1. Networking Concepts
Module A
Copyright Pearson Prentice Hall 2013

2. Definitions and Terms Octet Host internet vs. Internet
A Byte (collection of 8 bits)
8 bits = 1 Character
Bit
Is the basic unit of IT represented as a
0 or 1
Host
Any Device connected to the Internet
internet vs. Internet
i = computer networks or internet protocol
I = The global computer network
Copyright Pearson Prentice-Hall 2010

3. A-1: A Simple Home Network
NIC = Network Interface Card,
provides capability for Network communications
Copyright Pearson Prentice-Hall 2010

4. Access Router Router Is a Switch Is a Wireless Access Point (WAP)
Connects one network to another
Is a Switch
Sends frames between computers
Is a Wireless Access Point (WAP)
Signals are spread wide increasing danger
Contains a Dynamic Host Configuration Protocol (DHCP)
Provides each host an IP address
Provides Network Address Translation (NAT)
Hides IP address from attack
Copyright Pearson Prentice-Hall 2010

5. Copyright Pearson Prentice Hall 2013

6. Network Types LAN (Local Area Network)
Operate within building not across geographic locations
WAN (Wide Area Network, internet)
Operate across geographic locations
Because corporations don’t have regulatory rights to lay network lines in public areas they rely on commercial companies
Internet
Network of Network’s
Copyright Pearson Prentice-Hall 2010

7. Workgroup Switch: connect computers to the network
Core Switch:
Connect switches to other switches
Any computer can plug into a wall jack and potentially gain access to the network x requires any computer to first authenticate before gaining access to the network
Copyright Pearson Prentice-Hall 2010

8. Two Types of Leased Lines
Point to Point
Connections to these Networks is limited
Security by Obscurity – not the best if it is breached there is no security
Public Switched Data Network (PSDN) – passes frames between multiple sites
Copyright Pearson Prentice-Hall 2010

9. A-5: The Internet The global Internet has thousands of
networks connected
by routers
Network
Browser
Webserver
Software
Packet
Packet
Router
Route
Router
Router
Packet
Copyright Pearson Prentice Hall 2013

10. Messages
Messages (data) can move from any computer to any other computer on any other network connected to the Internet
Frames:
Messages (data) between a single network (LAN or WAN)
Packets
Messages (data) between computers across the Internet
Packets are contained within Frames
Different Frame per Network
Internet was designed specifically to NOT ADD SECURITY!
Copyright Pearson Prentice-Hall 2010

11. Packet travels in a different
frame in each network
Copyright Pearson Prentice Hall 2013

12. A-7: Internet Service Providers (ISPs)
US Backbone Map
Copyright Pearson Prentice-Hall 2010

13. Network Protocols Networks must “talk” with each other
Interoperability
Requires Standards
Standards Security Issues:
Is it inherently secure
an essential constituent or characteristic of the standard
Incidental security results from inherent security
Explicitly designed into standard
If added “after-the-fact” usually to newer versions going forward
Vendor implementations can be defective
Copyright Pearson Prentice-Hall 2010

14. A-8: Three Core Standards Layers
Super Layer
Description
Application
Communication between application programs on different hosts attached to different networks on an internet.
Internetworking
Transmission of packets across an internet. Packets contain application layer messages.
Single Network
Transmission of frames across a network. Frames contain packets.
Core Standards for each sub-system of the network communication process
Copyright Pearson Prentice-Hall 2010

15. Super Layer TCP/IP OSI Hybrid TCP/IP-OSI Application Presentation
Session
Internet
Transport
Network
Single Network
Subnet Access
Data Link
Physical
Copyright Pearson Prentice Hall 2013

16. In a single network, a physical link connects adjacent devices.
A data link is the path that a frame takes across a single network.
One data link; three physical links.
Copyright Pearson Prentice Hall 2013

