Download document 8052592

Monosek API Calls and Sample Applications for
Educational and Research Institutes
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com
Table of Contents
1
Sample Applications
1.1 Detection of TCP SYN flooding
1.2 Detection of UDP Flooding
1.3 Detection of IP-Spoofing
1.4 Estimation of Throughput of the network
1.5 Filtering of Packets
1.6 Routing Protocol
1.7 Finding of Round Trip Time
1.8 DNS
2 Example API Functions
2.1 int is_TCP_SYN_pkt (char *pbuf)
2.2 int is_ICMP_pkt (char *pbuf)
2.3 int get_routing_protocl (char *pbuf)
2.4 int get_pkt_time (char *pbuf)
2.5 int get_dns_flag(char *pbuf)
2.6 A few other API Functions
Purpose of this Document:
This document lists a few typical applications that can be written by students in C or C++
around our Monosek card using C callable API functions provided by us.
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com
Sample Applications
1.1 Detection of TCP SYN flooding
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of
SYN requests to a target's system. A malicious client can skip sending this last ACK message.
Or by spoofing the source IP address in the SYN, it makes the server send the SYN-ACK to the
falsified IP address, and thus never receive the ACK. In both cases, the server will wait for the
acknowledgement for some time, as simple network congestion could also be the cause of the
missing ACK. In such cases, the server fails to respond to legitimate users as time and resource
is used up, rather wasted on the malicious client. This leads to further congestion and the server
can eventually breakdown.
Our API calls can be called to identify if the packets are SYN packets or ACK packets etc. Also the
time stamp returned by one of the API calls will indicate the periodicity of such packets from a
given system. A combination of these and such other calls will help in identifying the Flooding
1.2 Detection of UDP Flooding
A UDP flood attack could be initiated by sending a large number of UDP packets to
random ports on a particular remote host. As a result, the distant host will:
Check for the application listening at that port;
See that no application listens at that port;
Reply with an ICMP Destination Unreachable packet.
Thus, for a large number of UDP packets, the victimized system will be forced into sending
many ICMP packets, eventually leading it to be unreachable by other clients. This also leads
to congestion and resource wastage at the host end
Using protocols identification and time stamps etc from Monosek API, user can write a
program to isolate such instances.
1.3 Detection of IP-Spoofing
Returning an IP address that is different from the one that is actually assigned to
the destination website.
An attack method by which IP packets are sent with a false source address.
An attack whereby a system attempts to illicitly impersonate another system by using
its IP network address.
IP spoofing refers to the creation of Internet Protocol (IP) packets with a forged source IP
address, called spoofing, with the purpose of concealing the identity of the sender or
impersonating another computing system.
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com
This leads to an illegal use of the network and its resources. It could be more dangerous if the
“man in the middle” injects virus into the network.
Monosek’s API calls will help students in collecting statistics about the packet origin, which will
enable detection of IP spoof.
1.4 Estimation of Throughput of the network
It is the ratio of the effective data delivered to the total data sent/received over
the communication link.
Useful to determine the quality of the network
Measured in “bits per second”.
1.5 Filtering of Packets
Packets can be filtered based on IP address, TCP ports, application protocols, TCP flags,
IP protocols etc. This facility is useful for a statistical study of network packets.
1.6 Routing Protocol
User can study routing protocol details by finding out the routing protocols used by the router
to route IP packets. It could be RIP, OSPF and BGP etc.
1.7 Finding of Round Trip Time
User can find out the round trip time and thereby determine the congestion in the network.
Our product creates a time stamp of arrival time for each packet and is available to the user
through API calls.
1.8 DNS
1. Short for Domain Name System (or Service or Server), an Internet service that
translates domain names into IP addresses.
2. A DNS query may be either a recursive query or a non-recursive query:
A non-recursive query is one in which the DNS server provides a record for a
domain for which it is authoritative itself, or it provides a partial result without
querying other servers.
A recursive query is one for which the DNS server will fully answer the query
(or give an error) by querying other name servers as needed. DNS servers are not
required to support recursive queries.
We can find the number of Hops taken by the DNS resolver to get a particular
domain, the type of query that the resolver is handling and the various types
of resource records.
The student can develop his own applications based on his knowledge, interest and expertise of
TCP/IP networks.
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com
Example API Functions
Some of the API calls for the above mentioned applications are given below
int is_TCP_SYN_pkt (char *pbuf):
Returns TRUE if the packet is a TCP SYN packet, else returns FALSE.
Description: Based on the number of SYN packets to a particular user (identified by IP
address and TCP port number), the user can decide if there is a SYN flooding.
int is_ICMP_pkt (char *pbuf):
Returns TRUE if it is an ICMP packet, else returns FALSE.
Description: Based on the number of ICMP packets from a single user (based on IP address),
the user can decide if there is a UDP flooding.
int get_routing_protocol (char *pbuf):
Returns the routing protocol used for routing purpose.
Description: The user can determine the routing protocol that is used to route IP packets.
For this, it is important that the system is able to sniff packets from a router.
int get_pkt_time (char *pbuf):
Returns time stamp of the packets recived.
Description: This can be very useful for various applications which require to know the time of
arrival of a packet in the network. As an example, the user can get two values of time stamps
of the incoming packets and determine the round trip delay
int get_dns_flag(char *pbuf) :
Returns value of the DNS flag
Description: The DNS flag value indicates some paramters like type of query,
message truncation status, etc. The user can use this flag to know the status of the
packet.
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com
A few other API Functions
int get_packet_ size ();
int get_src_mac_address (); int get_dst_mac_address ();
int get_src_ip_address (); int get_dst_ip_address (); int get_ip_protocol ();
int get_tcp_src_port (); int get_tcp_dst_port ();
int get_udp_src_port (); int get_udp_dst_port ();
int get_application_protocol ();
get_domain_name( ) : gives the domain name of the packet.
is_pckt_q( ) : checks the packet for the query.
get_type_of_query( ) : give the type of the query.
get_num_of_rsrc_rcrds( ) : gives the number of resource records present in the packet.
get_tid( ) : gives the transaction ID of the packet.
is_it_response( ) : checks the packet for response.
get_dns_flags( ) : gives the DNS flags.
get_q_class( ) : gives the class of the packet.
is_pckt_errorfree( ) : checks the packet for error in the message.
is_msg_trunctd( ) : checks the packet for truncation of the message.
int create_filter();
int delete_filter();
int modify_filter();
int get_aggregation_table_size();
int get_aggregation_table();
nd
th
th
Office: # 35,2 Floor, 8 Main, 16 Cross, Malleswaram , Bangalore – 560055
Telefax: 91- 80 – 23561866, Telephone: 91 – 80 – 41204434
www.ncs-in.com