Detekce anomálií v ICMP provozu

Bc. Miroslav Piter

Bachelor's thesis

Anomaly detection in ICMP traffic

Abstract:

The point of this bachelor thesis is to describe the anomalies and ICMP exploits, and to propose the actions for detecting them and verify these actions in practice. The theoretical part of this thesis describes the basic protocols and their position in the reference model TCP/IP and ISO OSI, their headers and properties. It mentions briefly the principle of filtering NetFlow data using nfdump. The practical part describes chosen anomalies and ICMP exploits and by which means they occur. Further I focus on their impact on the network traffic and their detection possibilities using NetFlow technology. The results of this thesis are nfdump filters to detect these anomalies.

Abstract:

Cieľom je popísať anomálie a cielené zneužitia protokolu ICMP, navrhnúť postupy ich detekcie a tieto postupy overiť v praxi. V teoretickej časti tejto bakalárskej práce popisujem základné protokoly, z ktorých vychádzam, ich zaradenie do referenčných modelov TCP/IP a ISO OSI, ich hlavičky a vlastnosti. V krátkosti načrtávam princíp filtrovania NetFlow dát pomocou nástroja nfdump. V praktickej časti popisujem vybrané anomálie a cielené zneužitia protokolu ICMP, spôsoby ako vznikajú, dopady na fungovanie siete a možnosti ich detekovania pomocou technológie NetFlow. Výsledkami praktickej časti sú nfdump filtre, ktoré tieto anomálie detekujú.

Keywords

TCP/IP, ICMP, anomálie, NetFlow, nfdump, bezpečnosť

Language used: Slovak

Date on which the thesis was submitted / produced: 4. 1. 2011

Thesis defence

• Date of defence: 3. 2. 2011
• Supervisor: RNDr. Pavel Minařík, PhD.
• Reader: RNDr. Vojtěch Krmíček, Ph.D.

Masaryk University

Faculty of Informatics

Bachelor programme / field:
Informatics / Computer Networks and Communication