maintenance:
Cost
Includes the cost of the network components, their installation, and their ongoing maintenance.
Security
Includes the protection of the network components and the data they contain and/or the data transmitted between them.
Speed
Includes how fast data is transmitted between network end points (the data rate).
Topology
Describes the physical cabling layout and the logical way data moves between components.
Scalability
Defines how well the network can adapt to new growth, including new users, applications, and network components.
Reliability
Defines the reliability of the network components and the connectivity between them. Mean time between failures (MTBF) is a measurement commonly used to indicate the likelihood of a component failing.
Availability
Measures the likelihood of the network being available to the users, where downtime occurs when the network is not available because of an outage or scheduled maintenance. Availability is typically measured in a percentage based on the number of minutes that exist in a year. Therefore, uptime would be the number of minutes the network is available divided by the number of minutes in a year.
Network classification
The following list presents categories used for classifying networks.
Connection method
Computer networks can also be classified according to the hardware and software technology that is used to interconnect the individual devices in the network, such as Optical fiber, Ethernet Card, Wireless LAN, HomePNA, or Power line communication.
Ethernet uses physical wiring to connect devices. Frequently deployed devices include hubs, switches, bridges and/or routers. Wireless LAN technology is designed to connect devices without wiring. These devices use radio waves or infrared signals as a transmission medium.
Scale
Based on their scale, networks can be classified as Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Personal Area Network (PAN), Virtual Private Network (VPN), Campus Area Network (CAN), Storage Area Network (SAN), etc.
Functional relationship (network architecture)
Computer networks may be classified according to the functional relationships which exist among the elements of the network, e.g., Active Networking, Client-server and Peer-to-peer (workgroup) architecture.
Network topology
Computer networks may be classified according to the network topology upon which the network is based, such as bus network, star network, ring network, mesh network, star-bus network, tree or hierarchical topology network. Network topology signifies the way in which devices in the network see their logical relations to one another. The use of the term "logical" here is significant. That is, network topology is independent of the "physical" layout of the network. Even if networked computers are physically placed in a linear arrangement, if they are connected via a hub, the network has a Star topology, rather than a bus topology. In this regard the visual and operational characteristics of a network are distinct; the logical network topology is not necessarily the same as the physical layout. Networks may be classified based on the method of data used to convey the data, these include digital and analog networks.
Network Components
Applications, which enable users to perform various tasks, make up a key component
of networking. Many applications are network-aware, allowing you to access and use resources that are not located on your local computer. While the number of networking applications ranges in the thousands, some of the more common networking applications include e-mail applications for sending mail electronically, File Transfer Protocol (FTP) applications for transferring files, and web applications for providing a graphical representation of information.
Protocols are used to implement applications. Some protocols are open standard, meaning that many vendors can create applications that can interoperate with each other, while others are proprietary, meaning that they work only with a particular application. Common protocols used on the Internet are Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol version 4 (IMAP4), and Post Office Protocol 3 (POP3), which implements e-mail applications such as Sendmail and Microsoft Exchange; File Transfer Protocol (FTP), which implements file
transfer programs such as FTP Explorer, Cute FTP, and WSFTP; and Hypertext Transfer Protocol (HTTP), which implements web browsing applications such asInternet Explorer and Firefox and web server applications such as Microsoft Internet Information Services (IIS) and Apache.
Some applications, such as e-mail, require little bandwidth, while others, such as backup software, video software, and file transfer software, require a lot. Some applications operate in real-time, such as voice over IP (VoIP) and video; some operate interactively, such as instant messaging or database queries; and some operate in a batch mode, requiring little user interaction. Today’s networks need to accommodate all these different types of resources and applications, including their specific requirements such as bandwidth for large transfers or minimal delay and latency for VoIP and video. Quality of service (QoS) features are commonly used to meet these requirements.