1. Module A

2.  This is a module that some teachers will cover while others will not  This module is a refresher on networking concepts, which are important in information security  If your teacher does not cover networking, you might want to cover it yourself, to “get the rust out” of your networking knowledge Copyright Pearson Prentice-Hall 2009 2

3. 3

4. 4

5. 5

6. 6

7. 7

8. 8 Network Browser Packet Router Packet Router Packet Route Webserver Software Router The global Internet has thousands of networks connected by routers The global Internet has thousands of networks connected by routers

9. Copyright Pearson Prentice-Hall 2009 9 Packet travels in a different frame in each network Packet travels in a different frame in each network

10. Copyright Pearson Prentice-Hall 2009 10

11. Copyright Pearson Prentice-Hall 2009 11 Super LayerDescription ApplicationCommunication between application programs on different hosts attached to different networks on an internet. InternetworkingTransmission of packets across an internet. Packets contain application layer messages. NetworkTransmission of frames across a network. Frames contain packets.

12. Copyright Pearson Prentice-Hall 2009 12 Super LayerTCP/IPOSIHybrid TCP/IP-OSI Application Presentation Session InternetTransport InternetNetworkInternet Single NetworkSubnet AccessData Link Physical

13. Copyright Pearson Prentice-Hall 2009 13 Switched Network 1 Data Link Physical LinkFrame In a single network, a physical link connects adjacent devices. A data link is the path that a frame takes across a single network. One data link; three physical links.

14. Copyright Pearson Prentice-Hall 2009 14

15. Copyright Pearson Prentice-Hall 2009 15 Total Length (16 bits) Identification (16 bits) Header Checksum (16 bits) Time to Live (8 bits) Flags Protocol (8 bits) 1=ICMP, 6=TCP, 17=TCP Bit 0Bit 31 IP Version 4 Packet Source IP Address (32 bits) Fragment Offset (13 bits) Diff-Serv (8 bits) Header Length (4 bits) Version (4 bits) Destination IP Address (32 bits) Options (if any)Padding Data Field 0100

16. Copyright Pearson Prentice-Hall 2009 16

17. Copyright Pearson Prentice-Hall 2009 17

18. Copyright Pearson Prentice-Hall 2009 18 Source Port Number (16 bits)Destination Port Number (16 bits) Acknowledgment Number (32 bits) Sequence Number (32 bits) TCP Checksum (16 bits) Window Size (16 bits) Flag Fields (6 bits) Reserved (6 bits) Header Length (4 bits) Urgent Pointer (16 bits)

19. Copyright Pearson Prentice-Hall 2009 19 PC Transport Process Webserver Transport Process 1. SYN (Open) 2. SYN, ACK (1) (Acknowledgement of 1) 3. ACK (2) Open (3) 3-Way Open

20. Copyright Pearson Prentice-Hall 2009 20 PC Transport Process Webserver Transport Process 1. SYN (Open) 2. SYN, ACK (1) (Acknowledgement of 1) 3. ACK (2) 4. Data = HTTP Request 5. ACK (4) 6. Data = HTTP Response 7. ACK (6) Open (3) Carry HTTP Req & Resp (4)

21. Copyright Pearson Prentice-Hall 2009 21 PC Transport Process Webserver Transport Process 8. Data = HTTP Request (Error) Carry HTTP Req & Resp (4) 9. Data = HTTP Request (No ACK so Retransmit) 10. ACK (9) 11. Data = HTTP Response 12. ACK (11) Error Handling

22. Copyright Pearson Prentice-Hall 2009 22 PC Transport Process Webserver Transport Process Close (4) 13. FIN (Close) 14. ACK (13) 15. FIN 16. ACK (15) Note: An ACK may be combined with the next message if the next message is sent quickly enough Normal Four-Way Close

23. Copyright Pearson Prentice-Hall 2009 23 PC Transport Process Webserver Transport Process Close (1) RST Abrupt Close Either side can send A Reset (RST) Segment At Any Time Ends the Session Immediately

24. Copyright Pearson Prentice-Hall 2009 24

25. Copyright Pearson Prentice-Hall 2009 25

26. Copyright Pearson Prentice-Hall 2009 26

27. Copyright Pearson Prentice-Hall 2009 27 Source Port Number (16 bits)Destination Port Number (16 bits) UDP Length (16 bits)UDP Checksum (16 bits) Data Field

28. Copyright Pearson Prentice-Hall 2009 28

29. Copyright Pearson Prentice-Hall 2009 29

30. Copyright Pearson Prentice-Hall 2009 30

31. Copyright Pearson Prentice-Hall 2009 31

32.  Application Exploits ◦ By taking over applications, hackers gain the permissions of the exploited program ◦ A multitude of application standards ◦ Consequently, there is a multitude of security issues at the application level Copyright Pearson Prentice-Hall 2009 32

33.  Many Applications Need Two Types of Standards ◦ One for the transmission of messages, one for the content of application documents ◦ For the World Wide Web, these are HTTP and HTML, respectively ◦ For transmission, e-mail uses SMTP, POP, and IMAP ◦ For message content, e-mail uses RFC 2822 (all- text), HTML, and MIME Copyright Pearson Prentice-Hall 2009 33

34.  FTP and Telnet ◦ Have no security ◦ Passwords are transmitted in the clear so can be captured by sniffers ◦ Secure Shell (SSH) can replace both securely Copyright Pearson Prentice-Hall 2009 34

35.  Many Other Application Standards Have Security Issues ◦ Voice over IP ◦ Service-oriented architecture (SOA); web services ◦ Peer-to-peer applications Copyright Pearson Prentice-Hall 2009 35

36. Copyright Pearson Prentice-Hall 2009 36