Skip to content

Port Knocking

Jump to bottom
Luca Pollini edited this page Oct 14, 2015 · 13 revisions

In this tutorial we'll show how to realize the Port Knocking application by leveraging OpenState features.

Before going further into this tutorial, you have to make sure you've already installed the OpenState softswitch in Mininet as explained here http://openstate-sdn.github.io/. The completeness of this step leads Mininet to use OpenState as its OpenFlow user space switch.

  1. Launch portknock controller application in Mininet by typing the following command:

    $ ryu-manager ryu/ryu/app/openstate/portknock.py

The port knock program composes of the following port sequence, where to actually open the last port 2000 we must first "knock" the previous 4 ports.

PORT_LIST = [10, 11, 12, 13, 22]

  1. Start Mininet with a single topology with 2 hosts:

    $ sudo mn --topo single,2 --mac --switch user --controller remote -x

  2. To actually knock on UDP ports we'll use netcat on both h1 and h2. On h2's terminal run the following command:

    h2# nc -lu 22

  3. On the h1's terminal type the following command:

    h1# nc -u 10.0.0.2 22

Type something on stdin and then press return. In this case netcat will read from stdin and send the message as a UDP packet to the specified port. Type ctrl-c to exit the nc process. As you can see from h2 no packet is received.

  1. Using netcat on h1 send packets to the following ports: 10, 11, 12, 13 (type something, press return and ctrl-c to exit the process). You can use nc as specified by the following command:

    h1# nc -u 10.0.0.2 10 ... h1# nc -u 10.0.0.2 11 ... h1# nc -u 10.0.0.2 12 ... h1# nc -u 10.0.0.2 13 ...

  2. Finally, as we completed the knock sequence port 22 should be open from h1 to h2.

    h1# nc -u 10.0.0.2 22 ...

It is possible to avoid points 5 and 6 by executing the script "test_port_knocking" in h1. This script will test an incorrect sequence and then the correct one. You have to specify the following command in h1 xterm:

h1# ~/ryu/ryu/app/openstate/test_port_knocking.sh
  1. Type something on stdin and then press return. You should see now h2 receiving packets on port 22.

To debug flow entries:

$ sudo dpctl -c unix:/tmp/s1 stats-flow table=0

To query the state table:

$ sudo dpctl -c unix:/tmp/s1 stats-state table=0
Clone this wiki locally