Isbn: 9798170832286 - tcp/ip in practice: reconnaissance, fingerprinting, and the defenses that answer them (4 Ergebnisse)

PAP. Zustand: New. New Book. Shipped from UK. Established seller since 2000.

Paperback. Zustand: new. Paperback. You can run traceroute. Can you explain why it works? Every networking tool is applied protocol semantics. It repurposes a field, or exploits a behavior the RFC either mandated or left undefined. Traceroute is the TTL field doing a second job. The nmap SYN, FIN, NULL, Xmas, and ACK scans are RFC 793's own mandated replies turned into a probe. The idle scan reads a stranger's IP ID counter. p0f fingerprints a host from the idiosyncrasies of its TCP options. The Kaminsky attack races sixteen bits of DNS entropy. TCP/IP in Practice teaches the stack the way an engineer actually learns it: by understanding why each tool works, field by field, and then inverting every mechanism into a defense. For each technique, the book shows the defensive inversion the protocol community actually shipped - SYN cookies, GTSM, RFC 6528 sequence numbers, source-port randomization, DNS 0x20 encoding, response-rate limiting, and uRPF - as one coherent family rather than a list of unrelated fixes. Who it is forSenior engineers and security practitioners who already use these tools and want to own the mechanism instead of memorizing the command. It assumes you know what an IP packet and a TCP handshake are. It does not assume you have ever opened Scapy. InsideThe field-by-field core. TTL and path shape, the handshake's honest answers, ISN entropy and spoofing, the IP ID side channel, and timestamp/window/option fingerprinting - each derived from the RFC.The tool families. ARP and the blind network map, active and passive fingerprinting, UDP and ICMP inference, fragment-based evasion, covert channels, and DNS cache poisoning.The defensive inversions, assembled. Encode state in the field, add entropy, verify the field - one meta-pattern behind every modern defense.A hands-on lab. A self-contained Linux network-namespace testbed built with Scapy, hping3, tcpdump, and Wireshark. You reconstruct traceroute, a SYN scanner, the idle scan, a p0f-lite classifier, and a DNS-poisoning proof of concept - each in about a dozen lines.Six graded katas, from mapping a subnet you cannot send traffic to, to redesigning a technique the defenders already killed.Thirty-one chapters, eighteen hand-drawn diagrams, and four appendices - including a field tool defense quick-reference table. Samir Chekkal is the author of the In Practice series - concise, hands-on guides written by an engineer for engineers who ship real systems. This item is printed on demand. Shipping may be from multiple locations in the US or from the UK, depending on stock availability. …

Zustand: New. Print on Demand.

Paperback. Zustand: new. Paperback. You can run traceroute. Can you explain why it works? Every networking tool is applied protocol semantics. It repurposes a field, or exploits a behavior the RFC either mandated or left undefined. Traceroute is the TTL field doing a second job. The nmap SYN, FIN, NULL, Xmas, and ACK scans are RFC 793's own mandated replies turned into a probe. The idle scan reads a stranger's IP ID counter. p0f fingerprints a host from the idiosyncrasies of its TCP options. The Kaminsky attack races sixteen bits of DNS entropy. TCP/IP in Practice teaches the stack the way an engineer actually learns it: by understanding why each tool works, field by field, and then inverting every mechanism into a defense. For each technique, the book shows the defensive inversion the protocol community actually shipped - SYN cookies, GTSM, RFC 6528 sequence numbers, source-port randomization, DNS 0x20 encoding, response-rate limiting, and uRPF - as one coherent family rather than a list of unrelated fixes. Who it is forSenior engineers and security practitioners who already use these tools and want to own the mechanism instead of memorizing the command. It assumes you know what an IP packet and a TCP handshake are. It does not assume you have ever opened Scapy. InsideThe field-by-field core. TTL and path shape, the handshake's honest answers, ISN entropy and spoofing, the IP ID side channel, and timestamp/window/option fingerprinting - each derived from the RFC.The tool families. ARP and the blind network map, active and passive fingerprinting, UDP and ICMP inference, fragment-based evasion, covert channels, and DNS cache poisoning.The defensive inversions, assembled. Encode state in the field, add entropy, verify the field - one meta-pattern behind every modern defense.A hands-on lab. A self-contained Linux network-namespace testbed built with Scapy, hping3, tcpdump, and Wireshark. You reconstruct traceroute, a SYN scanner, the idle scan, a p0f-lite classifier, and a DNS-poisoning proof of concept - each in about a dozen lines.Six graded katas, from mapping a subnet you cannot send traffic to, to redesigning a technique the defenders already killed.Thirty-one chapters, eighteen hand-drawn diagrams, and four appendices - including a field tool defense quick-reference table. Samir Chekkal is the author of the In Practice series - concise, hands-on guides written by an engineer for engineers who ship real systems. This item is printed on demand. Shipping may be from our UK warehouse or from our Australian or US warehouses, depending on stock availability. …