{"id":748,"date":"2009-09-27T09:43:26","date_gmt":"2009-09-27T09:43:26","guid":{"rendered":"http:\/\/pchero21.com\/?p=748"},"modified":"2009-09-27T09:43:26","modified_gmt":"2009-09-27T09:43:26","slug":"3-%ec%a0%84%ec%86%a1-%ea%b3%84%ec%b8%b5-%ea%b3%b5%ea%b2%a9%ea%b3%bc-%eb%b0%a9%ec%96%b4","status":"publish","type":"post","link":"http:\/\/pchero21.com\/?p=748","title":{"rendered":"3. \uc804\uc1a1 \uacc4\uce35 \uacf5\uaca9\uacfc \ubc29\uc5b4"},"content":{"rendered":"

 TCP\ub294 \uc5f0\uacb0\ud615 \ud504\ub85c\ud1a0\ucf5c\uc774\ub2e4. \uc774\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \uc11c\ubc84\uac00 \uc2e4\uc81c \ub370\uc774\ud130 \uad50\ud658 \uc774\ub358\uc5d0 \ub370\uc774\ud130 \uc804\uc1a1 \ubc29\ubc95\uc744 \uc815\uc758\ud558\ub294 \ub9e4\uac1c\ubcc0\uc218\ub4e4\uc744 \ud611\uc758\ud558\uba70 \uc5f0\uacb0\uc758 \uc2dc\uc791\uacfc \ub05d\uc5d0 \uba85\ud655\ud55c \uad6c\ubd84\uc774 \uc788\ub2e4\ub294 \ub73b\uc774\ub2e4. TCP \ub294 \ub450 \ub178\ub4dc \uc0ac\uc774\uc5d0\uc11c \uc2e0\ub8b0\ud560 \uc218 \uc788\uace0 \uc21c\uc11c\ub97c \uc720\uc9c0\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud558\ubbc0\ub85c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ud504\ub85c\ud1a0\ucf5c\uc740 \uc774\ub7f0 \uae30\ub2a5\uc744 \uc790\uccb4\uc801\uc73c\ub85c \ub0b4\uc7a5\ud560 \ud544\uc694\uac00 \uc5c6\ub2e4.<\/p>\n

 \ubc18\uba74 UDP \ub294 \ube44\uc5f0\uacb0\ud615 \ud504\ub85c\ud1a0\ucf5c\uc774\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \ub370\uc774\ud130\uac00 \uc758\ub3c4\ub41c \ubaa9\uc801\uc9c0\uc5d0 \ub3c4\ub2ec\ud558\ub9ac\ub77c\ub294 \ubcf4\uc7a5\ub3c4 \uc5c6\uace0 \uc804\uc1a1\uc744 \ubcf4\uc7a5\ud558\ub294 \ub370\uc774\ud130 \ud615\ud0dc\uc5d0 \ub300\ud55c \ubcf4\uc7a5\ub3c4 \uc5c6\ub2e4(\uc2ec\uc9c0\uc5b4 UDP \ud5e4\ub354\uc5d0\uc11c\ub294 TCP\uc640 \ub2ec\ub9ac \uccb4\ud06c\uc12c \uacc4\uc0b0\ucd08\uc790 \uc635\uc158\uc774\ub2e4). UDP \uc18c\ucf13\uc744 \ud1b5\ud574 \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud558\ub294 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc740 \ub370\uc774\ud130\ub97c \uc2e0\ub8b0\ud560 \uc218 \uc788\uac8c \uc804\uc1a1\ud558\uae30 \uc704\ud55c \ucd94\uac00\uc801\uc778 \uae30\ubc95\uc744 \uad6c\ud604\ud560 \uc218 \uc788\uc9c0\ub9cc \uc774\ub7ec\ud55c \uae30\ub2a5\uc740 UDP \uc18c\ucf13\uc774 \uc0ac\uc6a9\ub420 \ub54c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35\uc5d0 \ub0b4\uc7a5\ub418\uc57c \ud55c\ub2e4.<\/p>\n

  * iptables \ub97c \uc774\uc6a9\ud55c \uc804\uc1a1 \uacc4\uce35 \ud5e4\ub354\uc758 \uae30\ub85d<\/span><\/p>\n

 iptables LOG \ud0c0\uac9f\uc740 TCP\uc640 UDP \ud5e4\ub354 \uae30\ub85d\uc744 \uc704\ud55c \uad11\ubc94\uc704\ud55c \uc7a5\uce58\ub97c \uac00\uc9c0\uace0 \uc788\ub2e4. TCP \ud5e4\ub354\ub294 UDP \ud5e4\ub354\ubcf4\ub2e4 \ud6e8\uc52c \ub354 \ubcf5\uc7a1\ud558\uba70, TCP \ud5e4\ub354 \ud56d\ubaa9\uc758 \uc77c\ubd80\ub294 iptables \uc815\ucc45\uc5d0 LOG \uaddc\uce59\uc774 \ucd94\uac00\ub420 \ub54c iptables \uc5d0 \ud2b9\uc815 \uba85\ub839 \ud589 \uc778\uc790\uac00 \uc8fc\uc5b4\uc9c8 \uacbd\uc6b0\uc5d0\ub9cc \uae30\ub85d\ub41c\ub2e4.<\/p>\n

 – TCP \ud5e4\ub354\uc758 \uae30\ub85d
 TCP \ud5e4\ub354\ub294 RFC 793\uc5d0 \uc815\uc758\ub3fc \uc788\uc73c\uba70 TCP \uc138\uadf8\uba3c\ud2b8(\ud328\ud0b7)\uc758 \ud5e4\ub354 \uae38\uc774\ub294 \ud3ec\ud568\ub41c \uc635\uc158\uc758 \uc218\uc5d0 \ub530\ub77c \ub2e4\uc591\ud558\ub2e4. \uc635\uc158(\uc720\uc77c\ud55c \uac00\ubcc0 \uae38\uc774 \ud56d\ubaa9)\uc744 \uc81c\uc678\ud55c \ud5e4\ub354\uc758 \uae38\uc774\ub294 \ud56d\uc0c1 20\ubc14\uc774\ud2b8\ub2e4.<\/p>\n

 INPUT, OUTPUT, FORWARD \uccb4\uc778\uc758 LOG \uaddc\uce59\uc740 \ubaa8\ub450 –log-tcp-options \uc778\uc790\ub97c \ud3ec\ud568\ud55c\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \ub85c\uadf8 \uba54\uc2dc\uc9c0\ub294 TCP \uc138\uadf8\uba3c\ud2b8\uac00 \uc635\uc158\uc744 \ud3ec\ud568\ud560 \ub54c\ub9c8\ub2e4 \uc54c\uc544\ubcfc \uc218 \uc5c6\ub294 16\uc9c4\uc218 \ucf54\ub4dc\ub97c \ud3ec\ud568\ud55c\ub2e4. <\/p>\n

 iptables \uac00 TCP \uc21c\uc11c\ubc88\ud638\uc640 \uc2b9\uc778 \uac12\ub3c4 \ud3ec\ud568\ud558\uac8c \ud558\ub824\uba74 –log-tcp-sequence \uc778\uc790\ub97c \uc0ac\uc6a9\ud558\uba74 \ub41c\ub2e4.<\/p>\n

 – UDP \ud5e4\ub354\uc758 \uae30\ub85d
 UDP \ud5e4\ub354\ub294 RFC 768\uc5d0 \uc815\uc758\ub3fc \uc788\ub2e4. \uae38\uc774\uac00 8\ubc14\uc774\ud2b8\ubc16\uc5d0 \ub418\uc9c0 \uc54a\uc73c\uba70 \uac00\ubcc0 \uae38\uc774 \ud56d\ubaa9\uc740 \uc5c6\ub2e4.<\/p>\n

 LOG \ud0c0\uac9f\uc774 UDP \ud5e4\ub354\ub97c \ub098\ud0c0\ub0b4\ub294 \ubc29\ubc95\uc5d0 \uc601\ud5a5\uc744 \uc904 \uc218 \uc788\ub294 \ud2b9\uc218 \uba85\ub839 \ud589 \uc778\uc790\ub294 \uc5c6\uae30 \ub54c\ubb38\uc5d0 iptables\ub294 UDP \ud5e4\ub354\ub97c \ud56d\uc0c1 \ub3d9\uc77c\ud55c \ubc29\uc2dd\uc73c\ub85c \uae30\ub85d\ud55c\ub2e4.<\/p>\n

 \uc55e\uc11c \uc791\uc131\ud55c iptables \uc815\ucc45\uc758 \uae30\ubcf8 LOG \uaddc\uce59\uc740 –log-tcp-options \uc778\uc790\ub97c \uc0ac\uc6a9\ud558\uc9c0\ub9cc iptables \ub294 UDP \ud328\ud0b7\uc774 \uc774\ub7f0 \uaddc\uce59 \uc911 \ud558\ub098\uc640 \uc77c\uce58\ud558\ub294 \uacbd\uc6b0\uc5d0\ub3c4 \uc81c\ub300\ub85c \ub3d9\uc791\ud558\uba70, \uc2e4\uc81c \ud328\ud0b7\uc5d0 \ub4e4\uc5b4\uc788\ub294 \uc815\ubcf4\ub9cc\uc744 \uae30\ub85d\ud55c\ub2e4. \uc989, \uc874\uc7ac\ud558\uc9c0\ub3c4 \uc54a\ub294 TCP \ud5e4\ub354\uc758 \uc635\uc158 \ubd80\ubd84\uc744 \uae30\ub85d\ud558\ub824\uace0 \ud558\uc9c0 \uc54a\ub294\ub2e4. UDP \uccb4\ud06c\uc12c\uc740 \uae30\ub85d\ub418\uc9c0 \uc54a\uc9c0\ub9cc \ub098\uba38\uc9c0 \uc138 \ud56d\ubaa9(SPT, DPT, LEN)\uc740 \ubaa8\ub450 \ud3ec\ud568\ud55c\ub2e4.<\/p>\n

 * \uc804\uc1a1 \uacc4\uce35 \uacf5\uaca9 \uc815\uc758<\/span><\/p>\n

 \ub124\ud2b8\uc6cc\ud06c \uacc4\uce35 \uacf5\uaca9\uc758 \uc815\uc758\uc640 \ub9c8\ucc2c\uac00\uc9c0\ub85c \uc804\uc1a1 \uacc4\uce35 \uacf5\uaca9\uc740 \ub9d0\ub2e8 \ud638\uc2a4\ud2b8\uc758 \uc804\uc1a1 \uc2a4\ud0dd \uad6c\ud604\uc5d0 \uc874\uc7ac\ud558\ub294 \ucde8\uc57d\uc810\uc774\ub098 \uc624\ub958 \uc870\uac74(error condition)\uc744 \uacf5\uaca9\ud558\uae30 \uc704\ud574 \uc804\uc1a1 \uacc4\uce35 \ud5e4\ub354\uc758 \ud56d\ubaa9\uc744 \uc545\uc6a9\ud558\ub294 \ud328\ud0b7\uc774\ub098 \ud328\ud0b7\ub4e4\ub85c \uc815\uc758\ub41c\ub2e4.<\/p>\n

 \uc804\uc1a1 \uacc4\uce35 \uacf5\uaca9\uc740 \ub2e4\uc74c\uacfc \uac19\uc774 \uc138 \ubd84\ub958\ub85c \ub098\ub25c\ub2e4.<\/p>\n

 — \uc5f0\uacb0 \uc790\uc6d0 \uc18c\uc9c4 : \ubaa9\ud45c \ud638\uc2a4\ud2b8\ub098 \ud638\uc2a4\ud2b8 \uc9d1\ud569\uc5d0\uc11c \uc0c8\ub85c\uc6b4 \uc5f0\uacb0\uc744 \uc11c\ube44\uc2a4\ud558\ub294 \ub370 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub294 \uc790\uc6d0\uc744 \ubaa8\ub450 \ud3ec\ud654\uc2dc\ud0a4\uae30 \uc704\ud574 \uc124\uacc4\ub41c \ud328\ud0b7. \ub300\ud45c\uc801\uc778 \uc608\ub85c SYN \ud50c\ub7ec\ub529 \ud615\ud0dc\uc758 DDoS \uacf5\uaca9\uc774 \uc788\ub2e4.<\/p>\n

 — \ud5e4\ub354 \uc545\uc6a9 : \uc545\uc758\uc801\uc73c\ub85c \uad6c\uc131\ub410\uac70\ub098 \uae68\uc9c4, \ub610\ub294 \ubcc0\uc870\ub41c \uc804\uc1a1 \uacc4\uce35 \ud5e4\ub354\ub97c \ud3ec\ud568\ud558\ub294 \ud328\ud0b7. \ub300\ud45c\uc801\uc778 \uc608\ub85c\ub294 TCP \uc5f0\uacb0\uc744 \ud30c\uad34\ud558\uae30 \uc704\ud574 \uc124\uacc4\ub41c \uac00\uc9dc RST \ud328\ud0b7\uc774 \uc788\ub2e4. \uc2a4\uce94 \uc790\uccb4\uac00 \uc545\uc758\uc801\uc778 \uac83\uc740 \uc544\ub2c8\uc9c0\ub9cc \ud3ec\ud2b8 \uc2a4\uce94\ub3c4 \uc774 \ubc94\uc8fc\uc5d0 \ud3ec\ud568\ub41c\ub2e4.<\/p>\n

 — \uc804\uc1a1 \uc2a4\ud0dd \uacf5\uaca9 : \ub9d0\ub2e8 \uc2a4\ud0dd\uc5d0 \uc874\uc7ac\ud558\ub294 \ucde8\uc57d\uc810\uc5d0 \ub300\ud55c \uc804\uc1a1 \uacc4\uce35 \uc18c\ud0dd \uacf5\uaca9\uc744 \ud3ec\ud568\ud558\ub294 \ud328\ud0b7. \uc989, \uc804\uc1a1 \uacc4\uce35 \uc815\ubcf4\ub97c \ucc98\ub9ac\ud558\ub294 \ucee4\ub110 \ucf54\ub4dc \uc790\uccb4\uac00 \uacf5\uaca9 \ubaa9\ud45c\ub2e4. \ub300\ud45c\uc801\uc778 \uc608\ub85c\ub294 \ub137\ud544\ud130 TCP \uc635\uc158 \ucc98\ub9ac \ucf54\ub4dc\uc5d0 \uc874\uc7ac\ud558\ub294 \ucde8\uc57d\uc810\uc5d0 \ub300\ud574 2004\ub144\uc5d0 \ubc1c\ud45c\ub41c \uacf5\uaca9\uc774 \uc788\ub2e4. \uc774 \uacf5\uaca9\uc740 TCP \ud328\ud0b7 \uc790\uccb4\ub97c \uacf5\uaca9\ud558\uc9c0\ub294 \uc54a\uc9c0\ub9cc \ub137\ud544\ud130 \ud504\ub808\uc784\uc6cc\ud06c\ub97c \ud1b5\ud574 \uc2a4\ud0dd\uc73c\ub85c \uc9c1\uc811 \ud6c4\ud0b9\ub418\ub294 \ucf54\ub4dc\ub97c \uacf5\uaca9\ud55c\ub2e4.<\/p>\n

 * \uc804\uc1a1 \uacc4\uce35 \uc545\uc6a9<\/span><\/p>\n

 \uc5b4\ub5a4 \uba74\uc5d0\uc11c \uc804\uc1a1 \uacc4\uce35\uc740 \ub124\ud2b8\uc6cc\ud0b9\ub41c \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uacfc \uc2a4\ud0dd \uc704\ub85c \ud1b5\uc2e0\ud558\uae30 \uc804\uc5d0 \ub098\uc624\ub294 \ub9c8\uc9c0\ub9c9 \uac8c\uc774\ud2b8\uc6e8\uc774\uae30 \ub54c\ubb38\uc5d0 \uacf5\uaca9\uc790\uc5d0\uac8c \ub9e4\ub825\uc801\uc778 \uacf5\uaca9 \ubaa9\ud45c\ub2e4. \uc804\uc1a1 \uacc4\uce35 \uc815\ubcf4\ub97c \ud3ec\ud568\ud558\ub294 \uc218\uc0c1\ud55c \ud65c\ub3d9\uc758 \ub2e4\uc218\ub294 \ub178\uace8\uc801\uc778 \uacf5\uaca9\uc774 \uc544\ub2c8\ub77c \uc815\ud0d0\uc774\ub2e4.<\/p>\n

 – \ud3ec\ud2b8 \uc2a4\uce94
 \ud3ec\ud2b8 \uc2a4\uce94\uc740 \ud2b9\uc815 IP \uc8fc\uc18c\uc5d0\uc11c \uc5b4\ub5a4 TCP\ub098 UDP \uc11c\ube44\uc2a4\uac00 \uc811\uadfc \uac00\ub2a5\ud55c\uc9c0 \uc54c\uc544\ubcf4\uae30 \uc704\ud574 \ud638\uc2a4\ud2b8\uc758 \uc815\ubcf4\ub97c \uc5bb\uc5b4\ub0b4\ub294 \uae30\uc220\uc774\ub2e4. \uacf5\uaca9\uc790\ub294 \uc2dc\uc2a4\ud15c \uc2a4\uce94\uc744 \ud1b5\ud574 \uc811\uadfc\uc774\ub098 \uacf5\uaca9\ud560 \uc11c\ube44\uc2a4\uc758 \uc815\ubcf4\ub97c \uc5bb\uae30 \ub54c\ubb38\uc5d0 \uc774\ub294 \uc131\uacf5\uc801\uc778 \uce68\ud22c\uc758 \uc911\uc694\ud55c \ub2e8\uacc4\uc77c \uc218 \uc788\ub2e4.<\/p>\n

 \ubc18\uba74 \ud3ec\ud2b8 \uc2a4\uce94\uc740 \ub2e8\uc9c0 \uc5b4\ub5a4 \uc11c\ube44\uc2a4\uac00 \uc774\uc6a9 \uac00\ub2a5\ud55c\uc9c0 \uc54c\uc544\ubcf4\ub294 \ub370\uc5d0\ub3c4 \uc911\uc694\ud55c \ub2e8\uacc4\uc77c \uc218 \uc788\ub2e4. \ud3ec\ud2b8 \uc2a4\uce94 \uc790\uccb4\uc5d0\ub294 \ubcf8\uc9c8\uc801\uc73c\ub85c \uc545\uc758\uc801\uc778 \uc5b4\ub5a4 \uac83\ub3c4 \uc5c6\ub2e4. \ud3ec\ud2b8 \uc2a4\uce94\uc740 \uc9d1\uc758 \ubaa8\ub4e0 \ubb38\uc744 \ub450\ub4dc\ub824\ubcf4\ub294 \uc0ac\ub78c\uc5d0 \ube44\uc720\ud560 \uc218 \uc788\ub2e4. \uadf8\ub7ec\ub098 \ub204\uad70\uac00\uac00 \uc9d1\uc758 \ubaa8\ub4e0 \ubb38\uc744 \ub450\ub4dc\ub9b0\ub2e4\uba74 \uc774\ub294 \uadf8\uac00 \uc9d1\uc5d0 \uce68\uc785\ud560 \uac00\uc7a5 \uc88b\uc740 \ubc29\ubc95\uc5d0 \ub300\ud55c \uc815\ubcf4\ub97c \ubaa8\uc73c\uace0 \uc788\uc744 \uc218\ub3c4 \uc788\ub2e4\ub294 \uc758\ubbf8\uae30 \ub54c\ubb38\uc5d0 \uc774\ub97c \uc54c\uc544\ucc44\ub294 \uac83\uc740 \uc911\uc694\ud55c \uc77c\uc774\ub2e4.<\/p>\n

 \ub9c8\ucc2c\uac00\uc9c0\ub85c(\uae0d\uc815 \uc624\ub958\ub97c \uc904\uc774\uae30 \uc704\ud55c \ud29c\ub2dd \uc5f0\uc2b5\uc744 \ud55c\ub2e4\ub294 \uac00\uc815\ud558\uc5d0) \ud3ec\ud2b8 \uc2a4\uce94\uc744 \ud0d0\uc9c0\ud558\ub294 \uac83\uc740 \uc88b\uc740 \uc0dd\uac01\uc774\uba70, \ub300\ubd80\ubd84\uc758 \ub124\ud2b8\uc6cc\ud06c \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uc740 \uc2a4\uce94\ub420 \ub54c \uc54c\ub9bc\uc744 \uc804\uc1a1\ud560 \uc218 \uc788\ub294 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4.<\/p>\n

 — \ucde8\uc57d\ud55c \uc11c\ube44\uc2a4\ub85c \ud3ec\ud2b8 \uc2a4\uce94 \uc77c\uce58 \uc2dc\ud0a4\uae30
 \ud3ec\ud2b8 \uc2a4\uce94\uc744 \uc704\ud574 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 \uac00\ub2a5\ud55c \ubaa8\ub4e0 \ud3ec\ud2b8\uc5d0 \ub300\ud574 \uc804\uccb4 \uc2dc\ud5d8\uc744 \uc218\ud589\ud560 \ud544\uc694\ub294 \uc5c6\ub2e4. \uc608\ub97c \ub4e4\uc5b4 OpenSSH 3.3\uacfc BIND 4.9 \uc11c\ubc84\uc758 \uce68\ud22c\uc5d0 \ub2a5\uc219\ud55c \uacf5\uaca9\uc790\ub77c\uba74 \ub098\uba38\uc9c0 65,533 \uac1c\uc758 \ud3ec\ud2b8\ub3c4 \ubaa8\ub450 \ubc14\uc778\ub529\ub41c \uc11c\ubc84\ub97c \uac00\uc9c4\ub2e4\ub294 \uc0ac\uc2e4\uc744 \uc54c\uc544\ub0b4\ub294 \uac83\uc740 \ubcc4 \uc18c\uc6a9\uc774 \uc5c6\ub2e4. \ub354\uc6b1\uc774 \uc2dc\uc2a4\ud15c\uc758 \ubaa8\ub4e0 \ud3ec\ud2b8\ub97c \uc2dc\ud5d8\ud558\uae30 \uc704\ud574 \uc0dd\uc131\ud55c \ub5a0\ub4e4\uc369\ud55c \uc2a4\uce94\uc740 \ubcf4\ud1b5\uc758 \ud3ec\ud2b8 \uc2a4\uce94 \uc784\uacc4\uce58\ub97c \ub118\uc744 \uac00\ub2a5\uc131\uc774 \ub9e4\uc6b0 \ub192\uae30 \ub54c\ubb38\uc5d0 IDS \uc758 \uacbd\uace0\ub97c \uc720\ubc1c\ud558\uae30 \uc2ed\uc0c1\uc774\ub2e4. \uacf5\uaca9\uc790 \uc785\uc7a5\uc5d0\uc11c\ub294 \ubd88\ud544\uc694\ud55c \uc8fc\ubaa9\uc744 \ubc1b\uc9c0 \uc54a\ub294 \uac83\uc774 \uc88b\ub2e4. \uacf5\uaca9\uc790\ub294 IDS\uac00 \uc2a4\uce94\uc758 \uc2e4\uc81c \ucd9c\ubc1c\uc9c0\ub97c \uacb0\uc815\ud558\uae30 \ub354 \uc5b4\ub835\uac8c \ud558\uae30 \uc704\ud574 Nmap\uc758 \ubbf8\ub07c (-D) \uc635\uc158\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4. \uc774 \uc635\uc158\uc740 \ud3ec\ud2b8 \uc2a4\uce94\uc744 \uc5ec\ub7ec \uac1c\uc758 \uc2a4\ud478\ud551\ub41c \ucd9c\ubc1c\uc9c0 \uc8fc\uc18c\ub85c \uc911\ubcf5\ub418\uac8c \ud568\uc73c\ub85c\uc368 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc774 \ub3d9\uc2dc\uc5d0 \uc5ec\ub7ec \uac1c\uc758 \ub3c5\ub9bd\uc801\uc778 \ucd9c\ubc1c\uc9c0\uc5d0 \uc758\ud574 \uc2a4\uce94\ub418\uace0 \uc788\ub294 \uac83\ucc98\ub7fc \ubcf4\uc774\uac8c \ud55c\ub2e4. \ubaa9\uc801\uc740 IDS \uc54c\ub9bc\uc744 \ubcf8 \ubcf4\uc548 \uad00\ub9ac\uc790\uac00 \uc2e4\uc81c \uc2a4\uce94 \ucd9c\ubc1c\uc9c0\ub97c \uc54c\uc544\ub0b4\uae30 \ud798\ub4e4\uac8c \ud558\ub294 \uac83\uc774\ub2e4.<\/p>\n

 — TCP \ud3ec\ud2b8 \uc2a4\uce94 \uae30\uc220
 TCP \ud3ec\ud2b8\uc758 \ud3ec\ud2b8 \uc2a4\uce94\uc5d0\ub294 \uc5c4\uccad\ub098\uac8c \ub9ce\uc740 \uae30\uc220\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4. \uc5ec\uae30\uc11c\ub294 Nmap\uc744 \uc0ac\uc6a9\ud558\uc5ec \ud3ec\ud2b8 \uc2a4\uce94 \uae30\uc220\uc744 \ub2e4\ub8f0 \uac83\uc774\ub2e4.
 TCP connect() \uc2a4\uce94 – (Nmap -sT)
 TCP SYN \ub610\ub294 \ubc18\uac1c\ubc29(half-open) \uc2a4\uce94 – (Nmap -sS)
 TCP FIN, XMAS, NULL \uc2a4\uce94 – (Nmap -sF, -sX, -sN)
 TCP ACK \uc2a4\uce94 – (Nmap -sA)
 TCP \uc720\ud734 \uc2a4\uce94(idle) \uc2a4\uce94 – (Nmap -sI)
 UDP \uc2a4\uce94 – (Nmap -sU)<\/p>\n

 \ub610 \uc2a4\uce94\uc5d0\uc11c\ub294 Nmap\uc774 \uc2a4\uce94\uc744 \uc804\uc1a1\ud558\uae30 \uc804\uc5d0 \ud574\ub2f9 \ubc29\ud654\ubcbd \uc2dc\uc2a4\ud15c\uc758 \ub3d9\uc791 \uc5ec\ubd80\ub97c \uc54c\uc544\ubcf4\uc9c0 \uc54a\uac8c(\uc989, \ud638\uc2a4\ud2b8\uc758 \ubc1c\uacac\uc744 \uc0dd\ub7b5\ud558\uac8c) \uac15\uc81c\ud558\uae30 \uc704\ud574 Nmap -P0 \uba85\ub839 \ud589 \uc635\uc158\uc744 \uc0ac\uc6a9\ud55c\ub2e4. Nmap\uc758 \uad00\uc810\uc5d0\uc11c \ubcfc \ub54c \uc2a4\uce94\ub41c \ud3ec\ud2b8\ub294 \ub2e4\uc74c\uc758 \uc138 \uc0c1\ud0dc \uc911 \ud558\ub098\uc5d0 \uc18d\ud55c\ub2e4.<\/p>\n

 \uc5f4\ub9bc : \ud3ec\ud2b8\uc5d0 \ubc14\uc778\ub529\ub41c \uc11c\ubc84\uac00 \uc788\uc73c\uba70 \uc811\uadfc \uac00\ub2a5\ud558\ub2e4.
 \ub2eb\ud798 : \ud3ec\ud2b8\uc5d0 \ubc14\uc778\ub529\ub41c \uc11c\ubc84\uac00 \uc5c6\ub2e4.
 \ud544\ud130\ub9c1\ub428 : \ud3ec\ud2b8\uc5d0 \ubc14\uc778\ub529\ub41c \uc11c\ubc84\uac00 \uc788\uc744 \uc218 \uc788\uc9c0\ub9cc \uc774\uc640 \ud1b5\uc2e0\ud558\uae30 \uc704\ud55c \uc2dc\ub3c4\ub294 \ucc28\ub2e8\ub418\uba70 Nmap\uc740 \ud3ec\ud2b8\uac00 \uc5f4\ub824\uc788\ub294\uc9c0 \ub610\ub294 \ub2eb\ud600\uc788\ub294\uc9c0 \uc54c \uc218 \uc5c6\ub2e4.<\/p>\n

 — TCP connect() \uc2a4\uce94
 \ud1b5\uc0c1\uc801\uc778 \ud074\ub77c\uc774\uc5b8\ud2b8 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud1b5\ud574 TCP \ud3ec\ud2b8\uc640 \ubc14\uc778\ub529\ub41c \uc11c\ubc84\uc640 \ud1b5\uc2e0\ud558\uace0\uc790 \ud560 \ub54c\ub294 \ub85c\uceec TCP \uc2a4\ud0dd\uc774 \ud074\ub77c\uc774\uc5b8\ud2b8 \uc785\uc7a5\uc5d0\uc11c \uc6d0\uaca9 \uc2a4\ud0dd\uacfc \uc5f0\ub3d9\ud55c\ub2e4. \ub450 \uc2a4\ud0dd\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ub370\uc774\ud130\uac00 \uc804\uc1a1\ub418\uae30 \uc804\uc5d0 \ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \uc11c\ubc84 \uc0ac\uc774\uc5d0 \uc788\uc744 \ud1b5\uc2e0\uc744 \uad00\ub9ac\ud558\ub294 \ub9e4\uac1c\ubcc0\uc218\ub97c \ud611\uc0c1\ud574\uc57c \ud55c\ub2e4. \uc774 \ud611\uc0c1\uc744 \ud45c\uc900 TCP \uc4f0\ub9ac\uc6e8\uc774 \ud578\ub4dc\uc170\uc774\ud0b9(three-way handshake) \uc774\ub77c\uace0 \ud55c\ub2e4.<\/p><\/blockquote>\n

 TCP connect() \uc2a4\uce94\uc758 \ubb38\ub9e5\uc5d0\uc11c \uc2a4\uce90\ub108\ub294 \uc2a4\uce94\ub418\ub294 \uac01 \ud3ec\ud2b8\uc5d0 SYN\uacfc \ub9c8\uc9c0\ub9c9 ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud55c\ub2e4. \uc77c\ubc18 \uc0ac\uc6a9\uc790\ub294 Nmap\uc744 \uc0ac\uc6a9\ud574\uc11c \uc774\ub7f0 \ubc29\uc2dd\uc73c\ub85c \uc6d0\uaca9 \uc2dc\uc2a4\ud15c\uc744 \uc2a4\uce94\ud560 \uc218 \uc788\ub2e4. \uc5b4\ub5a4 \ud2b9\uc218 \uad8c\ud55c\ub3c4 \ud544\uc694\uce58 \uc54a\ub2e4<\/p>\n