17. Physical Layer Device Connection Types
UTP
Links between computers and switches
Uses voltage changes (high vs. low)
Act like radio antennas, so signal can be intercepted without tapping
Optical Fiber
Uses light changes (on or off)
Require tapping for interception of data
Wireless
Uses radio waves for transmission
Spread widely and easily intercepted
Copyright Pearson Prentice-Hall 2010

18. Internetworking Standards
How routers forward packets
Best effort protocol
No Guarantee packets will arrive or will arrive in order
Main standard is Internet Protocol (IP)
Transport
Main standard is Transport Control Protocol (TCP)
Fixes transmission errors
Ensures proper order of packets
Slows transmission if necessary
For transmissions that do NOT require these capabilities will use
User Datagram Protocol (UDP)
Copyright Pearson Prentice-Hall 2010

19. Types of Standards (Protocols)
Connection-Oriented
Requires agreement for transmission to commence
Monitors transmission for errors to ensure Reliability of transmission
Connectionless
Does NOT require agreement, transmission occurs when needed
No monitoring of transmission for errors occurs
Copyright Pearson Prentice-Hall 2010

20. Internet Protocol (IP)
Connectionless
Unreliable
Purpose
How are packets organized
How routers move packets to destination host
Versions
IPv4
32 bit address size 232 = 4,294,967,296
IPv6
128 bit address size 2128 = 3.4e+38
Copyright Pearson Prentice-Hall 2010

21. Copyright Pearson Prentice Hall 2013

22. A-12: The Internet Protocol (IP) Packet
0100
IP Version 4 Packet
Bit 0
Bit 31
Version
(4 bits)
Header
Length
(4 bits)
Diff-Serv
(8 bits)
Total Length
(16 bits)
Identification (16 bits)
Flags
Fragment Offset (13 bits)
Time to Live
(8 bits)
Protocol (8 bits)
1=ICMP, 6=TCP,
17=UDP
Header Checksum (16 bits)
Source IP Address (32 bits)
Destination IP Address (32 bits)
Options (if any)
Padding
Data Field
Copyright Pearson Prentice-Hall 2010

23. IPv4 Represented as 32 bit rows Consists of: May have optional rows
Header consists of 5 rows
May have optional rows
Data
Copyright Pearson Prentice-Hall 2010

24. IPv4 Row 1 Version Header Length (usually 5 rows) Diff-Serv
Total Length
(16 bits)
Diff-Serv
(8 bits)
Header
Length
(4 bits)
Version
Version
0100 = 4
Header Length (usually 5 rows)
0101 = 5
More than 5 rows usually indicates an attack so examining this part of the header is important to detect attacks
Diff-Serv
Rarely uses intended to provide priority to different packets (Network Neutrality)
Total Length
Length of (entire packet - header) in bytes
Maximum size of a packet is 216 = 65,536
Copyright Pearson Prentice-Hall 2010

25. IPv4 Row 2
Used if a packet is too large and is divided into smaller packets
This is rare and can indicate an attack
Most O/S don’t allow fragmentation
Flag values:
Identification (16 bits)
Flags
Fragment Offset (13 bits)
Copyright Pearson Prentice-Hall 2010

26. Header Checksum (16 bits)
Time to Live
(8 bits)
Protocol (8 bits)
1=ICMP, 6=TCP,
17=UDP
IPv4 Row 3
Time to Live (TTL)
Set to a value between 0 and 255
Usually set to 64 or 128 by O/D
As packet moves from router to router
TTL decremented by 1
If TTL reaches 0 the packet is discarded
Attackers can determine how many router hops are between hacker and victim host by examining TTL and guessing 64 or 128 so…
Protocol Message
List of IP Protocol Numbers
Header Checksum
Copyright Pearson Prentice-Hall 2010

27. IPv4 Source and Destination IP Address
Each Address is 32 bits long
Kind of hard to remember so…
Divided into 4 8 bit segments & converted to decimal (0 to 255)
4 segments divided into a mask
First 2 are for the network
= UCF
217 = College of Business
166 = Web Server
Copyright Pearson Prentice-Hall 2010

