Chapter 25 Digital Evidence at the Network and Transport Layers ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.

Figure 1.1 FIGURE 25.1 TCP/IP diagram with OSI layers superimposed. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.2 IP addresses are conceptually the same as telephone numbers. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.3 A zone transfer using NetScanTools Pro requires the DNS server to be set to one of the target system’s DNS servers under Advanced Query Options (accesses using the “Adv Qry Setup” button). ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.4 IP routing. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.5 UDP packet with port number in the heading being transmitted to a server. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.6 TCP establishing a connection using a three-way handshake. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.7 Internet café with several kiosks, Ethernet ports for customer laptops, and a wireless access point connected together with an Ethernet switch and connected to an ISP’s router by a firewall performing NAT. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 25.8 VPN concentrator (172.16.1.219), IAS server (172.16.1.45), and connecting host (64.252.248,133, 172.16.19.53). ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.