Free AI web copilot to create summaries, insights and extended knowledge, download it at here

6094

Abstract

nge(len(data)):

        try:
            
            <span class="hljs-class"><span class="hljs-keyword">data</span>[i, where] = (<span class="hljs-title">data</span>[<span class="hljs-title">i</span> - <span class="hljs-title">lookback</span> + 1:<span class="hljs-title">i</span> + 1, <span class="hljs-title">close</span>].<span class="hljs-title">mean</span>())</span>
        
        except <span class="hljs-type">IndexError</span>:
            
            pass
        
<span class="hljs-class"><span class="hljs-keyword">data</span> = jump(<span class="hljs-title">data</span>, <span class="hljs-title">lookback</span>)</span>

return <span class="hljs-class"><span class="hljs-keyword">data</span></span></pre></div><div id="0f03"><pre><span class="hljs-attribute">def</span> demarker(Data, lookback, high, low, where):

<span class="hljs-comment"># Calculating DeMAX</span>
<span class="hljs-attribute">for</span> i in range(len(Data)):
    
    <span class="hljs-attribute">if</span> Data[i, high] &gt; Data[i - <span class="hljs-number">1</span>, high]:
        <span class="hljs-attribute">Data</span>[i, where] = Data[i, high] - Data[i - <span class="hljs-number">1</span>, high]
    <span class="hljs-attribute">else</span>:
        <span class="hljs-attribute">Data</span>[i, where] = <span class="hljs-number">0</span>

<span class="hljs-comment"># Calculating the Moving Average on DeMAX</span>
<span class="hljs-attribute">Data</span> = ma(Data, lookback, where, where + <span class="hljs-number">1</span>)        
        
<span class="hljs-comment"># Calculating DeMIN</span>
<span class="hljs-attribute">for</span> i in range(len(Data)):
    
    <span class="hljs-attribute">if</span> Data[i - <span class="hljs-number">1</span>, low] &gt; Data[i, low]:
        <span class="hljs-attribute">Data</span>[i, where + <span class="hljs-number">2</span>] = Data[i - <span class="hljs-number">1</span>, low] - Data[i, low]
    <span class="hljs-attribute">else</span>:
        <span class="hljs-attribute">Data</span>[i, where + <span class="hljs-number">2</span>] = <span class="hljs-number">0</span>    

<span class="hljs-comment"># Calculating the Moving Average on DeMIN</span>
<span class="hljs-attribute">Data</span> = ma(Data, lookback, where + <span class="hljs-number">2</span>, where + <span class="hljs-number">3</span>)        


<span class="hljs-comment"># Calculating DeMarker</span>
<span class="hljs-attribute">for</span> i in range(len(Data)):
    
    <span class="hljs-attribute">Data</span>[i, where + <span class="hljs-number">4</span>] = Data[i, where + <span class="hljs-number">1</span>] / (Data[i, where + <span class="hljs-number">1</span>] + Data[i, where + <span class="hljs-number">3</span>]) 

<span class="hljs-comment"># Removing Excess Columns</span>
<span class="hljs-attribute">Data</span> = deleter(Data, where, <span class="hljs-number">4</span>)

<span class="hljs-attribute">return</span> Data</pre></div><figure id="a207"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Hzlb4TnTDcvH3sxeXwjTUQ.png"><figcaption><b>EURUSD in the first panel with the 21-period Demarker in the second panel.</b></figcaption></figure><p id="9cfd">Check out my weekly market sentiment report to understand the current positioning and to estimate the future direction of several major markets through complex and simple models working side by side. Find out more about the report through this link:</p><div id="7415" class="link-block">
      <a href="https://coalescence.substack.com/">
        <div>
          <div>
            <h2>Coalescence</h2>
            <div><h3>A Weekly Report Covering FX &amp; Equities Market Positioning Using Complex Models. Let me read it first This site requires…</h3></div>
            <div><p>coalescence.substack.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*7zo8Jv6sfnts5WCL)"></div>
          </div>
        </div>
      </a>
    </div><h1 id="8210">Using the Demarker</h1><p id="0df8">I am not a strong believer in the 0.30/0.70 overbought/oversold levels as I prefer to widen them a little bit to at least 0.20/0.80. Therefore, when we see the signals on the chart following the 0.20/0.80 rule, we can get something like the below plot.</p><ul><li><b>A long (Buy) signal is generated whenever the Demarker reaches 0.20 with the previous value above 0.20.</b></li><li><b>A short (Sell) signal is generated whenever the Demarker reaches 0.80 with the previous value below 0.80.</b></li></ul><div id="ff6e"><pre><span class="hljs-keyword">def</span> <span class="hljs-title function_">signal</span>(<span class="hljs-params"><span class="hljs-title class_">Data</span>, what, buy, sell</span>)<span class="hljs-symbol">:</span></pre></div><div id="0e12"><pre><span class="hljs-type">Data</span> = adder(<span class="hljs-type">Data</span>, <span class="hljs-number">10</span>)</pre></div><div id="4a8f"><pre><span class="hljs-symbol">for</span> i in range(len(<span class="hljs-meta">Data</span>)):
        
