Welcome to the lecture on network traffic monitoring First we will recall some basic information about
firewalls and their configuration.
The firewall which is really a special kind of router should control the network traffic rather than
unobtrusively send senders and receivers packets
the firewall should send only those packets that were allowed and block all others which packets get
through and which packets get blocked as specified by the rules.
That is the conditions according to which the firewall processes the packets such a condition in the
general form looks as follows.
Depending on the criteria the packet means it should be blocked or accepted.
The information saved in the headers of the Protocols of the lower layers of the overside model is historically
wise.
The first criteria that appeared you can create rules that will filter the traffic on the basis of the
sender's address recipient's address senders port or receivers port.
There are two approaches to creating such rules or configuring then that work firewall.
The first says that the default rule should be a block rule everything that is not explicitly allowed
will be blocked by the firewall.
An alternative approach is to create a default rule that will be an allow rule all traffic except for
packets explicitly blocked will be permitted to pass through the firewall.
Security wise the only effective way is to use the first approach by default.
Everything that may threaten the security of computers that are to be protected must be blocked.
The same intuitive rules should be applied in other security solutions in the same way you should prevent
users from running any program of their liking and allow them only to install ones that are known to
be safe.
We will return to this issue later.
When it comes to firewalls we all realize that the default rule should be a block rule
such an attitude isn't very popular and other aspects of computer network security yet.
Historically the first method of filtering network traffic was IP Hetter analysis in its time it was
an effective solution.
We're talking about situations dating back more than 15 years.
Back then computers exchange data only if they had public IP addresses.
No one used masks or more virtual and private addresses.
Since then the situation has changed so these kind of firewalls are no longer effective.
The use of the IP protocol has changed in the last 15 years.
Another functionality that firewalls have acquired over the years is the ability to filter traffic on
the basis of the headers of the fourth layer the transport layer protocols such as TCAP and UDP because
these protocols are responsible for establishing the communication channel.
It was possible to filter traffic on the basis of for example port numbers.
It was possible to allow web browsing and deny P2P traffic.
It's all done by filtering on the basis of some constant features.
For example port numbers it is assumed that a given service will always run on the same port
Farwell's filtering by transport layer protocol headers can usually check the session state to.
This is the basis for the division of firewalls into stateless and stateful if a trusted computer look
at it in your private network initiates communication the Internet connection firewall should allow
it.
This is due to the fact that the decision to connect to a less trusted server is consciously made by
a trusted user.
If however the server itself initiated the session then it should be blocked.
That would be an untrusted computer trying to connect to one of the protected computers GCP session
direction is crucial here.
We will return to the issue of TCAP session direction later in the lecture.
The next step in the development of firewalls was to enable them to filter packets.
Not on the basis of headers but on the basis of data.
You will notice that any firewall and almost every network monitor is equipped with the functionality
allowing them to reassemble data a set of data can be divided into several packets.
Therefore before making a decision whether it is correct or if a file type is allowed data from multiple
packets must be gathered together the data from these packets must be reassembled into one unit this
operation is computationally expensive and time consuming.
Therefore application layer firewalls usually don't protect individual computers.
They're specialized devices whose task is to protect in real time whole networks a situation where it
takes a minute or even a couple of seconds for a firewall to assemble packets together examine their
contents and send them begge is unsustainable.
Application layer firewalls are rather expensive devices of large computational power a separate issue
that should be discussed as the issue of data encryption with an application layer firewall installed
and configured.
Another problem arises that is when the firewall should let packets through and when to block them.
If the data is encrypted
the firewall should be able to first decrypt the data and later re-encrypt it.
Without this the data would be completely unreadable for the firewall.
The requirement to encrypt all data does not automatically improve the security of computer networks.
It may sometimes have the opposite effect.
Anyone who wants to send your private data outside will encrypt the data before sending it.
Having a good chance of fooling your firewalls and intrusion detection systems
even the firewalls are not perfect.
They're very useful and effective indeed for the purposes they were created for
firewalls should be used to control traffic between networks and suddenly it's
you should use them to control the transmission of messages that are not needed outside primarily diagnostic
messages.
Such a control should take place on a corporate network boundary.
Or even the boundaries of individual subnets while blocking the ICMP protocol and the sudden that level
can cause some trouble logging these messages that the boundary is reasonable.
The firewalls are perfect for controlling traffic between subnets having divided the network and the
subnets.
You can allow access to the subnet which hosts database servers only through the port service listen
on in this way you prevent people from using them for other purposes.
For example as files servers
firewalls can be used also to block specific hosts or services most firewalls have a useful feature
of generating traffic history.
You can make a record of packets that passed through the firewall.
This is useful in case you have to prove that an attack happened or track down the source of an attack.