Author: Marshall Beddoe

Heuristics for Packet Field Identification

January 4, 2007

When performing any type of protocol fuzzing, one must obtain three key pieces of information about the target protocol: structure, state and semantics. The structure of a network protocol is the format of the messages, which contains a series of fields which, at the simplest level, are integers and strings. When dealing with any protocol with public specifications, this information is easily obtained. However, what is one to do when the specs are not publicly available, say in the case of a proprietary industrial control and automation protocol?

Full Post »

Categories: Research
817 Comments
Bookmark and Share