    <span class="hljs-meta">if</span> <span class="hljs-meta">Data</span>[i, what] &lt; lower_barrier <span class="hljs-keyword">and</span> <span class="hljs-meta">Data</span>[i - <span class="hljs-number">1</span>, what] &gt; lower_barrier:
        <span class="hljs-meta">Data</span>[i + <span class="hljs-number">1</span>, buy] = <span class="hljs-number">1</span>
        
    <span class="hljs-meta">if</span> <span class="hljs-meta">Data</span>[i, what] &gt; upper_barrier <span class="hljs-keyword">and</span> <span class="hljs-meta">Data</span>[i - <span class="hljs-number">1</span>, what] &lt; upper_barrier:
        <span class="hljs-meta">Data</span>[i + <

Options

span class="hljs-number">1, sell] = -1

return <span class="hljs-meta">Data</span></pre></div><figure id="7ee7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Vwt17ycpypw7FqWrOQ2urQ.png"><figcaption><b>Signal chart.</b></figcaption></figure><p id="251c">Another strategy can be created which states that only the exit of the extreme zones will yield a trade:</p><ul><li><b>A long (Buy) signal is generated whenever the Demarker exits 0.20 with the previous value below 0.20.</b></li><li><b>A short (Sell) signal is generated whenever the Demarker exits 0.80 with the previous value above 0.80.</b></li></ul><div id="47c0"><pre><span class="hljs-keyword">def</span> <span class="hljs-title function_">signal</span>(<span class="hljs-params"><span class="hljs-title class_">Data</span>, what, buy, sell</span>)<span class="hljs-symbol">:</span></pre></div><div id="2fa6"><pre><span class="hljs-type">Data</span> = adder(<span class="hljs-type">Data</span>, <span class="hljs-number">10</span>)</pre></div><div id="f24b"><pre><span class="hljs-symbol">for</span> i in range(len(<span class="hljs-meta">Data</span>)):
        
    <span class="hljs-meta">if</span> <span class="hljs-meta">Data</span>[i, what] &gt; lower_barrier <span class="hljs-keyword">and</span> <span class="hljs-meta">Data</span>[i - <span class="hljs-number">1</span>, what] &lt; lower_barrier:
        <span class="hljs-meta">Data</span>[i + <span class="hljs-number">1</span>, buy] = <span class="hljs-number">1</span>
        
    <span class="hljs-meta">if</span> <span class="hljs-meta">Data</span>[i, what] &lt; upper_barrier <span class="hljs-keyword">and</span> <span class="hljs-meta">Data</span>[i - <span class="hljs-number">1</span>, what] &gt; upper_barrier:
        <span class="hljs-meta">Data</span>[i + <span class="hljs-number">1</span>, sell] = -<span class="hljs-number">1</span>
        
