can iptables or BPF be used to detect and drop replay attack traffic?
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is valid in that its payload conforms to what the server expects and destination is valid service port. But if it's old and see before i want to drop it before it reaches the server.
Can this be done with iptables/bpf ?
Using a the packets signature or timestamp field perhaps or marking the packet and storing in conntrack for some time which is checked etc...
Before going down the userspace or kernel module path i wanted to check if this can be done now.
thanks.
security iptables firewall netfilter
asked 2 mins ago
Flo Woo
13315
add a comment |Â
up vote
0
down vote
favorite
I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is valid in that its payload conforms to what the server expects and destination is valid service port. But if it's old and see before i want to drop it before it reaches the server.
Can this be done with iptables/bpf ?
Using a the packets signature or timestamp field perhaps or marking the packet and storing in conntrack for some time which is checked etc...
Before going down the userspace or kernel module path i wanted to check if this can be done now.
thanks.
security iptables firewall netfilter
asked 2 mins ago
Flo Woo
13315
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is valid in that its payload conforms to what the server expects and destination is valid service port. But if it's old and see before i want to drop it before it reaches the server.
Can this be done with iptables/bpf ?
Using a the packets signature or timestamp field perhaps or marking the packet and storing in conntrack for some time which is checked etc...
Before going down the userspace or kernel module path i wanted to check if this can be done now.
thanks.
security iptables firewall netfilter
asked 2 mins ago
Flo Woo
13315
I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is valid in that its payload conforms to what the server expects and destination is valid service port. But if it's old and see before i want to drop it before it reaches the server.
Can this be done with iptables/bpf ?
Using a the packets signature or timestamp field perhaps or marking the packet and storing in conntrack for some time which is checked etc...
Before going down the userspace or kernel module path i wanted to check if this can be done now.
thanks.
security iptables firewall netfilter
security iptables firewall netfilter
asked 2 mins ago
Flo Woo
13315
asked 2 mins ago
Flo Woo
13315
asked 2 mins ago
Flo Woo
13315
asked 2 mins ago
Flo Woo
13315
asked 2 mins ago
Flo Woo
13315
13315
add a comment |Â
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f475209%2fcan-iptables-or-bpf-be-used-to-detect-and-drop-replay-attack-traffic%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