28. A-13: IP Version 6 Packet Payload length = Total Length from IPv4
Hop Limit = TTL from IPv4
Note there is no Checksum
Reliability is assumed from higher level security
Copyright Pearson Prentice-Hall 2010

29. IPv6 Optional Header Rows
Unlike IPv4 IPv6 utilized optional header rows
One such use is for IPSec
Remember that IP was developed without Security
IPSec was added later to provide security
Everything in the data field of the packet is Secure
Secure = Encrypted
Application message is also secure
Two Modes:
Transport – host to host protection
Tunnel – protection between hosts
Details in Chapter 4
Copyright Pearson Prentice-Hall 2010

30. Transport Layer Protocols
Transmission Control Protocol (TCP)
Connection-oriented, reliable
TCP message is called a Segment
User Datagram Protocol (UDP)
Connectionless, unreliable
Copyright Pearson Prentice-Hall 2010

31. A-14: Transmission Control Protocol (TCP) Segment
Copyright Pearson Prentice-Hall 2010

32. A-15: Messages in a TCP SessionPC
Transport Process
Webserver
Transport Process
1. SYN (Open)
Open
(3)
2. SYN, ACK (1) (Acknowledgement of 1)
3. ACK (2)
3-Way Open
Syn = Synchronize sequence numbers, I want to send a message
SYN, ACK (Acknowledge), OK I’ll accept your message
ACK = OK I’m acknowledging that I received your acknowledgement
Copyright Pearson Prentice-Hall 2010

33. Using TCP for Denial-of Service Hacks
Hacker floods victim host with SYN messages
The victim host
Sends SYN, ACK &
Sets aside resources for the upcoming message
Hacker never sends ACK back
Half-open SYN attack
Copyright Pearson Prentice-Hall 2010

34. A-15: Messages in a TCP Session (continued)PC
transport process
Webserver
transport process
1. SYN (Open)
Open
(3)
2. SYN, ACK (1) (Acknowledgement of 1)
3. ACK (2)
4. Data = HTTP Request
Carry
HTTP
Req &
Resp
(4)
5. ACK (4)
6. Data = HTTP Response
7. ACK (6)
Copyright Pearson Prentice Hall 2013

35. A-15: Messages in a TCP Session (continued)PC
transport process
Webserver
transport process
8. Data = HTTP Request (Error)
Carry
HTTP
Req &
Resp
(4)
9. Data = HTTP Request (No ACK so Retransmit)
10. ACK (9)
11. Data = HTTP Response
12. ACK (11)
Error Handling
Copyright Pearson Prentice Hall 2013

36. A-15: Messages in a TCP Session (continued)PC
transport process
Webserver
transport process
Normal Four-Way Close
13. FIN (Close)
Close
(4)
14. ACK (13)
15. FIN
16. ACK (15)
Note: An ACK may be combined with the next message if the next message
is sent quickly enough
Copyright Pearson Prentice Hall 2013

37. A-15: Messages in a TCP SessionPC
Transport Process
Webserver
Transport Process
Abrupt Close
RST
Close
(1)
Either side can send
A Reset (RST) Segment
At Any Time
Ends the Session Immediately
Rejection of a SYN (from an untrusted host) with a RST will provide
Hacker with IP address of internal host, something the hacker tries to get
Copyright Pearson Prentice-Hall 2010

38. A-14: Transmission Control Protocol (TCP) Segment
Copyright Pearson Prentice-Hall 2010

39. Integrity and Reliability of Message
Sequence Number field
Allows for segments to be put together in order
First segment uses a randomly generated number
If segment contains no data (SYN, ACK, etc)
number is 1 + last segment
If segment contains data
Number of first octet (byte) for the data field is used
Acknowledgement Number field
Enables verification that a segment has arrived
Number of last octet (byte) for the data field + 1
Copyright Pearson Prentice-Hall 2010

