Analysis of tunneled traffic

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F12%3APU101895" target="_blank" >RIV/00216305:26230/12:PU101895 - isvavai.cz</a>
Result on the web
<a href="http://6lab.cz/article/analysis-of-tunneled-traffic/" target="_blank" >http://6lab.cz/article/analysis-of-tunneled-traffic/</a>
DOI - Digital Object Identifier
—

Result language
angličtina
Original language name
Analysis of tunneled traffic
Original language description
Traditional firewall techniques usually permit traffic according to IP addresses or port numbers. More advanced firewalls inspect even packet's payload - e.g. http traffic. However, neither of these techniques is sufficient when dealing with IPv6 transition techniques. An attacker can easily avoid a security policy in a network by using one of many IPv6 transition techniques. Using Teredo as an example, the IPv6 traffic is encapsulated in UDP payload on high port numbers. Traditional firewall can't detect traffic inside the tunnel if the DPI of every UDP packet is not performed. Unfortunately, firewalls in current network equipment (Cisco, Juniper, HP ...) do not support this functionality. To make things worse, these firewalls are often used as borderfirewalls in enterprise networks. The presentation focuses on our monitoring solution of IPv6 transition techniques. The probe monitors network traffic and generates NetFlow statistics. The type of transition technique is enc
Czech name
—
Czech description
—

Project
<a href="/en/project/VG20102015022" target="_blank" >VG20102015022: Modern tools for detection and mitigation of cyber criminality on the New Generation Internet</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year
2012
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Similar results(10)