Chapter4 Packet and Protocol

Content What does a packet look like? IP Protocol above IP Protocol below IP IP Version 6 Non IP Protocols Attack Based on Low-Level Protocol Details

What does a packet look like? TCP/IP Protocol layer: Application Layer(ftp,http) Transport Layer(TCP or UDP) Internet Layer(IP) Network Access Layer(Ethernet,FDD,ATM) Packet consists of two parts: Header: It contains protocol information. Body: It contains data

TCP/IP/Ethernet Example Ethernet Layer: It has MAC Address (Source,Destination address). IP layer: It consists of IP header and IP Body. IP header contains: IP source address IP destination address IP protocol type IP options field TCP layer: It consist of : TCP Source port. TCP destination port. TCP flag

IP IP Multicast and Broadcast: Unicast:They are sent to an individual destination host. Multicast:It send to a group of host. Broadcast:It send to every host that can receive them. IP Option: For placing a special information or handling instruction that do not have a specific field of their own in the header. IP Fragmentation:The ability to divide a large packet into small packet for sending on network.

Protocol above IP TCP provides a reliable,bidirectional connection between two endpoints(receive in order, no duplicate).It was used by FTP,SNMP,HTTP. TCP Option: URG(Urgent):It marks data that sender think is importance. ACK(Acknowledgement):It make up the framed TCP three way handshake. PSH(Push): It tell receiver to stop buffering. RST(Reset): To close connection. SYNRST(Synchronize):To give next packet a number to acknowledge. FIN(Finish): To close connection.

Protocol above IP ICMP UDP/IP over IP It is used for IP status and control massage. ICMP carry in the body of IP packet. Feature of ICMP Protocol: Echo request: when run command ping. Echo response:what a host response to an echo request. Time Exceeded:when packet have looping. Destination Unreachable:when packet Unreachable to its destination. Redirect:It tell host about more efficient path for next time. UDP Protocol is a low-overhead alternative to TCP. IP over IP:IP packet are encapsulated within other IP for transmission. The use of IP over IP: Encapsulating encrypted network traffic. Carrying multicast IP Packet. Mobile IP. Carrying IPv6 over IPv4 network.

Protocol below IP IP is the lowest level protocol which people chose to do packet filtering. We can't filter packet below IP protocol by the reason: All packet from the outside are coming from the same MAC address. Multiple connection with different lower-level protocol. Filtering based on Hardware address is not reliable security mechanism against hostile insider.

Non IP Protocols