40. Copyright Pearson Prentice Hall 2013

41. A-14: Transmission Control Protocol (TCP) Segment
Copyright Pearson Prentice-Hall 2010

42. Port Numbers & Sockets Clients Servers Socket
Random number used when connecting to Host for transmission session (short-lived session)
Servers
Represents a specific application running
Socket
Combination of IP Address and Port Number
:80
Copyright Pearson Prentice-Hall 2010

43. Copyright Pearson Prentice Hall 2013

44. Copyright Pearson Prentice Hall 2013

45. TCP Security There is NO security built into the standard
Security is instead provided by IPSec in the IP standard since it secures the data package where the TCP segment is contained.
Copyright Pearson Prentice-Hall 2010

46. Copyright Pearson Prentice Hall 2013

47. A-20: Internet Control Message Protocol (ICMP)
Copyright Pearson Prentice Hall 2013

48. ICMP Ping & Traceroute Ping Traceroute
Are you there?
Traceroute
How do packets go from my client to a host
ICMP messages contain error messages back to originator
Hackers can send mal-formed ICMP message hoping to identify IP address of host
Copyright Pearson Prentice-Hall 2010

49. Copyright Pearson Prentice Hall 2013

50. DNS Server Organized Hierarchically
13 DNS Root Servers
Top-level Domain Servers (.com, .edu, etc.)
Second-level (University of Central Florida)
Need to know the names of host computers within its own network
Cache Poisoning occurs if an attacker replaces an IP address on the DNS with a fake one
Copyright Pearson Prentice-Hall 2010

51. DNSSEC for the .edu Domain
Becky Granger
Director, Information Technology
and Member Services
EDUCAUSE
April 29, 2010

52. DNS: A Review
Illustration courtesy of Niranjan Kunwar / Nirlog.com

53. DNS Caching DNS Servers cache data to improve performance
But…what happens if the cached data is wrong?

54. DNS is Fundamentally Flawed
More detailed explanation:

55. DNS Threats Packet Interception ID Guessing & Query Prediction
DNS's usual behavior of sending an entire query or response in a single unsigned, unencrypted UDP packet makes these attacks particularly easy
Attacker intercepts query to DNS or response back
Substituting their own message
ID Guessing & Query Prediction
Attacker guesses UDP ID for DNS Query
DNS port number is well-known
16 bits per ID so 2⌃16 – susceptible to brute force
Name Chaining or Cache Poisoning (see previous slide)
DOS – no different from any other server

56. Chain of Trust Can Be Established
Original illustration courtesy of Niranjan Kunwar / Nirlog.com

57. Copyright Pearson Prentice Hall 2013

58. Copyright Pearson Prentice Hall 2013

59. A-24: Application Standards
Application Exploits
By taking over applications, hackers gain the permissions of the exploited program
A multitude of application standards
Consequently, there is a multitude of security issues at the application level
Copyright Pearson Prentice Hall 2013

60. A-24: Application Standards
Many Applications Need Two Types of Standards
One for the transmission of messages, one for the content of application documents
For the World Wide Web, these are HTTP and HTML, respectively
For transmission, uses SMTP, POP, and IMAP
For message content, uses RFC 2822 (all- text), HTML, and MIME
Copyright Pearson Prentice Hall 2013

61. A-24: Application Standards
FTP and Telnet
Have no security
Passwords are transmitted in the clear so can be captured by sniffers
Secure Shell (SSH) can replace both securely
Copyright Pearson Prentice Hall 2013

62. A-24: Application Standards
Many Other Application Standards Have Security Issues
Voice over IP
Service-oriented architecture (SOA); web services
Peer-to-peer applications
Copyright Pearson Prentice Hall 2013

64. Copyright © 2013 Pearson Education, Inc. Publishing as Prentice Hall