TCP/IP in Practice: Reconnaissance, Fingerprinting, and the Defenses That Answer Them - Tapa blanda

Sinopsis

You can run traceroute. Can you explain why it works?

Every networking tool is applied protocol semantics. It repurposes a field, or exploits a behavior the RFC either mandated or left undefined. Traceroute is the TTL field doing a second job. The nmap SYN, FIN, NULL, Xmas, and ACK scans are RFC 793's own mandated replies turned into a probe. The idle scan reads a stranger's IP ID counter. p0f fingerprints a host from the idiosyncrasies of its TCP options. The Kaminsky attack races sixteen bits of DNS entropy.

TCP/IP in Practice teaches the stack the way an engineer actually learns it: by understanding why each tool works, field by field, and then inverting every mechanism into a defense.

For each technique, the book shows the defensive inversion the protocol community actually shipped — SYN cookies, GTSM, RFC 6528 sequence numbers, source-port randomization, DNS 0x20 encoding, response-rate limiting, and uRPF — as one coherent family rather than a list of unrelated fixes.

Who it is for
Senior engineers and security practitioners who already use these tools and want to own the mechanism instead of memorizing the command. It assumes you know what an IP packet and a TCP handshake are. It does not assume you have ever opened Scapy.

Inside

• The field-by-field core. TTL and path shape, the handshake's honest answers, ISN entropy and spoofing, the IP ID side channel, and timestamp/window/option fingerprinting — each derived from the RFC.
• The tool families. ARP and the blind network map, active and passive fingerprinting, UDP and ICMP inference, fragment-based evasion, covert channels, and DNS cache poisoning.
• The defensive inversions, assembled. Encode state in the field, add entropy, verify the field — one meta-pattern behind every modern defense.
• A hands-on lab. A self-contained Linux network-namespace testbed built with Scapy, hping3, tcpdump, and Wireshark. You reconstruct traceroute, a SYN scanner, the idle scan, a p0f-lite classifier, and a DNS-poisoning proof of concept — each in about a dozen lines.
• Six graded katas, from mapping a subnet you cannot send traffic to, to redesigning a technique the defenders already killed.

"Sinopsis" puede pertenecer a otra edición de este libro.