Anonymizing packet header fields

IDS rules:
----------
Bro
-port TCP/UDP
-IP addr
-content eg filename(ftp), user(finger,ftp), ftp parses PORT requests
-time, time interval

Snort
-port TCP/UDP
-IP addr (local or nonlocal)
-content (strings in content)

NFR
-pkt filtering n-code language

Points to note:
---------------
Need to consider: Outside contextual info + Info from trace
Info from trace may not seem significant, but if put together with other info from gained by other means, can
help an attacker. So should only reveal what is necessary, and nothing more.

If the network the trace was taken from is given, could analyze patterns in trace and patterns in actual
network based on attacker's own measurements, to identify real ip addresses.

Measurements may look different depending on where they are taken from. Where to take measurements from?

Attacks may be present in the trace eg. scans, which can reveal info about OS, open ports.

Payload: anonymize selectively? Snort's attack signatures depend on text in payload, but if we remove payload 
in background traffic, could affect false positive measurements

Sensitive data:
---------------
-Directly sensitive
   -Real IP address
   -payload data (userid/pword,encrypted info(credit card no.),encrypted msg,form data,messages(email,im),
                  filenames,file contents,url name)
-Indirectly sensitive (how much additional external info must a hacker have for this field to reveal sensitive information?)

   Source               | Compromised information           |   Additional information that the attacker must have
   ICMP error pkt         OS              
   IP Prefixes            Network topology
   TCP packet             OS
   IP freq analysis       real IP addresses of popular web 
                          servers
   traffic flow analysis  Distinguish clients from servers
   dns queries/responses                                        Knowledge of DNS Hierarchy
   traffic analysis       Real IP addresses                     Knowledge of which network the trace was taken from,
                                                                ability to trace packets on the network
   traffic analysis       Whether an individual has been        Real IP address corresponding to an anonymized address,
                                                                real IP addresses corresponding
                          communicating with certain people     to anonymized addresses of others.


Deduction paths:
----------------
OS->individual
App->OS
Port no.->App
Protocol->Apps

Links:
------
TBIT, the TCP Behavior Inference Tool (Differences in TCP implementations) http://www.icir.org/tbit
TCP header flags (see RFC 3168) http://www.iana.org/assignments/tcp-header-flags
Common Vulnerabilities and Exposures http://www.cve.mitre.org
Google: "header checksum attack"