The campus network Natshell_ANTI_SHALING defense agency is a routine thing. People at the university information centre have a headache about private routers.——A student dormitory with four or five devices online is normal, and some even buy a little router to set up a secondary hotspot for the entire floor. But if the proxy function is not configured correctly, it kills normal users or becomes empty. I have seen many schools' anti-agent strategy configurations run by default and are not used to switch them to their own school students’ web usage.
Let's get to the bottom of this:A pro-agent is not a single test.TTL alone. The routers fixes now can manually adjust TTL values; IP heading is the only way students can bypass it by changing their proxy configuration; application features are the only thing that changes when a version of proxy software is updated every few weeks. Effective defenses must be multi-dimensional combination tests, each dimension being cross-checked and reduced by error rates. For example, TTL testing, IP bag head characteristics, HTTP Cookie detection and clock drift monitoring are used simultaneously, and agency behaviour is determined when at least two dimensions are triggered, rather than just one condition is hit by a single life.
The first easily overlooked configuration isTest frequency. Many devices have a default detection frequency of one minute, but students are not evenly distributed in the same way with their network in the dormitory.——At the late peak, a router sharing several terminals may have created a traffic feature far beyond normal single terminal within 30 seconds. If the frequency is too slow, the student has been using an agent for more than half an hour when the system finds out. It is recommended to increase the frequency of detection to 30 seconds or even 15 seconds once, but here it is important to note how the frequency affects the system.——If 20,000 people are large, running the full-volume user test logic every second, there is pressure on the pro-agent module and CPUs at dial-up gateways. A balance point needs to be found in performance tests in the physical environment.
The second key configuration is...Tier control strategyNot a single-size cut. A single-size cut is a direct blackout of proxy behavior.——This practice has a high rate of injury, as there is indeed a legitimate multi-end use scenario, such as a student using a cell phone to heat the laptop online (as is common at academic meetings or when an experimental report is submitted). Better done is graded: first level——Terminals are within reasonable range (e.g., up to three) released but not recorded; second tier——Micromail or other IM applications detected to log in at more than three terminals simultaneously, window alarms plus log entry without interruption; level 3——The confirmed proxy behaviour (multidimensional simultaneous hits), a window warning, a temporary 15-minute stoppage if activated again within an hour, and a third delay. This both deters malicious sharing and leaves room for error in normal use.
The third detail is...MAC address binding policyThe NATSHELLL_AUTH_BILLING system can be used to set the account-MAC (a number is limited to a few MAC addresses), so that the strategic measure of the DSA can be relaxed.——Because account-MAC binding has limited an account to a maximum end-number that allows access to the Internet, surrogates are more likely to prevent secondary sharing on individual terminals. Instead, if account-MAC binding is not done, agency protection strategies must be stricter.
The fourth one that many people have missed is...White List MechanismSome of the equipment naturally shows up."Like an agent."The flow characteristics——For example, the proxy servers themselves, the public computers in the college's laboratory room and the library's self-help search terminal are exported from campus networks. These devices have a very high impact if they are killed by an agent protection strategy.——The white list cannot be maintained on a one-time basis, but there is a mechanism to update it regularly because the school’s network equipment is constantly increasing and changing.
The fifth configuration is related toWarning and Log. The agent is not just blocked, it's finished. The record must be kept in full.——The log data is particularly important in two cases: students come to the information centre and complain."My internet's gone."The duty officer can quickly find out if he was killed by a proxy strategy; second, when the school makes an income score with the operator, it needs proof."We're really serious about defense, not letting it go.". The retention time of the ADR is recommended for at least 180 days, corresponding to the retention period of the ABL.
Finally, a realistic question:A surrogate is a cat-and-daughter game. Never."Once and for all."Configuration. Students are constantly trying new ways to bypass, and proxy software is being updated. The surrogate strategy needs to be re-maped regularly.——Each month, a stop-count is drawn to see how many complaints have been blocked and how many misdirected (the proportion of complaints removed) are adjusted to test sensitivity and disposal strategies. If the complaint has a high rate of success (for example, over 30%), it means that there is a high rate of miscarriages and that the strategy needs to be relaxed; if the number of stops suddenly falls dramatically, it is not for students to behave well, but probably new ways of bypassing existing detection methods and upgrading the detection features library.