return <span class="hljs-meta">Data</span></pre></div><figure id="2c88"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_4OQFQtIqhz1AfcsJcXosg.png"><figcaption><b>Signal chart.</b></figcaption></figure><p id="d761">The second technique of waiting before initiating the position showed slightly better results but not statistically different. In anyways, both are losing strategies with the second one losing less (0.94 profit factor compared to 0.96).</p><p id="3618">I have recently partnered with Lumiwealth, and if you want to see how to create all sorts of algorithms yourself, feel free to check out the below link. From algorithmic trading to blockchain and machine learning, they have hands-on detailed courses that I highly recommend.</p><div id="fead" class="link-block">
      <a href="https://www.lumiwealth.com/algorithmic-trading-landing-page/?utm_source=influence&amp;utm_medium=medium&amp;utm_campaign=sofien">
        <div>
          <div>
            <h2>Learn Algorithmic Trading with Python Lumiwealth</h2>
            <div><h3>undefined</h3></div>
            <div><p>undefined</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*FbCz_ARtbOdywMlC)"></div>
          </div>
        </div>
      </a>
    </div><h1 id="e420">Summary</h1><p id="05a4">To sum up, what I am trying to do is to simply contribute to the world of objective technical analysis which is promoting more transparent techniques and strategies that need to be back-tested before being implemented. This way, technical analysis will get rid of the bad reputation of being subjective and scientifically unfounded.</p><p id="570c">Medium is a hub to interesting reads. I read a lot of articles before I decided to start writing. Consider joining Medium using my referral link (at <b>NO </b>additional cost to you).</p><div id="de8c" class="link-block">
      <a href="https://kaabar-sofien.medium.com/membership">
        <div>
          <div>
            <h2>Join Medium with my referral link — Sofien Kaabar</h2>
            <div><h3>As a Medium member, a portion of your membership fee goes to writers you read, and you get full access to every story…</h3></div>
            <div><p>kaabar-sofien.medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*XBqK-oHjNF_4ydU8)"></div>
          </div>
        </div>
      </a>
    </div><p id="5d41">I recommend you always follow the the below steps whenever you come across a trading technique or strategy:</p><ul><li>Have a critical mindset and get rid of any emotions.</li><li>Back-test it using real life simulation and conditions.</li><li>If you find potential, try optimizing it and running a forward test.</li><li>Always include transaction costs and any slippage simulation in your tests.</li><li>Always include risk management and position sizing in your tests.</li></ul><p id="beb3">Finally, even after making sure of the above, stay careful and monitor the strategy because market dynamics may shift and make the strategy unprofitable.</p><p id="4f75">For the paperback link of the book, you may use the following link:</p><div id="355f" class="link-block">
      <a href="https://www.amazon.com/dp/B09VG3SH2P?&amp;linkCode=sl1&amp;tag=sofien-20&amp;linkId=f0daa140733c5f6b08c1e744bd1b98b5&amp;language=en_US&amp;ref_=as_li_ss_tl">
        <div>
          <div>
            <h2>Contrarian Trading Strategies in Python</h2>
            <div><h3>Amazon.com: Contrarian Trading Strategies in Python: 9798434008075: Kaabar, Sofien: Books</h3></div>
            <div><p>www.amazon.co</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*C7k3f3kawsSsQCVn)"></div>
          </div>
        </div>
      </a>
    </div></article></body>

Looking for Packet Leaks After Implementing an IPSEC VPN

ACM.475 And some interesting traffic anomalies and perhaps a pfSense bug

In the last post I was looking at potential DNS leaks when using a VPN.

Does Your VPN Have a DNS Leak?

ACM.474 What it matters and how to check

medium.com

In this post, I looked at my network traffic to see if any other type of traffic might be leaking besides DNS.

So first of all, I find it annoying that I’m still seeing IPv6 Router Advertisements on my network. I can’t fully disable IPv6 on my pfSense the way I used to be able to do that and I need to look into that further.

So long story short I just want to look at what is odd or abnormal in packets and for now I’m going to ignore that IPv6 traffic. It’s an advertisement and I don’t see anything responding so unless something is hidden from my by the firewall it is just noise.

I have segregated networks for different things. When there’s no one else in the house I can lock them all down except the one I’m using to avoid on the VPN to avoid confusion.

Initially I blocked all traffic to the interfaces to those other networks but I forgot I had some float rules potentially overriding those interface-specific rules with an allow set to process immediately. I had to add the blocking rules to the top of my float list. If you don’t know what I’m talking about I’m using pfSense and I wrote about how to configure network rules in other posts.

Network Security

Blog posts, papers, and articles on Network Security by Teri Radichel

medium.com

So what would you expect to see in that case after you lock down all the networks?

Good Traffic

The firewall needs to connect to the ISP in order to connect to the Internet. There’s a gateway to the Internet provided by your ISP that has an IP address and you’ll probably see some of that in your logs when your firewall initially starts up and connects to the Internet. Your router needs to communicate with the ISP to send traffic to it.

Then, for the VPN, all the traffic sent through the VPN tunnel should be heading over to the IP address associated with the gateway for the VPN tunnel (on AWS in my case).

You’ll see your WAN IP address communicating with the VPN gateway IP address.

Anomalous Traffic

What I would expect is that all other traffic gets blocked since all my traffic from my laptop should be going through the VPN tunnel.

No other traffic should be allowed in or out besides whatever the firewall needs to do to connect to the ISP, and also possibly get some updates from the firewall vendor.

And those annoying IPv6 router advertisements I’m going to look into a bit more. Where are those coming from — the Netgate or UDM device? Why can’t I just turn all that off completely in a way that actually stops that? I’ve written about how certain configurations that used to work on the 3100 no longer work on the 6100.

IPv6

Stories by Teri Radichel on IPv6

medium.com

There will also be some scanner traffic coming from the Internet of course.

Scanners lead to scammers

Sources of unrequested network traffic from the past few months

medium.com

What I would not expect to see is any request and response traffic outside of the VPN other than what is expected once the VPN is established. An IPSEC VPN creates a tunnel and I created routing rules to send all traffic from my laptop through that tunnel to AWS. No traffic from my laptop should be destined for the Internet from the firewall itself. In addition, all other devices on the network should be blocked.