 — TCP SYN\uc774\ub098 \ubc18\uac1c\ubc29 \uc2a4\uce94
 SYN \uc774\ub098 \ubc18\uac1c\ubc29 \uc2a4\uce94\uc740 \ubaa9\ud45c \ud3ec\ud2b8\uac00 \uc5f4\ub838\ub294\uc9c0 \uc544\ub2c8\uba74 \ub2eb\ud614\ub294\uc9c0\ub97c \uc54c\ub824\uc8fc\ub294 SYN\/ACK \uc774\ub098 RST\/ACK \uc751\ub2f5\uc744 \ubaa8\uc73c\uae30 \uc704\ud574 \uc2a4\uce90\ub108\uac00 \uac01 TCP \ud3ec\ud2b8\ub85c SYN \ud328\ud0b7\uc744 \uc804\uc1a1\ud55c\ub2e4\ub294 \uc810\uc5d0\uc11c connect() \uc2a4\uce94\uacfc \uc720\uc0ac\ud558\ub2e4. \uadf8\ub7ec\ub098 \uc774 \uacbd\uc6b0 \uc2a4\uce94 \uc2dc\uc2a4\ud15c\uc740 \uace0\uc758\uc801\uc73c\ub85c SYN\/ACK \ub85c \uc751\ub2f5\ud558\ub294 \uc5f4\ub9b0 \ud3ec\ud2b8\ub85c ACK \ud328\ud0b7\uc744 \ubc18\ud658\ud558\uc9c0 \ubabb\ud558\uac8c \ud558\uae30 \ub54c\ubb38\uc5d0 \uc4f0\ub9ac\uc6e8\uc774 \ud578\ub4dc\uc250\uc774\ud06c\ub294 \uc644\ub8cc\ub418\uc9c0 \uc54a\ub294\ub2e4. \uadf8\ub7ec\ubbc0\ub85c SYN \uc2a4\uce94\uc740 \ud578\ub4dc\uc250\uc774\ud06c\uac00 \uc815\uc0c1\uc801\uc73c\ub85c \uc644\ub8cc\ub420 \uc218 \uc5c6\ub2e4\ub294 \uc810\uc5d0\uc11c \ubc18\uac1c\ubc29 \uc2a4\uce94\uc774\ub77c\uace0\ub3c4 \ud55c\ub2e4.<\/p>\n<\/blockquote>\n

 connect() \uc2dc\uc2a4\ud15c \ud638\ucd9c\uc740 \ubaa9\ud45c\ub85c\ubd80\ud130 \uc218\uc2e0\ud55c SYN\/ACK \uc5d0 \ub300\ud574 ACK\uc73c\ub85c \uc751\ub2f5\ud558\ub294 \ubc14\ub2d0\ub77c TCP \uc2a4\ud0dd \ucf54\ub4dc\ub97c \ud638\ucd9c\ud558\uae30 \ub54c\ubb38\uc5d0 SYN \uc2a4\uce94\uc5d0\ub294 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\ub2e4. \uadf8\ub7ec\ubbc0\ub85c SYN \uc2a4\uce94\uc5d0\uc11c \uc804\uc1a1\ub418\ub294 \ubaa8\ub4e0 SYN \ud328\ud0b7\uc740 TCP \uc2a4\ud0dd \uc804\uccb4\ub97c \uc6b0\ud68c\ud558\ub294 \uae30\ubc95\uc744 \uc774\uc6a9\ud574\uc11c \uc0dd\uc131\ud574\uc57c \ud55c\ub2e4. \uc774 \uc791\uc5c5\uc5d0\ub294 \ubcf4\ud1b5 OS \ucee4\ub110\uc758 \uc804\uc1a1 \uc2dc SYN \ud328\ud0b7\uc744 \ubaa8\ubc29\ud558\ub294 \ub370\uc774\ud130 \uad6c\uc870\ub97c \ub9cc\ub4e4\uae30 \uc704\ud574 \uc6d0\uc2dc \uc18c\ucf13\uc744 \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n

 — \uc6d0\uc2dc \uc18c\ucf13\uacfc \uc6d0\ud558\uc9c0 \uc54a\uc740 SYN\/ACK
 \uc6d0\uaca9 \uc2dc\uc2a4\ud15c\uc5d0 \ub300\ud55c TCP SYN \ud328\ud0b7\uc744 \uc0dd\uc131\ud558\uae30 \uc704\ud574 connect() \uc2dc\uc2a4\ud15c \ud638\ucd9c \ub300\uc2e0 \uc6d0\uc2dc \uc18c\ucf13\uc744 \uc0ac\uc6a9\ud558\ub294 \uac83\uc740 \ud765\ubbf8\ub85c\uc6b4 \uc7c1\uc810\uc744 \uc720\ubc1c\ud55c\ub2e4. \uc6d0\uaca9 \ud638\uc2a4\ud2b8\uac00 SYN\/ACK \ub85c \uc751\ub2f5\ud558\uba74 \uc2a4\uce94 \uc2dc\uc2a4\ud15c\uc0c1\uc758 \ub85c\uceec TCP \uc2a4\ud0dd\uc740 SYN\/ACK \ub97c \uc218\uc2e0\ud558\uc9c0\ub9cc \uc544\uc6c3\ubc14\uc6b4\ub4dc SYN \ud328\ud0b7\uc740 \ub85c\uceec \uc2a4\ud0dd\uc73c\ub85c\ubd80\ud130 \uc628 \uac83\uc774 \uc544\ub2c8\ub2e4(\uc6d0\uc2dc \uc18c\ucf13\uc744 \ud1b5\ud574 SYN\uc744 \uc0dd\uc131\ud588\uae30 \ub54c\ubb38). \uadf8\ub7ec\ubbc0\ub85c SYN\/ACK \ub294 \uc2a4\ud0dd\uc774 \uad00\ub828\ub418\ub294 \ud55c \uc815\ub2f9\ud55c TCP \ud578\ub4dc\uc250\uc774\ud06c\uc758 \uc77c\ubd80\uac00 \uc544\ub2c8\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \uc2a4\uce90\ub108\uc758 \ub85c\uceec \uc2a4\ud0dd\uc740 SYN\/ACK \ud328\ud0b7\uc744 \uc6d0\ud558\uc9c0 \uc54a\uc740 \ud328\ud0b7\uc73c\ub85c \ubcf4\uace0 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc5d0 RST\uc744 \uc804\uc1a1\ud55c\ub2e4. \uc774\ub7ec\ud55c \uc2a4\uce94 \uc2dc\uc2a4\ud15c\uc758 \ub3d9\uc791\uc740 \uba85\ub839\uc5b4\ub85c \uc2a4\uce94\uc744 \uc2dc\uc791\ud558\uae30 \uc804\uc5d0 \ub2e4\uc74c\uacfc \uac19\uc740 iptables \uaddc\uce59\uc744 OUTPUT \uccb4\uc778\uc5d0 \ucd94\uac00\ud574\uc11c \ub9c9\uc744 \uc218 \uc788\ub2e4.<\/p>\n

 # iptables -I OUTPUT 1 -d target -p tcp –tcp-flags RST RST -j DROP<\/p><\/blockquote>\n

 Nmap\uc740 SYN \uc2a4\uce94 \ubaa8\ub4dc(-sS, \ud2b9\uc218 \uad8c\ud55c\uc744 \uac00\uc9c4 \uc0ac\uc6a9\uc790\ub97c \uc704\ud55c \uae30\ubcf8 \uc2a4\uce94 \ubaa8\ub4dc)\uc5d0 \uc0ac\uc6a9\ub418\ub294 TCP SYN \ud328\ud0b7\uc744 \uc9c1\uc811 \ub9cc\ub4e4\uae30 \uc704\ud574 \uc6d0\uc2dc \uc18c\ucf13\uc744 \uc0ac\uc6a9\ud55c\ub2e4. \uc774\ub7ec\ud55c \ud328\ud0b7\uc758 \ud2b9\uc9d5\uc740 (\ub85c\uceec TCP \uc2a4\ud0dd\uc744 \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uace0) Nmap \uc5d0 \uc758\ud574 \uc9c1\uc811 \uacb0\uc815\ub418\uae30 \ub54c\ubb38\uc5d0 \uc2a4\ud0dd\uc774 \uc77c\ubc18\uc801\uc73c\ub85c \uc0dd\uc131\ud558\ub294 TCP SYN \ud328\ud0b7\uacfc\ub294 \uc0c1\ub2f9\ud788 \ub2e4\ub974\ub2e4. <\/p>\n

 \uc2e4\uc81c TCP \uc2a4\ud0dd\uc774 \uc0dd\uc131\ud558\ub294 SYN \ud328\ud0b7\uacfc \ub2ec\ub9ac Nmap\uc740 \uc2e4\uc81c TCP \uc138\uc158\uc758 \ud611\uc0c1\uc744 \uc2e0\uacbd\uc4f0\uc9c0 \uc54a\ub294\ub2e4. Nmap\uc758 \uc720\uc77c\ud55c \uad00\uc2ec\uc0ac\ub294 \uc6d0\uaca9 \ud638\uc2a4\ud2b8\uc758 \ud3ec\ud2b8\uac00 \uc5f4\ub838\ub294\uc9c0 (Nmap\uc740 SYN\/ACK\ub97c \uc218\uc2e0\ud568), \ub2eb\ud600\uc788\ub294\uc9c0(Nmap\uc740 RST\/ACK\uc744 \uc218\uc2e0\ud568), \uc544\ub2c8\uba74 \ud544\ud130\ub9c1\ub410\ub294\uc9c0(Nmap\uc740 \uc544\ubb34\uac83\ub3c4 \uc218\uc2e0\ud558\uc9c0 \uc54a\uc74c)\ub2e4. \uadf8\ub7ec\ubbc0\ub85c Nmap\uc774 \uc804\uc1a1\ud558\ub294 TCP SYN \ud328\ud0b7\uc740 \uc6d0\uaca9 TCP \uc2a4\ud0dd\uc774 SYN\/ACK, RST\/ACK\uc73c\ub85c \uc751\ub2f5\ud558\uac70\ub098 \uc751\ub2f5\ud558\uc9c0 \uc54a\uac8c(\ud3ec\ud2b8\uac00 \ud544\ud130\ub9c1\ub41c \uacbd\uc6b0) SYN \ud50c\ub798\uadf8\ub97c \uc124\uc815\ud55c TCP \ud328\ud0b7\uc73c\ub85c\uc11c \uc6d0\uaca9 \ud638\uc2a4\ud2b8\uc5d0 \uc801\ud569\ud558\uae30\ub9cc \ud558\uba74 \ub41c\ub2e4.<\/p>\n

 — TCP FIN, XMAS, NULL \uc2a4\uce94
 FIN, XMAS, NULL \uc2a4\uce94\uc740 (RFC\ub97c \ub530\ub974\ub294) \ubaa8\ub4e0 TCP \uc2a4\ud0dd\uc774 \ud3ec\ud2b8\uc5d0\uc11c SYN, ACK, RST \uc81c\uc5b4 \ube44\ud2b8\ub97c \uc124\uc815\ud558\uc9c0 \uc54a\uc740 \ub73b\ubc16\uc758 TCP \ud328\ud0b7\uc744 \uc218\uc2e0\ud55c \uacbd\uc6b0 \ud2b9\uc815\ud55c \ubc29\ubc95\uc73c\ub85c \uc751\ub2f5\ud574\uc57c \ud55c\ub2e4\ub294 \uc0ac\uc2e4\uc5d0 \uae30\ubc18\ud574\uc11c \ub3d9\uc791\ud55c\ub2e4. \ud3ec\ud2b8\uac00 \ub2eb\ud600\uc788\ub2e4\uba74 TCP\ub294 RST\/ACK\uc73c\ub85c \uc751\ub2f5\ud558\uc9c0\ub9cc \ud3ec\ud2b8\uac00 \uc5f4\ub824\uc788\ub2e4\uba74 TCP\ub294 \uc5b4\ub5a4 \ud328\ud0b7\uc73c\ub85c\ub3c4 \uc751\ub2f5\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

