Effectiveness of security tools to anomalies on tunneled traffic

• Main Authors: Bahaman, Nazrulazhar, Anton Satria, Prabuwono, Mas'ud, Mohd Zaki, Abdollah, Mohd Faizal
• Format: Article
• Language: English
• Published: Asian Network for Scientific Information 2012
• Online Access: http://eprints.utem.edu.my/id/eprint/11204/1/Effectiveness_of_Security_Tools_to_Anomalies_on_Tunneled_Traffic.pdf; http://eprints.utem.edu.my/id/eprint/11204/; https://scialert.net/fulltext/?doi=itj.2012.191.199

Tunneling Mechanism has been proven as an option to link the communication between IPv6 networks and IPv4 environments without incurring the high costs of upgrading equipment. However, this mechanism has reduced the network performance and downgrade the level of security if compared to the native IPv6 network. The Transition Mechanism has also become a covert channel for spreading threats without being acknowledged by the network security tools. Even though the issue has been raised in the set of IETF rules, still they do not provide any recommendation to overcome the problem. Based on this reason, this study explored the effectiveness of conventional network security tools to detect any anomalies occurring on a tunneling mechanism especially against packet flooding attack in IPv6 tunneling. In order to achieve this objective, a testbed that has been deployed with conventional firewall and IDS is used to simulate the IPv6 to IPv4 tunneling mechanism, several network attacks are then launched and the network traffic is then captured to be analyzed. The result shows that the firewall with the default settings had blocked all the tunneling packets, while the firewall and IDS with the default rule of set had performed well in IPv4 but not in the IPv6 tunnel.