Understanding passive and active service discovery

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2007, Pages 57-70

  Bartlett, Genevieve ^a   Heidemann, John ^a   Papadopoulos, Christos ^b  

^a UNIVERSITY OF SOUTHERN CALIFORNIA   (United States)

^b Department of Environmental and Radiological Health Sciences   (United States)

Author keywords

Active measurement; Network reconnaissance; Passive monitoring; Service discovery; Situational awareness

Indexed keywords

ACTIVE PROBING; ACTIVE SCANNING; ACTIVE SERVICE; DECENTRALIZED NETWORK MANAGEMENT; INCOMING CONNECTIONS; INFORMATION DISCLOSURES; INTERNET MEASUREMENTS; NETWORK OPERATORS; NETWORK VULNERABILITIES; PASSIVE MONITORING; SERVICE DISCOVERY; TRACKING SERVICES; VULNERABILITY DETECTION;

ADMINISTRATIVE DATA PROCESSING; INTERNET; KETONES; MANAGEMENT INFORMATION SYSTEMS; MONITORING; NETWORK MANAGEMENT; SCANNING; SEMICONDUCTING INTERMETALLICS;

COMPUTER NETWORKS;

EID: 42149083798     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1298306.1298314     Document Type: Conference Paper

References (19)

1. Nessus vulnerability scanner, http : //www. nessus. org.
2. Nmap ("Network Mapper"), http://insecure.org/nmap/.
3. Short, http://www.snort.org/.
4. M. Bawa, H. Deshpande, and H. Garcia-Molina. Transience of peers and streaming media. In Proceedings of the I, pages 107-112, Princeton, NJ, USA, October 2002.
5. D. Box, D. Ehnebuske, G. Kakivaya, A. Layman, N. Mendelsohn, H. F. Nielsen, S. Thatte, and D. Winer. Simple object access protocol (soap) 1.1. Technical Report NOTE-SOAP-20000508, W3C, May 2000.
6. B. Dayioglu and A. Özgit. Use of passive network mapping to enhance signature quality of misuse network intrusion detection systems. 2001.
7. N. Duffield and M. Grossglauser. Trajectory sampling for direct traffic observation. In Proceedings of the ACM SIGCOMM Conference, pages 179-191, Stockholm, Sweden, August 2000. ACM.
8. K. P. Gummadi, R. J. Dunn, S. Saroiu, S. D. Gribble, H. M. Levy, and J. Zahorjan. Measurement, modeling, and analysis of a peer-to-peer file-sharing workload. In Proceedings of the 19th Symposium on Operating Systems Principles, pages 314-329, Bolton Landing, NY, USA, October 2003. ACM.
9. A. Hussein, G. Bartlett, Y. Pryadkin, J. Heidemann, C. Papadopoulos, and J. Bannister. Experiences with a continuous network tracing infrastructure. In Proceedings of the ACM SIGCOMM Workshop on Mining network data Mine Net, pages 185-190, Philadelphia, PA, USA, August 2005.
10. M. Krzywinski. Port knocking: Network authentication across closed ports. SysAdmin Magazine, 12(6):12-17, June 2003.
11. K. Lan and J. Heidemann. Rapid model parameteration from traffic measurement. ACM Transactions on Modeling and Computer Simulations, 12(3):201-229, July 2002.
12. A. De Montigny-Leboeuf and F. Massicotte. Passive network discovery for real time situation awareness. In Proceedings of the The RTO Information Systems Technology Panel (1ST) Symposium on Adaptive Defense in Unclassified Networks, pages 288-300, November 2004.
13. V. Paxson. Bro: a system for detecting network intruders in real-time. Computer Networks (Amsterdam, Netherlands: 1999), 31(23-24):2435-2463, 1999.
14. J. Rosenberg, H. Schulzrinne, A. Johnston G. Camarillo, J. Peterson, M. Handley R. Sparks, and E. Schooler. SIP: Session initiation protocol. RFC 3261, Internet Request For Comments, June 2002.
15. D. Schweitzer. Two sides of vulnerability scanning. http://www. computerworld.com/, February 2005.
16. F. Donelson Smith, F. Hernandez, K. Jeffay, and D. Ott. What TCP/IP protocol headers can tell us about the web. In Proceedings of the ACM SIGMETRICS, pages 245-256, Cambridge, MA, USA, June 2001. ACM.
17. Sun Microsystems. RPC: remote procedure call protocol specification version 2. RFC 1057, Internet Request For Comments, June 1988.
18. The PREDICT Program. Predict: Protected repository for the defense of infrastructure against cyber-threats. http://www.predict.org, January 2005.
19. S. Webster, R. Lippmann, and M. Zissman. Experience using active and passive mapping for network situational awareness. In Proceedings of the 5th IEEE International Symposium on Network Computing and Applications, pages 19-26, July 2006.