软考网络管理员谈防火墙及防火墙的渗透技术（Test the network administrator Technology about firewall and firewall penetration）.docVIP

软考网络管理员谈防火墙及防火墙的渗透技术（Test the network administrator Technology about firewall and firewall penetration） The working principle and advantages and disadvantages of the traditional firewall: 1. (traditional) packet filter firewall works Packet filtering is implemented on the IP layer, so it can be done only with routers. Packet filtering determines whether packets are allowed to pass through header information such as the source IP address, destination IP address, source port, destination port, and packet delivery direction of the packet. Filtering user defined content, such as IP addresses. The principle is that the system checks packets at the network level and is independent of the application layer. Packet filters are widely used because CPU can be used to handle packet filtering with negligible time. Moreover, this protective measure is transparent to users, and when legitimate users are out of the network, they simply can not feel it, and it is very convenient to use. In this way, the system has good transmission performance and easy to expand. But this firewall is not very safe, because the system of application layer information perception -- that is, they do not understand the content of the communication, not filtered at the user level, unable to distinguish different users and prevent IP address embezzlement. If an attacker sets the hosts IP address to a legitimate hosts IP address, it can easily pass through the packet filter, which is more likely to be hacked. Based on this mechanism, the packet filter firewall has the following drawbacks: Communication information: packet filtering firewalls can only access header information of some packets; Communication and application status information: packet filter firewall is stateless, so it is impossible to save state information from communications and applications; Information processing: packet filtering firewalls are limited in their ability to process information. For example, Microsoft IIS vulnerability Un