 — TCP ACK \uc2a4\uce94
 TCP ACK \uc2a4\uce94 (Nmap -sA)\uc740 \uc2a4\uce94\ub418\ub294 \uac01 \ud328\ud0b7\uc5d0 TCP ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\uace0 \uc5f4\ub9b0 \ud3ec\ud2b8\uc640 \ub2eb\ud78c \ud3ec\ud2b8\ub85c\ubd80\ud130 RST \ud328\ud0b7(RST\/ACK \ud328\ud0b7\uc774 \uc544\ub2d8)\uc744 \uae30\ub2e4\ub9b0\ub2e4. \ubaa9\ud45c \ud3ec\ud2b8\uc5d0\uc11c RST \ud328\ud0b7\uc774 \ubc18\ud658\ub418\uc9c0 \uc54a\uc73c\uba74 Nmap\uc740 \ud574\ub2f9 \ud3ec\ud2b8\uac00 \ud544\ud130\ub9c1\ub41c \uac83\uc73c\ub85c \ucd94\uc815\ud55c\ub2e4.<\/p>\n

 ACK \uc2a4\uce94\uc758 \ubaa9\uc801\uc740 \ud3ec\ud2b8\uac00 \uc5f4\ub824\uc788\uac70\ub098 \ub2eb\ud600\uc788\ub294\uc9c0\ub97c \uacb0\uc815\ud558\ub294 \uac83\uc774 \uc544\ub2c8\ub77c \ud3ec\ud2b8\uac00 \uc0c1\ud0dc\uc720\uc9c0\ud615 \ubc29\ud654\ubcbc\uc5d0 \uc758\ud574 \ud544\ud130\ub9c1\ub418\ub294\uc9c0 \uc5ec\ubd80\ub97c \uacb0\uc815\ud558\ub294 \uac83\uc774\ub2e4. \ub137\ud544\ud130 \uc5f0\uacb0\ucd94\uc801 \ud558\uc704\uc2dc\uc2a4\ud15c(\uc0c1\ud0dc \ub9e4\uce6d\uc744 \ud1b5\ud574)\uc0ac\uc6a9\ub420 \ub54c\ub9c8\ub2e4 iptables \ubc29\ud654\ubcbd\uc740 \uc0c1\ud0dc\uc720\uc9c0\ud615\uc774\uae30 \ub54c\ubb38\uc5d0 \ub73b\ubc16\uc758 ACK \ud328\ud0b7\uc740 \ubc29\ud654\ubcbd \uc2dc\uc2a4\ud15c\uc758 TCP \uc2a4\ud0dd\uc5d0 \ub3c4\ub2ec\ud560 \uc218 \uc5c6\ub2e4. \uadf8\ub7ec\ubbc0\ub85c RST \ud328\ud0b7\uc774 \uc2a4\uce90\ub108\ub85c \ubc18\ud658\ub418\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

 — TCP \uc720\ud734 \uc2a4\uce94
 TCP \uc720\ud734(Idle) \uc2a4\uce94\uc740 \uc138 \uac1c\uc758 \uc2dc\uc2a4\ud15c(\uc2a4\uce94\uc744 \uc2dc\uc791\ud558\ub294 \uc2dc\uc2a4\ud15c, \uc2a4\uce94 \ubaa9\ud45c, \uc774\uc6a9\ub960\uc774 \uc791\uc740[\uc5ec\uae30\uc11c \uc774 \uc2a4\uce94 \uc774\ub984\uc758 “\uc720\ud734” \ubd80\ubd84\uc774 \ub098\uc654\ub2e4] TCP \uc11c\ubc84\ub97c \uc2e4\ud589 \uc911\uc778 \uc880\ube44 \ud638\uc2a4\ud2b8)\uc744 \ud544\uc694\ub85c \ud558\ub294 \uace0\uae09 \uc2a4\uce94 \ubc29\uc2dd\uc774\ub2e4.<\/p>\n

 \uc720\ud734 \uc2a4\uce94\uc740 IP\uac00 IP \uc2a4\uce91\uc744 \ud1b5\ud574 \uc804\uc1a1\ub418\ub294 \ubaa8\ub4e0 \ud328\ud0b7\uc5d0 \ub300\ud574 IP ID \uac12\uc744 1\uc529 \uc99d\uac00\uc2dc\ud0a8\ub2e4\ub294 \uc0ac\uc2e4\uc744 \uc774\uc6a9\ud574\uc11c \uacf5\uaca9\ud560 \uc218 \uc788\ub2e4. \uc720\ud734 \uc2a4\uce94\uc740 \uc774 \uc0ac\uc2e4\uacfc \ud568\uaed8 TCP \uc2a4\uce94\uc774 \uc5f4\ub9b0 \ud3ec\ud2b8\ub85c\uc758 SYN \ud328\ud0b7\uc5d0 \ub300\ud55c \uc751\ub2f5\uc73c\ub85c SYN\/ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\uac70\ub098 \ub2eb\ud78c \ud3ec\ud2b8\ub85c\uc758 SYN \ud328\ud0b7\uc5d0 \ub300\ud55c \uc751\ub2f5\uc73c\ub85c RST\/ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud574\uc57c \ud55c\ub2e4\ub294  \uc694\uad6c\uc0ac\ud56d\ub3c4 \uc774\uc6a9\ud55c\ub2e4. \ub610 \ubaa8\ub4e0 TCP \uc2a4\ud0dd\uc740 \uc6d0\ud558\uc9c0 \uc54a\uc740 RST\/ACK \ud328\ud0b7\uc744 \ubb34\uc2dc\ud574\uc57c \ud55c\ub2e4. \uc2a4\uce90\ub108\ub294 \uc774\ub7ec\ud55c \uc0ac\uc2e4\uc744 \uc774\uc6a9\ud574\uc11c \uc880\ube44 \ud638\uc2a4\ud2b8\uac00 \uc2a4\uce90\ub108\uc5d0\uc11c \uc880\ube44 \ud638\uc2a4\ud2b8\ub85c \uc720\uc9c0\ub418\ub294 TCP \uc138\uc158\ub3d9\uc548 IP ID \uac12\uc744 \uc5b4\ub5bb\uac8c \uc99d\uac00\ub418\ub294\uc9c0 \uc9c0\ucf1c\ubcf8\ub2e4. \uc774\uc640 \ub3d9\uc2dc\uc5d0 \uc2a4\uce90\ub108\ub294 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc880\ube44 \ud638\uc2a4\ud2b8\uc758 IP \uc8fc\uc18c\ub85c SYN \ud328\ud0b7\uc744 \uc2a4\ud478\ud551\ud55c\ub2e4. \uacb0\uacfc\uc801\uc73c\ub85c \uc2a4\uce90\ub108\ub294 \uc880\ube44 \uc2dc\uc2a4\ud15c\uc73c\ub85c\ubd80\ud130 \uc804\uc1a1\ub418\ub294 \ud328\ud0b7\uc758 IP \ud5e4\ub354\uc5d0 \uc788\ub294 IP ID \uac12\uc744 \uac10\uc2dc\ud560 \uc218 \uc788\uc73c\uba70, \uc774 \uc815\ubcf4\ub97c \uc774\uc6a9\ud574\uc11c \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 \ud3ec\ud2b8\uac00 \uc5f4\ub824\uc788\ub294\uc9c0 \uc544\ub2c8\uba74 \ub2eb\ud600\uc788\ub294\uc9c0\ub97c \uc608\uce21\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 \uc2a4\uce90\ub108\uac00 \uc880\ube44\uc758 IP \uc8fc\uc18c\ub85c \uc2a4\ud478\ud551\ub41c \ucd9c\ubc1c\uc9c0 IP \uc8fc\uc18c\ub97c \uac00\uc9c0\ub294 SYN \ud328\ud0b7\uc744 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 \uc5f4\ub9b0 \ud3ec\ud2b8\ub85c \uc804\uc1a1\ud558\uba74 \ubaa9\ud45c\ub294 SYN\/ACK \uc73c\ub85c (\uc880\ube44 \uc2dc\uc2a4\ud15c\uc5d0) \uc751\ub2f5\ud55c\ub2e4. \uc880\ube44\uac00 \uc218\uc2e0\ud55c SYN \ud328\ud0b7\uc740 \uc2e4\uc81c\ub85c \uc6d0\ud558\uc9c0 \uc54a\uc740 \uac83\uc774\uae30 \ub54c\ubb38\uc5d0(\uc2a4\uce90\ub108\uac00 \uc2a4\ud478\ud551\ud55c \uac83) \uc880\ube44\ub294 RST\ub85c \uc751\ub2f5\ud558\uba70, \uc774\ub54c IP Id \uce74\uc6b4\ud130\ub97c 1\ub9cc\ud07c \uc99d\uac00\uc2dc\ud0a8\ub2e4. \uc2a4\uce90\ub108\uac00 \ub2eb\ud78c \ud3ec\ud2b8\ub85c SYN \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\uba74(\uc5ed\uc2dc \ucd9c\ubc1c\uc9c0 IP \uc8fc\uc18c\ub294 \uc2a4\ud478\ud551\ub428) \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc740 RST\/ACK \ub85c \uc880\ube44\uc5d0 \uc751\ub2f5\ud558\uba70, \uc880\ube44\ub294 \uc6d0\ud558\uc9c0 \uc54a\uc740 \ud328\ud0b7\uc744 \ubb34\uc2dc\ud55c\ub2e4. \uc774 \uacbd\uc6b0 \uc880\ube44\ub85c\ubd80\ud130 \uc5b4\ub5a4 \ud328\ud0b7\ub3c4 \uc804\uc1a1\ub418\uc9c0 \uc54a\uc73c\ubbc0\ub85c IP ID \uac12\uc740 \uc99d\uac00\ub418\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

