Defining Traffic
Legitimate Traffic
You have the ability to define which traffic options
you would like active on your network. To define traffic
use the checkboxes along the left side of the main window.
To turn traffic on simply check the box or uncheck it to
turn it off. Below you will find all information on each
legitimate service.
------------DNS------------
IP Address: 192.168.1.5
Port: 53
Protocol: UDP
----------Database---------
IP Address: 192.168.1.233
Port: 3306
Protocol: TCP
------------Email-----------
IP Address: 192.168.1.136
Port: 25
Protocol: TCP
------------VOIP-----------
IP Address: 192.168.1.74
Port: 38287
Protocol: TCP
-------------Web------------
IP Address: 192.168.1.114
Port: 80
Protocol: TCP
------------Chat------------
IP Address: 192.168.1.68
Port: 5222
Protocol: TCP
----Workstation Traffic----
Simply turns on traffic which
will originate from the
workstations.
Malicious Traffic
Along with legitimate traffic you are also able to define
which attacks you want to be sent to your network. The
attacks will come out of the internet cloud and attempt
to compromise your network in their own specific way.
They are located below the traffic checkboxes on the
left side of the main window and are activated with
checkboxes in the same way as legitimate traffic. Each
attack is represented by a bug of a unique color which is
displayed as they move through your network. Descriptions
and additional information on each attack can be found below.
---------------------OS Exploits-----------------------
Represents traditional Operating Systems vulnerabilites
and exploits which arise because of services provided
by the host Operating System. The exploit would come over
whichever port the service it is exploiting also uses.
------------------------Virus--------------------------
Simulates a computer virus which when allowed to infect
a system replicates and propogates to other systems on
the network unless stopped by a firewall with the
apprpriate rules to prevent their movement.
-----------------------Trojan--------------------------
Trojans are a form of malware which will pose as a file
or item which makes you think it is innocent or legitimate.
They are often disguised as common file types or items
which you open everyday but upon opening them they then
run their malicious code and infect your system without
your knowledge. They will then dial back to their
host or creator and pass them any information they can
access such as your credentials, passwords, etc. This
represenation does exactly that and once a system is
infected will then send dial back packets to the internet
cloud from the infected host. These dial back packets are
represented by the Trojan yellow bug with an envelope with
it. This image is included in the main window on the bottom
left for easy reference.
-----------------------Syn Scan--------------------------
Syn scans in this simulation randomly select a host on the
network as it's destination address and then attempts to
get through the firewall. If you have a rule allowing
traffic from the cloud to that service then that syn scan
packet will get through since it is on the same destination
IP and port as the rule you have defined as allowed.
-----------------------Ack Scan--------------------------
Ack scans are used to take advantage of stateless firewalls.
A stateless firewall keeps no state of previous packets and
thus when an ack packet is sent to the firewall it assumes
that someone inside the network has sent a Syn packet to
attempt to create a connection outside the firewall.
Through this assumption the firewall allows the Ack Scan
packet through and allows your network to be scanned. The
only prevention for this is to make your firewall stateful.
----------------------Web Attacks------------------------
Web attacks represent any attack which could be maneuvered
or aimed at a web server or resource. Web traffic comes over
port 80 and so do web attacks thus by nature web attacks
cannot be prevented with a firewall due to their limitations
and inability to investigate the contents of the packet
like an Intrustion Prevention System.
COPYRIGHT