I explain why that is in my other recent posts:

How to Route Your Home Network or Business Network Traffic Through AWS and Why

ACM.464 pfSense > AWS Site to Site VPN > Transit Gateway > NAT > Internet

medium.com

Why All The So-Called VPN Replacements Are Not VPN Replacements

ACM.473 Taking a closer look at AWS Verified Access and How It Works Compared to An IPSEC VPN — should you use it?

medium.com

Therefore I should see no request and response traffic other than what the firewall is sending itself to do what it needs to do. And what I see makes me question a few things.

Start a packet capture to view anomalous traffic

As I’ve shown before, start a packet capture on pfSense to look at anomalous traffic.

Here’s how I configured the packet capture:

Look at WAN traffic
Normal initially to keep it simple
HOST IP — none of: [Your VPN Gateway IP] — that should be normal traffic
Protocol— none of: 58 which is the number for the IPv6 router advertisement protocol

That allows me to see just what shouldn’t be there.

So I start looking at the traffic and I see something odd. I see requests and responses to and from the Apple network (17.0.0.0/8).

I’ve written about all the noise on Apple Macintosh systems in the past. All that traffic makes it hard to distinguish between what is legitimate and what is not.

Apple Macintosh Network Traffic

Noise on your network makes it more challenging to find what matters.

medium.com

The particular IP address that my system was trying to access:

17.57.144.42

According to the page below that’s for Apple’s push service which I am still trying to figure out how to disable completely.

17.57.144.42Aus-se-courier-vs.push-apple.com.akadns.net

Robtex

17.57.0.0-16

www.robtex.com

What does “se” stand for? South east? US? Maybe…

Well, that IP list is going to come in handy because if I can’t turn off the push service I can at least block the IPs.

Here’s the odd thing. I see requests and responses. This is when I realized my float rules might be a problem as mentioned above.

I create a float rule to block any and all apple traffic to or from 17.0.0.0/8. I put Apple in the description.

Now it’s easier to find which IP address is sending traffic to and receiving traffic from Apple. I can search for Apple when monitoring the firewall traffic and then filter on just that rule ID if I need to. At that point I can see that the Apple traffic is coming from the UDM Pro and related wifi network, not my laptop so that’s good.

So after blocking all that and looking in my packet capture I can see other interesting things.

One of the things I see is an ARP request form the Comcast network. If my firewall is trying to connect to Comcast using DHCP perhaps that is normal. But what is interesting is that neither of the IP address in this request are related to my network. Misconfiguration? Problem? I would need to look into this in more detail to see if there’s problem here.

Also, right after that I see a packet from Hong Kong that actually has data. Related? Coincidence?

I explain how to find where addresses are coming from in this post:

Who Owns That IP Address?

ACM.460 About Internet Registries

medium.com

More strange ARP requests and Apple trying to send traffic to my network even though all the devices that could respond are blocked.

Um. What?

Neither one of the IP addresses in the packet capture below are on my network. I do use the NIST time service but what is that address from Germany doing requesting the time somehow through my firewall? What is going on there?

I also see a ton of DNS traffic. It could be legitimate, but what I need to look at is whether those DNS request contain any extra bits and bytes in the various fields in the DNS protocol that my indicate DNS exfiltration. These requests are going to CloudFlare so I would hope that are inspecting for that sort of thing without compromising customer data, if possible.

To see more information about those DNS queries I can filter on only port 53 change the packet capture to full.

What I can see is that all those DNS requests — and responses — are coming to and from the UDM Pro network and interface even though I’m blocking all traffic from that Interface in my float rule. So it appears that my WAN is sending DNS request from the interface I have my UDM plugged into even though I’ve specified to block all traffic from that Interface.

That seems like a pfSense or Netgate bug, no?

So I add a rule to my WAN interface to block all traffic from the interface subnets where I have the UDM Pro plugged in. Now I see no DNS traffic.

For a while. Then it returns. Somehow that traffic is getting through even though it is blocked. I have some NAT rules set up related to DNS. Perhaps that’s how this is happening?

Redirect IoT Devices to Preferred DNS Servers

Leveraging PFSense Nat Rules to redirect DNS requests when the device itself won’t let you

medium.com

Well, that was fun but I have work to do. Hopefully someone who specializes in incident response, network monitoring, and such can look into all these anomalies further. I’ll keep poking around as time allows.

It doesn’t appear that my VPN is leaking traffic but there are some other strange traffic anomalies I’d like to understand better.

Questions, questions that will not be answered in this post — but after you implement your VPN — check to see if it’s really working or not and if it has a leak of any kind and look to see if you have any unexpected traffic on your network.

Follow for updates.

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab