IP agnostic real-time traffic filtering and host identification using TCP timestamps

Abstract

In this work, we describe and evaluate the design and implementation of natfilterd, a flexible and lightweight extension of the Linux netfilter packet filter framework, which enables us to identify hosts completely independent of IP addresses by taking advantage of certain characteristics of TCP timestamps. As an immediate consequence, not only can we count hosts behind a NAT gateway but block TCP traffic from single hosts without blocking the gateway itself. Our work extends ideas from Bursztein, which we improve in terms of performance as well as matching quality and usability in practice. A theoretical runtime of O(log(n)) for matching packets against a database of n hosts is achieved. We empirically verify this result and conclude that our approach scales extremely well and is therefore suitable for at least medium-scale networks of a few thousand hosts.

Supervised Learning-Based Fast, Stealthy, and Active NAT Device Identification Using Port Response Patterns

“…For example, vulnerable services opened through port forwarding may enable attackers to conveniently access the internal network, and NATHs may be used as zombies for distributed denial of service (DDoS) attacks. When many NATHs are connected to the private network of an NATD, it is inconvenient for external hosts or systems to identify the malicious behaviors by any of these or the NATHs exhibiting such behaviors [2,3,18].…”

“…Moreover, a few of these can conduct malicious behaviors that can impair the Internet. Because the network administrator acknowledges this traffic to be originating from one IP address, if the administrator blocks the IP address exhibiting such malicious behavior, both abnormal and normal hosts behind the NATD will be damaged [3].…”