 \uc2a4\uce90\ub108\ub294 IP ID \uac12\uc774 \uc5b4\ub5bb\uac8c \uc99d\uac00\ub418\ub294\uc9c0\ub97c \uac10\uc2dc\ud574\uc11c(\ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 \uc5f4\ub9b0 \ud3ec\ud2b8\uc5d0 \ub300\ud574\uc11c\ub294 1\ub9cc\ud07c \uc99d\uac00\ub418\uba70 \ub2eb\ud78c \ud3ec\ud2b8\uc5d0 \ub300\ud574\uc11c\ub294 \uc99d\uac00\ub418\uc9c0 \uc54a\uc74c) \ubaa9\ud45c\uc758 \uc5b4\ub290 \ud3ec\ud2b8\uac00 \uc5f4\ub824\uc788\ub294\uc9c0 \uc720\ud6c4\ud560 \uc218 \uc788\ub2e4. \uadf8\ub7ec\ub098 idel \uc2a4\uce94\uc758 \uc131\uacf5\uc5d0 \uac00\uc7a5 \uc911\uc694\ud55c \uc694\uc18c\ub294 \uc880\ube44\uc5d0\uc11c \uc774\uc6a9\ud560 \uc218 \uc788\ub294 \uc11c\ube44\uc2a4\uc758 \uc774\uc6a9\ub960\uc774\ub2e4. \ub110\ub9ac \uc4f0\uc774\ub294 \uc6f9\uc11c\ubc84\ub294 \uc880\ube44\ub85c \uc801\ud569\ud558\uc9c0 \uc54a\ub2e4. \uc774 \uacbd\uc6b0 \ubaa8\ub4e0 TCP \uc5f0\uacb0\uc774 IP ID \uac12\uc744 \uc99d\uac00\uc2dc\ud0a4\uae30 \ub54c\ubb38\uc5d0 \ub300\ubd80\ubd84\uc758 \uacbd\uc6b0 \uc2a4\uce90\ub108\uac00 \uc81c\uc5b4\ud560 \uc218 \uc5c6\ub294 \uc18d\ub3c4\ub85c IP ID \uac12\uc774 \uc99d\uac00\ub418\uba70, \uacb0\uad6d IP ID \uac12\uc758 \ubcc0\ud654\ub97c \uc2a4\uce94\ub41c \ud3ec\ud2b8\uc5d0 \uc801\uc6a9\ud560 \uc218 \uc5c6\uac8c \ub41c\ub2e4.<\/p>\n

 \uc720\ud734 \uc2a4\uce94\uc758 \ubaa9\ud45c\uac00 \ub418\ub294 \uc2dc\uc2a4\ud15c\uc740 \uc880\ube44 \ud638\uc2a4\ud2b8\ub85c\ubd80\ud130 \uc804\uc1a1\ub41c \uc2a4\ud478\ud551\ub41c SYN \ud328\ud0b7\ub9cc\uc744 \ubcf4\uae30 \ub54c\ubb38\uc5d0 \uc2a4\uce94\uc758 \uc2e4\uc81c \ucd9c\ubc1c\uc9c0\ub97c \uc54c \uc218 \uc5c6\ub2e4. \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 iptables \ub85c\uadf8\ub294 \uc815\uc0c1\uc801\uc778 SYN \uc2a4\uce94\ucc98\ub7fc \ubcf4\uc778\ub2e4.<\/p>\n

 — \uc880\ube44 \ud638\uc2a4\ud2b8\uc5d0\uc11c \uae30\ubcf8 \ubc84\ub9ac\uae30 \ubc29\ud654\ubcbd\uc774 \uc2e4\ud589 \uc911\uc774\ub77c\uba74 \uc720\ud734 \uc2a4\uce94\uc774 \ub3d9\uc791\ud560 \uc218 \uc788\ub294 \uc720\uc77c\ud55c \ubc29\ubc95\uc740 \uc2a4\uce90\ub108\uac00 \ucd9c\ubc1c\uc9c0 \ud3ec\ud2b8\ub97c \uc880\ube44\uc758 \uc5f4\ub9b0 TCP \ud3ec\ud2b8\ub85c \ud558\ub4dc \ucf54\ub529\ud558\ub294 \uac83\uc774\ub2e4. \uc880\ube44 TCP \uc2a4\ud0dd\uc740 \ud544\ud130\ub9c1\ub41c SYN\/ACK \uc744 \ubcfc \uc218 \uc5c6\uc73c\ubbc0\ub85c RST\ub97c \uc804\uc1a1\ud558\uc9c0 \uc54a\uc744 \uac83\uc774\uba70, IP ID\ub3c4 \uc99d\uac00\ub418\uc9c0 \uc54a\uae30 \ub54c\ubb38\uc774\ub2e4. \ubc29\ud654\ubcbd\uc774 \uc124\uce58\ub41c \uacbd\uc6b0\uc5d0\ub294 \uc774\uc6a9\ub960\uc774 \ub0ae\uc740 \uc11c\ube44\uc2a4\uac00 \uc720\uc77c\ud558\uac8c \uc774\uc6a9 \uac00\ub2a5\ud55c \ud3ec\ud2b8\uc77c \uc218\ub3c4 \uc788\ub2e4.<\/p><\/blockquote>\n

 – UDP \uc2a4\uce94
 UDP\ub294 \uc5f0\uacb0\uc744 \uc218\ub9bd\ud558\uae30 \uc704\ud55c \uc81c\uc5b4 \uba54\uc2dc\uc9c0\ub97c \uad6c\ud604\ud558\uc9c0 \uc54a\uae30 \ub54c\ubb38\uc5d0 UDP \uc11c\ube44\uc2a4\uc5d0 \ub300\ud55c \uacf5\uaca9\uc740 \uac04\ub2e8\ud558\uba70, UDP \ud3ec\ud2b8\ub85c \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud55c \ud6c4 \uc801\ub2f9\ud55c \uc2dc\uac04 \ub0b4\uc5d0 \uc751\ub2f5\uc774 \uc624\ub294\uc9c0 \uc54c\uc544\ubcf4\ub294 \ubc29\uc2dd\uc73c\ub85c \uc218\ud589\ub41c\ub2e4. \uc11c\ubc84\uac00 \ub300\uae30\ud558\uace0 \uc788\uc9c0 \uc54a\ub294 \ud544\ud130\ub9c1\ub418\uc9c0 \uc54a\uc740 \ud3ec\ud2b8\ub85c UDP \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\uba74 ICMP \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00 \uba54\uc2dc\uc9c0\ub97c \ubc1b\uae30 \ub54c\ubb38\uc5d0 \uc2a4\uce90\ub108\ub294 UDP \ud3ec\ud2b8\uac00 \ub2eb\ud614\ub294\uc9c0 \uc5ec\ubd80\ub97c \uc27d\uac8c \uc54c \uc218 \uc788\ub2e4.<\/p>\n

 \ubc18\uba74 \uc5f4\ub9b0 \ud3ec\ud2b8\ub85c UDP \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\uba74 \uc774 \ud328\ud0b7\uc774 \ud544\ud130\ub9c1\ub418\uc9c0 \uc54a\uc558\ub2e4 \ud558\ub354\ub77c\ub3c4 \uc751\ub2f5\uc744 \uc804\ud600 \ubc1b\uc9c0 \ubabb\ud560 \uc218\ub3c4 \uc788\ub2e4. \uc774\ub294 UDP \uc11c\ubc84\uac00 \uc751\ub2f5\ud574\uc57c \ud560 \uc758\ubb34\ub97c \uac00\uc9c0\uc9c0 \uc54a\uae30 \ub54c\ubb38\uc774\ub2e4. \uc11c\ubc84\uac00 \uc751\ub2f5\ud558\ub294\uc9c0 \uc5ec\ubd80\ub294 \uc804\uc801\uc73c\ub85c \ud3ec\ud2b8\uc5d0 \ubc14\uc778\ub529\ub41c \ud2b9\uc815 \uc11c\ubc84 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc758 \uacb0\uc815\uc5d0 \ub2ec\ub824\uc788\ub2e4.<\/p>\n

 \ubc29\ud654\ubcbd\uc774 \ud2b9\uc815 \ud3ec\ud2b8\uc5d0 \ub300\ud55c UDP \ud328\ud0b7\uc744 \uc2a4\uce90\ub108\ub85c\ubd80\ud130 \ucc28\ub2e8\ud558\uba74 \uc2a4\uce90\ub108 \uc785\uc7a5\uc5d0\uc11c\ub294 \uc544\ubb34 \uc751\ub2f5\ub3c4 \ubc1b\uc9c0 \ubabb\ud558\ubbc0\ub85c \ud3ec\ud2b8\uc5d0 \ubc14\uc778\ub529\ub41c UDP \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc751\ub2f5\uc744 \ud558\uc9c0 \uc54a\ub294 \uac83\ucc98\ub7fc \ubcf4\uc778\ub2e4(\uc774\ub294 \ud544\ud130\ub9c1 \ub418\ub294 \ud3ec\ud2b8\uac00 Nmap\uc5d0 \uc758\ud574 open|filtered \ub85c \ubcf4\uace0\ub418\uae30 \ub54c\ubb38\uc774\ub2e4).<\/p>\n

