TY - GEN
T1 - ONIS
T2 - 2018 IEEE Conference on Computer Communications, INFOCOM 2018
AU - Zhang, Xu
AU - Knockel, Jeffrey
AU - Crandall, Jedidiah R.
N1 - Funding Information:
IX. ACKNOWLEDGMENTS We would like to thank the anonymous reviewers and Antonio Espinoza for valuable feedback. We would like to thank Ben Edwards for helpful discussions about Akaike information criterion. This material is based upon work supported by the U.S. National Science Foundation under Grant Nos. #1518523, #1518878.
Publisher Copyright:
© 2018 IEEE.
PY - 2018/10/8
Y1 - 2018/10/8
N2 - We present ONIS, a new scanning technique that can perform network measurements such as: inferring TCP/IP-based trust relationships off-path, stealthily port scanning a target without using the scanner's IP address, detecting off-path packet drops between two international hosts. These tasks typically rely on a core technique called the idle scan, which is a special kind of port scan that appears to come from a third machine called a zombie. The scanner learns the target's status from the zombie by using its TCP/IP side channels. Unfortunately, the idle scan assumes that the zombie has IP identifiers (IPIDs) which exhibit the now-discouraged behavior of being globally incrementing. The use of this kind of IPID counter is becoming increasingly rare in practice. Our technique, unlike the idle scan, is based on a much more advanced IPID generation scheme, that of the prevalent Linux kernel. Although Linux's IPID generation scheme is specifically intended to reduce information flow, we show that using Linux machines as zombies in an indirect scan is still possible. ONIS has 87% accuracy, which is comparable to nmap's implementation of the idle scan at 86%. ONIS's much broader choice of zombies will enable it to be a widely used technique which can fulfill various network measurement tasks.
AB - We present ONIS, a new scanning technique that can perform network measurements such as: inferring TCP/IP-based trust relationships off-path, stealthily port scanning a target without using the scanner's IP address, detecting off-path packet drops between two international hosts. These tasks typically rely on a core technique called the idle scan, which is a special kind of port scan that appears to come from a third machine called a zombie. The scanner learns the target's status from the zombie by using its TCP/IP side channels. Unfortunately, the idle scan assumes that the zombie has IP identifiers (IPIDs) which exhibit the now-discouraged behavior of being globally incrementing. The use of this kind of IPID counter is becoming increasingly rare in practice. Our technique, unlike the idle scan, is based on a much more advanced IPID generation scheme, that of the prevalent Linux kernel. Although Linux's IPID generation scheme is specifically intended to reduce information flow, we show that using Linux machines as zombies in an indirect scan is still possible. ONIS has 87% accuracy, which is comparable to nmap's implementation of the idle scan at 86%. ONIS's much broader choice of zombies will enable it to be a widely used technique which can fulfill various network measurement tasks.
UR - http://www.scopus.com/inward/record.url?scp=85056182623&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85056182623&partnerID=8YFLogxK
U2 - 10.1109/INFOCOM.2018.8486426
DO - 10.1109/INFOCOM.2018.8486426
M3 - Conference contribution
AN - SCOPUS:85056182623
T3 - Proceedings - IEEE INFOCOM
SP - 2069
EP - 2077
BT - INFOCOM 2018 - IEEE Conference on Computer Communications
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 15 April 2018 through 19 April 2018
ER -