# SDMw: Secure Dynamic Middleware for Defeating Port and OS Scanning
## 5 SDMw: The Secure Dynamic Middleware Architecture
### The Performance of the SDMw System  
In this section, we evaluate the performance of the proposed SDMw system in terms of the latency. We implemented a simple test-bench topology that consists of two hosts running Windows OS. They are connected to a switch, which is then connected to the SDMw system. The striped-down prototype of the proposed SDMw is implemented in a Linux box with two network cards. One network card (say CARD1) is connected to the switch and the other network card (CARD2) is connected with a server machine running the HTTP service. The SDMw is implemented as a proxy-intercept service between these two network cards. The SDMw uses the native Linux TCP/IP kernel behavior. The prototype architecture is presented in Figure 3. We tested a connectionless ICMP and a connection-oriented TCP service from Host 1 and Host 2 to the server. Whenever an IP packet is received at CARD1, we record the current system time. 1. If the protocol number in the IP packet is 1 (ICMP), we keep the source and the destination IP address unchanged. We change IP-ID field and flags to reflect the underlying TCP/IP kernel behavior (as SDMw is using the native Linux kernel behavior). We then record the time in which the packet was forwarded to CARD2. The difference between the two timestamps gives us the latency due to SDMw processing, which includes OS scheduling latency. To minimize the latency due to running system services, we ran the system with only essential drivers and services. When a reply comes from the server, we simply forward it to the destination host without any modification. 2. If the protocol number in the IP packet is 6 (TCP), as before, we record the time at which the packet was received. We then inspect the TCP flag to determine its type. * If the received segment is a SYN (say with initial sequence number \(ISN_{o}\)) frame, then the source host is trying to establish a new TCP connection with the server. In this case, the SDMw system creates a new ISN (\(ISN_{n}\)), based on the underlying Linux kernel and records the mapping between <\(ISN_{o}\), \(ISN_{n}\)> in the translational table. Except for the socket  
Figure 3: Secure Dynamic Middleware (SDMw) test bench topology. information, SDMw modifies other TCP window parameters to reflect the underlying Linux behavior. The modified TCP segment is wrapped on to an IP packet, time-stamped and sent to the Server through CARD2. * Whenever a reply (SYN-ACK for \(ISN_{n}\)) arrives from the server, based on the translational table, SDMw must translate the SYN-ACK for \(ISN_{o}\). * If a DATA segment with an implicit ACK is received from an inside host, then it must be a part of an on-going connection. The Sequence (SEQ) number for the DATA component must be changed by the SDMw using the translational table. This is to reflect the change in the ISN. SDMw adds (\(ISN_{n}\)-\(ISN_{o}\)) to the original SEQ number given by the host's TCP segment to reflect the new SEQ number. Since the SEQ number from the down-stream traffic (server to host) is unchanged by SDMw, the implicit ACK for the segment from the server is unchanged. * If a DATA segment from the server is received addressed to an inside host, the SEQ numbers pertaining to the DATA are unchanged. However, any implicit ACK (for the up-stream traffic) from the server is changed to reflect the implicit ACK for the original TCP-DATA segment from the host using the translational table. * If the received TCP-segment is a FIN segment from a host, similar to the DATA segment, the SEQ number for the FIN segment is changed to reflect the change in the ISN. Any FIN segment from the down-stream traffic is unchanged. SDMw introduces the following latency for connection-oriented and connectionless IP services:  
1. The protocol field of the incoming IP packet needs to be examined in order to perform the correct action. 2. For a connectionless IP or UDP services, only the IP-ID and flag fields needs to be changed. There is no need to maintain any reference table information. 3.