 – \ud3ec\ud2b8 \uc2a4\uc715
 \ud3ec\ud2b8 \uc2a4\uc715(sweep)\uc740 \ud3ec\ud2b8 \uc2a4\uce94\uacfc \uc720\uc0ac\ud55c \uc815\ud0d0 \ubc29\ubc95\uc774\ub2e4. \uadf8\ub7ec\ub098 \ud3ec\ud2b8 \uc2a4\uc715\uc740 \ub2e8\uc77c \ud638\uc2a4\ud2b8\uc5d0\uc11c \uc811\uadfc \uac00\ub2a5\ud55c \uc11c\ube44\uc2a4\ub97c \uc54c\uc544\ubcf4\ub294 \uac83\uc774 \uc544\ub2c8\ub77c \uc5ec\ub7ec \ud638\uc2a4\ud2b8\uc5d0 \ub300\ud574 \ub2e8\uc77c \uc11c\ube44\uc2a4\uc758 \uc774\uc6a9 \uac00\ub2a5\uc131\uc744 \ud655\uc778\ud558\ub294 \uac83\uc774\ub2e4. \ubcf4\uc548 \uad00\uc810\uc5d0\uc11c \ubcf4\uba74 \ud3ec\ud2b8 \uc2a4\uc715\uc740 \ud55c \uc2dc\uc2a4\ud15c\uc774 \uc6dc\uc5d0 \uc758\ud574 \uce68\ud22c\ub2f9\ud574\uc11c \uc0c8\ub85c \uac10\uc5fc\uc2dc\ud0ac \ubaa9\ud45c\ub97c \ucc3e\uace0 \uc788\ub294 \uacbd\uc6b0\uac00 \ub9ce\uae30 \ub54c\ubb38\uc5d0 \ud3ec\ud2b8 \uc2a4\uce94\ubcf4\ub2e4 \ub354 \uc2ec\uac01\ud55c \uac83\uc774\ub2e4. \ub124\ud2b8\uc6cc\ud06c\uc5d0 \ub2e4\uc218\uc758 \uc708\ub3c4\uc6b0 \uc2dc\uc2a4\ud15c(\ubcf4\ud1b5 \uc6dc\uc758 \uc8fc\uc694 \ubaa9\ud45c)\uc774 \uc2e4\ud589 \uc911\uc774\uba74 \ud3ec\ud2b8 \uc2a4\uc715\uc744 \ud0d0\uc9c0\ud558\ub294 \uac83\uc740 \ud3ec\ud2b8 \uc2a4\uce94\uc744 \ud0d0\uc9c0\ud558\ub294 \uac83\ubcf4\ub2e4 \ub354 \uc911\uc694\ud558\ub2e4. \uadf8\ub7ec\ub098 \uc6dc\uc5d0 \uc9c1\uba74\ud588\uc744 \ub54c\ub294 \uc218\ubd84 \ub9cc\uc5d0 \uc804 \uc138\uacc4 \uc218\ucc9c \ub300\uc758 \uc2dc\uc2a4\ud15c\uc744 \uac10\uc5fc\uc2dc\ud0a8 SQL \uc2ac\ub798\uba38(Slammer) \ub54c\ucc98\ub7fc \ube60\ub978 \ud0d0\uc9c0\uc870\ucc28 \ud070 \uc758\ubbf8\ub97c \uc9c0\ub2c8\uc9c0 \ubabb\ud560 \uc218\ub3c4 \uc788\ub2e4. \uc6dc\uc774 \ud0d0\uc9c0\ub41c \uc2dc\uc810\uc5d0\ub294 \uc870\uce58\ub97c \ucde8\ud558\uae30\uc5d4 \ub108\ubb34 \ub2a6\uc740 \uacbd\uc6b0\uac00 \ub300\ubd80\ubd84\uc774\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n

 Nmap\uc758 \uae30\ub2a5\uc744 \uc774\uc6a9\ud558\uba74 \ud2b9\uc815 \uc11c\ube44\uc2a4\uc5d0 \ub300\ud574 \ub124\ud2b8\uc6cc\ud06c \uc804\uccb4\ub97c \uc27d\uac8c \uc2a4\uc715\ud560 \uc218 \uc788\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \uacf5\uaca9\uc790\uac00 SSH \ub370\ubaac\uc744 \uacf5\uaca9\ud55c\ub2e4\uba74 Nmap\uc740 \ub2e4\uc74c\uacfc \uac19\uc774 10.0.0.8\/8 \uc11c\ube0c\ub137 \uc804\uccb4\uc5d0\uc11c SSH \uc11c\ube44\uc2a4\ub97c \uc774\uc6a9\ud560 \uc218 \uc788\ub294 \ubaa8\ub4dc \uac1c\uccb4\ub97c \ucc3e\uc744 \uc218 \uc788\ub2e4.<\/p>\n

 # nmap -P0 -p 22 -sS 10.0.0.0\/8<\/p><\/blockquote>\n

 – TCP \uc21c\uc11c \ubc88\ud638 \uc608\uce21 \uacf5\uaca9
 \uc218\ub9bd\ub41c TCP \uc5f0\uacb0\uc5d0 \ub370\uc774\ud130\ub97c \uc0bd\uc785\ud558\uae30 \uc704\ud574\uc11c \uacf5\uaca9\uc790\ub294 \ub370\uc774\ud130 \uc804\ub2ec\uc744 \ucd94\uc801\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ub418\ub294 \ud604\uc7ac\uc758 \uc21c\uc11c \ubc88\ud638\ub97c \uc54c\uc544\uc57c \ud55c\ub2e4(\ub610\ub294 \ucd94\uce21\ud574\uc57c \ud55c\ub2e4). \uc21c\uc11c \ubc88\ud638\ub294 \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud558\uae30 \uc804\uc5d0 \uc5f0\uacb0 \uc591\uce21\uc774 \uac01\uae30 \uc120\ud0dd\ud55c \ucd08\uae30 \uc21c\uc11c \ubc88\ud638\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9c4\ub2e4. \ucd08\uae30 \uc21c\uc11c \ubc88\ud638\uac00 \ubb34\uc791\uc704\ub85c \uc120\ud0dd\ub418\uac8c \ubcf4\uc7a5\ud558\uae30 \uc704\ud574 \uc77c\ubd80 TCP \uc2a4\ud0dd\uc5d0\uc11c\ub294 \uc0c1\ub2f9\ud55c \uc791\uc5c5\uc774 \uc218\ud589\ub418\uba70 \uc21c\uc11c \ubc88\ud638 \ud56d\ubaa9\uc758 \ud06c\uae30 \uc5ed\uc2dc \uacf5\uaca9\uc790\uac00 TCP \uc5f0\uacb0\uc744 \uc2a4\ub2c8\ud551\ud558\uc9c0 \ubabb\ud560 \ub54c \uc21c\uc11c \ubc88\ud638\uc758 \uc608\uce21\uc744 \uc5b4\ub835\uac8c \ud55c\ub2e4.<\/p>\n

 \ub124\ud2b8\uc6cc\ud06c \uac8c\uc774\ud2b8\uc6e8\uc774\uac00 iptables\ub97c \uc2e4\ud589 \uc911\uc77c \ub54c \ub0b4\ubd80 \ub124\ud2b8\uc6cc\ud06c\uc758 \ub204\uad70\uac00\uac00 \uc678\ubd80 TCP \uc138\uc158\uc5d0 \ub300\ud55c \uc21c\uc11c \ubc88\ud638 \uc608\uce21 \uacf5\uaca9\uc744 \ud558\uc9c0 \ubabb\ud558\uac8c \ub9c9\ub294 \uac00\uc7a5 \uc88b\uc740 \ubc29\ubc95 \uc911 \ud558\ub098\ub294 \ub0b4\ubd80 \ub124\ud2b8\uc6cc\ud06c\uc5d0\uc11c \uc2dc\uc791\ub41c \uc2a4\ud478\ud551\ub41c \ud328\ud0b7\uc744 \ubc84\ub9ac\ub294 \uaddc\uce59\uc744 \ub9cc\ub4dc\ub294 \uac83\uc774\ub2e4.<\/p>\n

 – SYN \ud50c\ub7ec\ub529
 SYN \ud50c\ub7ec\ub529(flooding)\uc740 \uc2a4\ud478\ud551\ub41c \ucd9c\ubc1c\uc9c0 \uc8fc\uc18c\ub85c\ubd80\ud130 \uc5c4\uccad\ub09c \uc591\uc758 TCP SYN \ud328\ud0b7\uc744 \uc0dd\uc131\ud55c \ud6c4 \uc774\ub97c \ud2b9\uc815 TCP \uc11c\ubc84\ub85c \uc804\ub2ec\ud55c\ub2e4. SYN \ud50c\ub7ec\ub529\uc758 \ubaa9\uc801\uc740 \ubaa9\ud45c TCP \uc2a4\ud0dd\uc774 SYN\/ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\ub294 \ub370 \uc790\uc2e0\uc758 \uc790\uc6d0\uc744 \ubaa8\ub450 \uc18c\ube44\ud558\uace0 \uc808\ub300 \ubc1b\uc744 \uc218 \uc5c6\ub294 ACK \ud328\ud0b7\uc744 \uae30\ub2e4\ub9ac\uac8c \ub9cc\ub4e4\uc5b4\uc11c \uc11c\ubc84\uac00 \ubcf8\ub798 \uc791\uc5c5\uc744 \ud558\uc9c0 \ubabb\ud558\uac8c \ud558\ub294 \uac83\uc774\ub2e4. SYN \ud50c\ub7ec\ub529\uc740 \uc11c\ube44\uc2a4 \uac70\ubd80 \uacf5\uaca9\uc774\ub2e4. iptables \ub294 limit \ub9e4\uce58\ub97c \ud1b5\ud574 \uc5b4\ub290 \uc815\ub3c4 SYN \ud50c\ub7ec\ub529 \uacf5\uaca9\uc744 \ub9c9\uc744 \uc218 \uc788\ub2e4.<\/p>\n

