Version franšaise Tools Back home

A connection cutter

What for ?

Couic has been designed to enforce a security policy on an internal network: it listens to everything and shoots.

How does it work?

Currently, couic is based upon the libnet and libpcap libraries; in the first version, its argument had to be an expression Ó la tcpdump. I added a configuration language but it is a little "surprising".

Couic shuts the TCP connections down with RST packets and tries to disrupt UDP transfers with ICMP "host unreachable / bad port" answers.

Where is the f... manual?

There isn't any! For the configuration language, have a look at grammar.y
couic knows those options:
-i eth0
Listen on this network interface.
-f file
Read the commands from file...
-t
Next args are a tcpdump expression; couic kills everything that matches.

A few examples with tcpdump

  1. Deny any traffic on a network
    couic tcp or udp
  2. Deny any traffic to or from the gizmo machine
    couic \( tcp or udp \) and host gizmo
  3. Deny telnet on the whole network
    couic tcp and port 23

Some examples with the configuration language

  1. Deny any traffic on a network
    {any/tcp any/udp} { }
  2. Deny any traffic to or from the gizmo machine.
    {any/tcp any/udp} { deny gizmo }
  3. Deny telnet on the whole network
    {23/tcp} { }
  4. Allow telnet only between A and B
    {23/tcp} {
    allow between A and B
    }
  5. Allow telnet only from the 192.168.17.0 network
    {23/tcp} {
    allow from 192.168.17.0/24 to any
    }

The name...

Couic is a silly and meaningless name. A friend gave it a much better name: Cutting Off Unwanted IP Connections. As it is a little long, you may shorten it into couic.

To be done

Limitations

  1. Couic is not very efficient against protocols which use small UDP transfers. e.g. it cannot block the DNS service.
  2. Couic is powerless on a switched network.
  3. Couic is a dangerous weapon that can badly disrupt a network. Before you do some bad tricks against your colleagues, I want to let you know that arpwatch easily sees the packets that couic sends and that this kind of gag can cost you three years in jail in France... and probably in other countries.

Licence, copyright

This code is freely available under the GNU Public Licence, without any warranty. Companies which are victims of a malicious use of couic are kindly requested to keep me out of those affairs.
According to french law, the "intellectual right" cannot be dropped, so I may still oppose any "inappropriate" use of this tool. By "inappropriate" I mean anything that is against law (see previous paragraph) or business related and against the GPL, or any wicked trick that may hurt anyone (including me, of course).

Source

Forum

I created a mailing list to discuss about the development of this terrific tool that will soon change drastically network security ;-)
http://www.egroups.com/group/couic
Subscribe to couic-subscribe@egroups.com


Version franšaise Tools Back home
Michel Arboi
Last modified: Sun Mar 25 16:19:29 CEST 2007