Changes between Version 49 and Version 50 of ExDescLang

Timestamp:

Oct 18, 2010 3:48:41 PM (14 years ago)

Author:

sunshine

Comment:

--

ExDescLang

@@ -163 +163 @@
  * It should offer event generator for each of the events: query, reply, access, askconfidential. Specifically for query, reply it should offer DNS traffic generators.  For access, askconfidential it should offer HTTP traffic generators.
 
+== Example 3: ARP poisoning with MITM attack ==
+
+This example used two metadescriptions. The first was ARP poisoning which is a flavor of cache poisoning, and the other is MITM attack.
+
+
+=== ARP poisoning metadescription ===
+
+  This is a special case of cache poisoning where the target is ARP cache. I've highlighted customizations from the general cache poisoning metadescriptions to arrive at this one.
+
+   [[Image(arpcpobj.jpg)]]
+
+   (in English: There is one attacker node. There is a fakeIP of type IPaddress. A cache is simply a collection of ARPRecord items, one or more. These are  subtypes of Info and in the domain knowledge DB there's syntax defined for an ARPRecord. Cache does not reside at the attacker.)
+
+
+ * '''Timeline of events: '''
+
+  [[Image(arpwf.jpg, 50%)]]
+
+   (in English: Attacker asks for something, anything and in the same message sends the fake mapping stealing somebody's ARP address and tying it to a fakeIP. This really could be anybody's IP but in most cases it is the attacker's.)
+
+ * '''Invariants:''' 
+
+   Nothing in addition to the topology and timeline above.
+
+
 = TODO =