Question.3226 - 2.1 Explain the meaning of each field of the following packet filtering rule. (13 points) Firewall rule Packet direction Source address Dest address Packet type Source port Dest port ACK action C Incoming ext 132.28.6.4 TCP 23 * * deny 2.2 If a packet is permitted by the following packet filtering rule, that is, the packet matches the rule: Firewall rule Packet direction Source address Dest address Packet type Source port Dest port ACK action D Outgoing int ext TCP * 23 * permit 4. 2.2.1: Who is the sender program (of the packet) and where is the sender (inside the firewall or outside the firewall)? (7 points) 5. 2.2.2: Who is the receiver program (of the packet) and where is the receiver (inside the firewall or outside the firewall)? (7 points) 6. 2.2.3: What are the IP address and port number of the receiver program? (7 points) 7. 2.2.4: Could computer 168.3.144.1 be the machine on which the receiver program is running? Why? (8 points 2.2.5: Could this packet be the second sub-step packet (or signal) of the 3-way handshake process of the TCP session (or connection)? Why? (8 points) 9. 2.2.6: Could this packet be the third sub-step packet (or signal) of the 3-way handshake process of the TCP session (or connection)? Why? (8 points) 2.2.7: After the receiver program receives this packet, if the receiver wants to send a packet back to the sender, the above rule (rule D) does not authorize this packet to go through the firewall. 10. 2.2.7.1: Why rule D does not authorize this packet to go through the firewall? (8 points) 11. 2.2.7.2: A TCP connection has 3 steps (or phases): establish the connection, messages back and forth, terminate the connection. Is this packet part of Step 1, Step 2, or Step 3? (8 points) 12. 2.2.7.3: Give a rule which authorizes this new packet to go through the firewall. (8 points) 13. 2.2.7.4: Give a rule which can block this new packet from going through the firewall. (8 points)
Answer Below:
2.1) The meaning of each field of the following packet filtering rule: i) Firewall Rule, value= ‘C’- it specifies the firewall rule that the firewall follows for packet filtering. Firewall rule C is to be followed here. ii) Packet direction, value=”incoming”- states whether the packet is coming inside the network or going out of the network. iii) Source address, value=’ext’-gives the source address of the packet. Since the packet is entering the firewall from outside the network, its value is ‘ext’ (short for external) iv) Dest address, value=’132.28.6.4’-states the destination address of the packet where it is to be sent. Its value is the physical address of the destination. v) Packet type, value=’TCP’-states the communication protocol of the packet. Here it is TCP, so the transmission of packet is connection oriented with more reliability, security and integrity of data maintained. vi) Source port, value=’23’-gives the port address of the source of the packet from which the packet was sent. vii) Dest port, value=’*’- gives the port address of the destination of the packet through which the connection was established. Here the value is not specified; therefore the client can use any port for communication (usually port address above 1023). viii) ACK, value=’*’- gives the acknowledgment value of the packet whether it was accepted or not. ‘*’ signifies that the ack field is not set. ix) action, value=’deny’- states whether to allow packet transfer or not. 2.2.1) Sender of the program is the TELNET server and is inside the firewall. 2.2.2) Receiver of the program is an external client (via internet) and it is outside the firewall. 2.2.3) IP address of the receiver is can be any client connected with the internet (example: ‘168.3.144.1’) and port number is ‘23’. 2.2.4) Yes computer 168.3.144.1 could be the machine on which the receiver program is running because the firewall allows any outbound TELNET connection in this case, which sends the program over internet and computer 168.3.144.1 is connected to the internet. 2.2.5) No this packet cannot be the second sub-step packet (or signal) of the 3-way handshake process of the TCP session (or connection) because the ACK field is not set. 2.2.6) No this packet cannot be the third sub-step packet (or signal) of the 3-way handshake process of the TCP session (or connection) because the ACK field is not set. 2.2.7.1) Rule D is only for outgoing packets and thus incoming packets under rule D is not permitted (ACK field is not set and source port is not mentioned) 2.2.7.2) This packet is a part of step 3 in TCP connection. 2.2.7.3) Rule E authorizes this new packet to go through the firewall. 2.2.7.4) Rule C can block this new packet from going through the firewall.More Articles From Computer
.ico)
.ico)
.ico)
.ico)
