Skip to main content
Fig. 5 | EURASIP Journal on Wireless Communications and Networking

Fig. 5

From: A research survey in stepping-stone intrusion detection

Fig. 5

An interactive connection chain. Host hi can only know host hi+1 is connected with it. It has no idea about the connecting situation after hi+1 in the downstream of the connection chain. If we monitor the outgoing connection from the host hi, what we know is the TCP/IP packets coming from hi and going to host hi + 1, rather than any other hosts from hi+2 to hn+1. But if there is a session between hi and hn+1, each packet sent from host hi must be acknowledged by host hi+1 first and then forwarded to the following hosts until to the destination host hn+1 of the chain. Even though the echo of a send from hi comes from host hi+1 from the point of hi, this packet is actually echoed by the destination host, rather than its directly connected host

Back to article page