- ...
- This work was funded by the DFN-Verein (Association
for the promotion of a German Research Network) and Deutsche Telekom
under project number: DT10.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...server
- The ATMARP (ATM Address
Resolution Protocol) as specified in [10] is required for
resolving IP addresses into ATM addresses and vice versa. Unlike ARP
[11] which uses broadcasts to resolve addresses a server is
required in non broadcast multiple access networks such as ATM.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...connection
- Note that the number of
intermediate switches is irrelevant as long as a virtual connection
between attacker and server can be established.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...used
- In the case of a routed
broadcast LAN the attacker also has to make sure that the host,
whose IP address the attacker uses for spoofing, will not reset the
spoofed connection. This can be done by flooding it with
communication prior to the spoofing attack, so that the client is too busy to
respond to the packets from the server.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...establishment
- RFC
1577 [10]
section 5 ``Overview of Call Establishment Message Content''
requires the originator to supply a ``Calling Party Number''
Information Element (IE). It is expected to be an ATM address that
really belongs to the calling system, but of course this IE can be
faked like any other unauthenticated information.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...own
- This will not necessarily identify the attacker's host
because he may have registered an additional ATM address at his local
switch (see also section 2.6).
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...connections
- The ATM cells at the `User to Network Interface'
have 8 bits for virtual path identification and 16 bits for virtual
channels. This allows for a theoretical total of 2^24 different
virtual connections at any time between host and switch.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...phrases
- RFC1157[3] denotes them as
`community names'.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...NNI
- `Network to Network Interface' (NNI) describes the
appropriate interface for switch to switch interconnection.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...symmetric
- If the P-NNI protocol is
used at the NNI, the setup is called ``symmetric'' because there are
two network nodes (switches). The UNI protocols are not
symmetric because they are used for different kinds of peers (between an
end system (host) and a network node (switch)).
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...UNI
- `User Network
Interface' (UNI) describes a protocol to be used for connection
management between host and private ATM switches.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...group
- A number of switches that share a common addressing
scheme, e.g. the same address prefix, are grouped together. They
belong to a `peer group'.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...access
- During signaling for
connection establishment any node (both peers) and any intermediate
switch may disagree to the SETUP request. ATM networks therefore offer
some kind of ``shared control'' in contrast to legacy LANs which
usually offer only a ``shared access''.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...(CSMA/CD)
- Carrier Sense
Multiple Access with Collision Detection
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...only
- Beside configuring the PVCs the signaling of SVCs must
be disabled.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...interfaces
- Filters are not
in use unless they are applied to a port of the switch.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...DMZ
- A bastion host
is usually installed on its own subnet, frequently called
``Demilitarized Zone'' (DMZ) [4,5].
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
