Slide #1 CIT 380: Securing Computer Systems TCP/IP

Slide #2 Topics 1.TCP/IP Layering 2.Encapsulation 3.Internet Addresses 4.Link Layer Protocols 5.IP 6.Routing 7.TCP and UDP 8.Application Layer Protocols

Slide #3 Network Example A1A2A3 B1B2B3 Router External Router

Slide #4 TCP/IP Layering Application Transport Network Data Link Physical HTTP, FTP, telnet TCP, UDP IP, ICMP, IGMP PPP, Ethernet

Slide #5 TCP/IP Layers 1.Physical –NIC, cabling, electrical signaling. 2.Data Link –Single hop transport of packets. –Wired protocols (ethernet, FDDI, PPP) –Wireless protocols (802.11) 3.Network –End to end delivery of packets. –IP: Internet Protocol

Slide #6 TCP/IP Layers 4.Transport –Flow of data between two hosts for application layer. –TCP: reliable data flow with acknowledgements, retransmission, and timeouts. –UDP: simpler service with no guarantees. 5.Application –Protocols for particular applications. –ex: FTP, HTTP, SMTP

Slide #7 Encapsulation/De-multiplexing Sending: data sent down protocol stack –Each layer prepends a header to data –Ethernet frame sent as bit stream across wire Receiving: data moves up protocol stack –NIC moves bits into memory as ethernet frame –Each layer removes its header from packet

Slide #8 Encapsulation

Slide #9 De-multiplexing

Slide #10 TCP/IP Security TCP/IP has no built-in strong security. –No confidentiality features. –Minimal availability features (ToS options). –Insecure CRC checksums for integrity. –IPsec protocol extension adds security.

Slide #11 Data Link Layer IEEE Standards –Ethernet (802.3) –Token Ring (802.5) –Wireless (802.11) Serial Protocols –SLIP and CSLIP –PPP

Slide #12 Hubs and Switches Hubs –Broadcast packets received to all interfaces. Switches –Associates MAC addresses with physical interfaces. –Sends packets only to specified interface. –May have SPAN port for network monitoring.

Slide #13 Data Link Layer Loopback –Looks like any other link layer device. –Full network processing is performed. –Sends packets to localhost for testing. 48-bit MAC address Maximum Transmission Unit (MTU) –1492 or 1500 bytes, depending on ethernet std

Slide #14 Promiscuous Mode All ethernet frames to or from any locally connected host are seen by all hosts. NIC normally filters out frames that are not addressed to its MAC address. In promiscuous mode, NIC processes all ethernet frames, not just ones addressed to it. –Requires administrative access on most OSes.

Slide #15 IP: Internet Protocol Unreliable, connectionless datagram service –Packets may arrived damaged, out of order, duplicated or not at all. –Transport/Application layers provide reliability.