 # iptables -I FORWARD 1 -p tcp –syn -m limit –limit 1\/s -j ACCEPT<\/p><\/blockquote>\n

 * \uc804\uc1a1 \uacc4\uce35 \uc751\ub2f5<\/span><\/p>\n

 – TCP \uc751\ub2f5
 TCP \ubb38\ub9e5\uc5d0\uc11c \uc804\uc1a1 \uacc4\uce35\uc740 \ud1b5\uc2e0\uc744 \uc885\ub8cc\ud558\uae30 \uc704\ud55c \uace0\uc720\uc758 \uc751\ub2f5 \uba54\ucee4\ub2c8\uc998\uc744 \uac00\uc9c0\uba70, TCP RST(\uc7ac\uc124\uc815)\ub098 RST\/ACK(\uc7ac\uc124\uc815\/\uc2b9\uc778) \ud328\ud0b7\uc758 \ud615\ud0dc\ub85c \uad6c\ud604\ub41c\ub2e4. \uc774 \ud328\ud0b7\uc740 \ub354 \uc774\uc0c1 \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud560 \uc218 \uc5c6\uc73c\uba70 \ud604\uc7ac \uc0c1\ud0dc\uc640 \ubb34\uad00\ud558\uac8c \uc5f0\uacb0\uc774 \uc885\ub8cc\ub420 \uac70\ub77c\uace0 \uc218\uc2e0 TCP \uc2a4\ud0dd\uc5d0\uac8c \uc54c\ub9b0\ub2e4. RST \ud50c\ub798\uadf8\ub294 TCP \ud5e4\ub354\uc5d0\uc11c 6\ube44\ud2b8 \ub2e8\uc704\uc758 \uc81c\uc5b4 \ube44\ud2b8 \ud56d\ubaa9\uc758 \ud55c \uc694\uc18c\ub2e4. \uc774 \ud328\ud0b7\uc740 TCP \ud074\ub77c\uc774\uc5b8\ud2b8\ub098 \uc11c\ubc84\uac00 \ub354 \uc774\uc0c1 \uc9c0\uc18d\ud560 \uc218 \uc5c6\ub294 \uc0c1\ud669\uc5d0 \ubd09\ucc29\ud588\uc744 \ub54c\ub9c8\ub2e4 \uc4f0\uc774\uba70 \uc5f0\uacb0\uc758 \uc591\ucabd \ubaa8\ub450 RST\ub97c \uc804\uc1a1\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 — RST\uc640 RST\/ACK
 RFC 793\uc5d0 \ub530\ub974\uba74 TCP \uc2a4\ud0dd\uc774 RST\/ACK \ud328\ud0b7\uc744 \uc0dd\uc131\ud574\uc57c \ud558\ub294 \uacbd\uc6b0\ub294 \uc138 \uac00\uc9c0 \ubfd0\uc774\ub2e4. \ub098\uba38\uc9c0 \uacbd\uc6b0 ACK \ube44\ud2b8\ub97c \uc124\uc815\ud558\uc9c0 \uc54a\uc740 RST \ud328\ud0b7\uc774 \uc804\uc1a1\ub41c\ub2e4. \ub354\uc6b1\uc774 TCP \uc138\uc158\uc5d0\uc11c \ub9c8\uc9c0\ub9c9\uc5d0 \uc804\uc1a1\ub41c \ud328\ud0b7\uc758 ACK \ud50c\ub798\uadf8\uc640 \uc5f0\uacb0\uc744 \uc885\ub8cc\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ub418\ub294 RST \ud328\ud0b7 \uc0ac\uc774\uc5d0\ub294 \ubc18\ub300 \uad00\uacc4\uac00 \uc874\uc7ac\ud55c\ub2e4. \uc989, \ub9c8\uc9c0\ub9c9 \ud328\ud0b7\uc774 ACK \ud50c\ub798\uadf8\ub97c \uac00\uc9c0\uace0 \uc788\ub2e4\uba74 RST \ud328\ud0b7\uc740 ACK \ud50c\ub798\uadf8\ub97c \ud3ec\ud568\ud560 \uc218 \uc5c6\ub2e4. \ubc18\ub300\ub85c \ub9c8\uc9c0\ub9c9 \ud328\ud0b7\uc774 ACK \ud50c\ub798\uadf8\ub97c \ud3ec\ud568\ud558\uace0 \uc788\uc9c0 \uc54a\uc558\ub2e4\uba74 RST \ud328\ud0b7\uc740 ACK \ud50c\ub798\uadf8\ub97c \ud3ec\ud568\ud574\uc57c \ud55c\ub2e4.<\/p>\n

 — \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uacfc RST \uc0dd\uc131
 RFC 793\uc740 RST \ud328\ud0b7\uc774 \uc2b9\uc778 \uac12\uacfc \uc774\uc5d0 \ub300\uc751\ub418\ub294 ACK \uc81c\uc5b4 \ube44\ud2b8\ub97c \ud3ec\ud568\ud558\ub294 \uc0c1\ud669\uc744 \ub9e4\uc6b0 \uba85\ud655\ud788 \uba85\uc2dc\ud788\uace0 \uc788\uc9c0\ub9cc \ub9ce\uc740 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uc774 TCP \uc5f0\uacb0\uc744 \uc885\ub8cc\uc2dc\ud0a4\uae30 \uc704\ud574 RST\ub97c \uc0dd\uc131\ud560 \ub54c RFC\ub97c \ub530\ub974\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

 — SYN \ucfe0\ud0a4
 SYN \ud50c\ub7ec\ub529 \uacf5\uaca9 \ud558\uc5d0\uc11c TCP \uc2a4\ud0dd\uc774 \uc798 \ub3d9\uc791\ud558\uac8c \ud560 \uc218 \uc788\ub294 \ud765\ubbf8\ub85c\uc6b4 \ubc29\ubc95\uc740 SYN \ucfe0\uae30\ub97c \ud65c\uc131\ud654\ud558\ub294 \uac83\uc774\ub2e4. \uc218\ub3d9\ud615 IDS\uac00 \uacf5\uaca9\uc5d0 \ub300\ud55c \uc751\ub2f5\uc73c\ub85c SYN \ucfe0\ud0a4\ub97c \uad6c\ud604\ud560 \uc218\ub294 \uc5c6\uc9c0\ub9cc \ucee4\ub110\uc774 CONFIG_SYN_COOKIES \uc9c0\uc6d0\uc744 \ud65c\uc131\ud654\ud558\uace0 \ucef4\ud30c\uc77c\ub41c \ub9ac\ub205\uc2a4\uc5d0\uc11c\ub294 \ub2e4\uc74c\uacfc \uac19\uc740 \uba85\ub839\uc5b4\ub97c \uc774\uc6a9\ud574\uc11c \/proc \ud30c\uc77c\uc2dc\uc2a4\ud15c\uc744 \ud1b5\ud574 SYN \ucfe0\ud0a4\ub97c \uc27d\uac8c \ud65c\uc131\ud654\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 # echo 1 > \/proc\/sys\/net\/ipv4\/tcp_syncookies<\/p><\/blockquote>\n

 – UDP \uc751\ub2f5
 UDP \uc2a4\ud0dd\uc740 \uae30\ubcf8\uc801\uc778 \uc751\ub2f5 \ub9e4\ucee4\ub2c8\uc998\uc73c\ub85c ICMP\ub97c \ud65c\uc6a9\ud55c\ub2e4. UDP\uc11c\ubc84\uac00 \ub300\uae30 \uc911\uc774\uc9c0 \uc54a\uc740 \ud3ec\ud2b8\ub85c UDP \ud328\ud0b7\uc774 \uc804\uc1a1\ub418\uba74 \ubcf4\ud1b5 \uc751\ub2f5\uc73c\ub85c ICMP \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00(ICMP Port Unreachable) \uba54\uc2dc\uc9c0\uac00 \uc804\uc1a1\ub41c\ub2e4.<\/p>\n

 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uacfc \ubc29\ud654\ubcbd\uc740 UDP \ud2b8\ub798\ud53d\uc5d0 \ub300\ud55c \uc751\ub2f5\uc73c\ub85c\ub3c4 ICMP \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00 \uba54\uc2dc\uc9c0\ub97c \uc0dd\uc131\ud560 \uc218 \uc788\ub2e4. iptables REJECT \ud0c0\uac9f\uc740 –reject-with icmp-port-unreachable \uba85\ub839 \ud589 \uc778\uc790\ub97c \ud1b5\ud574 \uc774\ub7ec\ud55c \uc751\ub2f5\uc744 \uc9c0\uc6d0\ud55c\ub2e4.<\/p>\n

 — \ubc29\ud654\ubcbd \uaddc\uce59\uacfc \ub77c\uc6b0\ud130 ACL(Access Control List)
 RST\ub85c \uc758\uc2ec\uc2a4\ub7ec\uc6b4 TCP \uc5f0\uacb0\uc744 \uc885\ub8cc\uc2dc\ud0a4\uac70\ub098 UDP \ud2b8\ub798\ud53d\uc5d0\uc11c \uacf5\uaca9\uc744 \ud0d0\uc9c0\ud55c \ud6c4 ICMP \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00 \uba54\uc2dc\uc9c0\ub97c \uc804\uc1a1\ud558\ub294 \uac83\uacfc \uac19\uc740 \uc804\uc1a1 \uacc4\uce35 \uc751\ub2f5\uc740 \ub9ce\uc740 \uacbd\uc6b0\uc5d0 \uc720\uc6a9\ud558\ub2e4. \uadf8\ub7ec\ub098 \uc774\ub7ec\ud55c \uc751\ub2f5\uc740 \uac1c\ubcc4\uc801\uc778 TCP \uc5f0\uacb0\uc774\ub098 UDP \ud328\ud0b7\uc5d0\ub9cc \uc801\uc6a9\ub41c\ub2e4. \uacf5\uaca9\uc790\uac00 \uc0c8\ub85c\uc6b4 \uacf5\uaca9\uc744 \uc2dc\ub3c4\ud558\uc9c0 \ubabb\ud558\uac8c \ub9c9\ub294 \uc601\uc18d\uc801\uc778 \ubc29\uc5b4 \uae30\uc220\uc740 \uc5c6\ub2e4.<\/p>\n

 \ub2e4\ud589\ud788 TCP RST\ub098 ICMP \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00 \uba54\uc2dc\uc9c0\ub97c \uc804\uc1a1\ud558\ub294 \uac83\uc740 \ubc29\ud654\ubcbd \uc815\ucc45\uc758 \ucc28\ub2e8 \uaddc\uce59\uc774\ub098 \uacf5\uaca9\uc790 IP\uc640 \uacf5\uaca9\uc744 \ubc1b\uace0 \uc788\ub294 \uc11c\ube44\uc2a4\uc5d0 \ub300\ud55c \ub77c\uc6b0\ud130 ACL\uacfc \ub3d9\uc801\uc73c\ub85c \uacb0\ud569\ub420 \uc218 \uc788\ub2e4.<\/p>\n

 \uadf8\ub7ec\ub098 \uc77c\ub2e8 \uacf5\uaca9\uc790\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc774 \uc2dc\uc791\ub418\uba74 \uc774 \uaddc\uce59\uc740 \uc124\uc815 \uac00\ub2a5\ud55c \uc2dc\uac04 \ud6c4\uc5d0 \uc774\ub97c \uc81c\uac70\ud560 \uc218 \uc788\ub294 \ubcc4\ub3c4\uc758 \ucf54\ub4dc\ub97c \uc774\uc6a9\ud574\uc11c \uad00\ub9ac\ud574\uc57c \ud55c\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"

 TCP\ub294 \uc5f0\uacb0\ud615 \ud504\ub85c\ud1a0\ucf5c\uc774\ub2e4. \uc774\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \uc11c\ubc84\uac00 \uc2e4\uc81c \ub370\uc774\ud130 \uad50\ud658 \uc774\ub358\uc5d0 \ub370\uc774\ud130 \uc804\uc1a1 \ubc29\ubc95\uc744 \uc815\uc758\ud558\ub294 \ub9e4\uac1c\ubcc0\uc218\ub4e4\uc744 \ud611\uc758\ud558\uba70 \uc5f0\uacb0\uc758 \uc2dc\uc791\uacfc \ub05d\uc5d0 \uba85\ud655\ud55c \uad6c\ubd84\uc774 \uc788\ub2e4\ub294 \ub73b\uc774\ub2e4. TCP \ub294 \ub450 \ub178\ub4dc \uc0ac\uc774\uc5d0\uc11c \uc2e0\ub8b0\ud560 \uc218 \uc788\uace0 \uc21c\uc11c\ub97c \uc720\uc9c0\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud558\ubbc0\ub85c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ud504\ub85c\ud1a0\ucf5c\uc740 \uc774\ub7f0 … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[52],"tags":[218],"_links":{"self":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/748"}],"collection":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=748"}],"version-history":[{"count":0,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/748\/revisions"}],"wp:attachment":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=748"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}