1. Hands-On Ethical Hacking and Network Defense Chapter 2 TCP/IP Concepts Review Last modified 1-30-10

2. Objectives Describe the TCP/IP protocol stack Describe the TCP/IP protocol stack Explain the basic concepts of IP addressing Explain the basic concepts of IP addressing Explain the binary, octal, and hexadecimal numbering system Explain the binary, octal, and hexadecimal numbering system

3. Overview of TCP/IP Protocol Protocol Common language used by computers for speaking Common language used by computers for speaking Transmission Control Protocol/Internet Protocol (TCP/IP) Transmission Control Protocol/Internet Protocol (TCP/IP) Most widely used protocol Most widely used protocol TCP/IP stack TCP/IP stack Contains four different layers Contains four different layers Network Network Internet Internet Transport Transport Application Application

5. The Application Layer Front end to the lower-layer protocols Front end to the lower-layer protocols What you can see and touch – closest to the user at the keyboard What you can see and touch – closest to the user at the keyboard HTTP, FTP, SMTP, SNMP, SSH, IRC and TELNET all operate in the Application Layer HTTP, FTP, SMTP, SNMP, SSH, IRC and TELNET all operate in the Application Layer

7. The Transport Layer Encapsulates data into segments Encapsulates data into segments Segments can use TCP or UDP to reach a destination host Segments can use TCP or UDP to reach a destination host TCP is a connection-oriented protocol TCP is a connection-oriented protocol TCP three-way handshake TCP three-way handshake Computer A sends a SYN packet Computer A sends a SYN packet Computer B replies with a SYN-ACK packet Computer B replies with a SYN-ACK packet Computer A replies with an ACK packet Computer A replies with an ACK packet

8. TCP Header Format 0 1 2 3 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Port | Destination Port | | Source Port | Destination Port | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Acknowledgment Number | | Acknowledgment Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data | |U|A|P|R|S|F| | | Data | |U|A|P|R|S|F| | | Offset| Reserved |R|C|S|S|Y|I| Window | | Offset| Reserved |R|C|S|S|Y|I| Window | | | |G|K|H|T|N|N| | | | |G|K|H|T|N|N| | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Checksum | Urgent Pointer | | Checksum | Urgent Pointer | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options | Padding | | Options | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | data | | data | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

9. TCP Segment Headers Critical components: Critical components: TCP flags TCP flags Initial Sequence Number (ISN) Initial Sequence Number (ISN) Source and destination port Source and destination port Abused by hackers finding vulnerabilities Abused by hackers finding vulnerabilities

10. TCP Flags Each flag occupies one bit Each flag occupies one bit Can be set to 0 (off) or 1 (on) Can be set to 0 (off) or 1 (on) Six flags Six flags SYN: synchronize flag SYN: synchronize flag ACK: acknowledge flag ACK: acknowledge flag PSH: push flag PSH: push flag URG: urgent flag URG: urgent flag RST: reset flag RST: reset flag FIN: finish flag FIN: finish flag

11. Initial Sequence Number (ISN) 32-bit number 32-bit number Tracks packets received Tracks packets received Enables reassembly of large packets Enables reassembly of large packets Sent on steps 1 and 2 of the TCP three- way handshake Sent on steps 1 and 2 of the TCP three- way handshake By guessing ISN values, a hacker can hijack a TCP session, gaining access to a server without logging in By guessing ISN values, a hacker can hijack a TCP session, gaining access to a server without logging in

12. TCP Ports Port Port Logical, not physical, component of a TCP connection Logical, not physical, component of a TCP connection Identifies the service that is running Identifies the service that is running Example: HTTP uses port 80 Example: HTTP uses port 80 A 16-bit number – 65,536 ports A 16-bit number – 65,536 ports Each TCP packet has a source and destination port Each TCP packet has a source and destination port

13. Blocking Ports Helps you stop or disable services that are not needed Helps you stop or disable services that are not needed Open ports are an invitation for an attack Open ports are an invitation for an attack You can’t block all the ports You can’t block all the ports That would stop all networking That would stop all networking At a minimum, ports 25 and 80 are usually open on a server, so it can send out Email and Web pages At a minimum, ports 25 and 80 are usually open on a server, so it can send out Email and Web pages

14. TCP Ports (continued) Only the first 1023 ports are considered well-known Only the first 1023 ports are considered well-known List of well-known ports List of well-known ports Available at the Internet Assigned Numbers Authority (IANA) Web site (www.iana.org) Available at the Internet Assigned Numbers Authority (IANA) Web site (www.iana.org) Ports 20 and 21 Ports 20 and 21 File Transfer Protocol (FTP) File Transfer Protocol (FTP) Use for sharing files over the Internet Use for sharing files over the Internet Requires a logon name and password Requires a logon name and password More secure than Trivial File Transfer Protocol (TFTP) More secure than Trivial File Transfer Protocol (TFTP)

16. TCP Ports (continued) Port 25 Port 25 Simple Mail Transfer Protocol (SMTP) Simple Mail Transfer Protocol (SMTP) E-mail servers listen on this port E-mail servers listen on this port Port 53 Port 53 Domain Name Service (DNS) Domain Name Service (DNS) Helps users connect to Web sites using URLs instead of IP addresses Helps users connect to Web sites using URLs instead of IP addresses Port 69 Port 69 Trivial File Transfer Protocol Trivial File Transfer Protocol Used for transferring router configurations Used for transferring router configurations

17. TCP Ports (continued) Port 80 Port 80 Hypertext Transfer Protocol (HTTP) Hypertext Transfer Protocol (HTTP) Used when connecting to a Web server Used when connecting to a Web server Port 110 Port 110 Post Office Protocol 3 (POP3) Post Office Protocol 3 (POP3) Used for retrieving e-mail Used for retrieving e-mail Port 119 Port 119 Network News Transfer Protocol Network News Transfer Protocol For use with newsgroups For use with newsgroups

18. TCP Ports (continued) Port 135 Port 135 Remote Procedure Call (RPC) Remote Procedure Call (RPC) Critical for the operation of Microsoft Exchange Server and Active Directory Critical for the operation of Microsoft Exchange Server and Active Directory Port 139 Port 139 NetBIOS NetBIOS Used by Microsoft’s NetBIOS Session Service Used by Microsoft’s NetBIOS Session Service File and printer sharing File and printer sharing

19. 19 TCP Ports (continued) Port 143 Port 143 Internet Message Access Protocol 4 (IMAP4) Internet Message Access Protocol 4 (IMAP4) Used for retrieving e-mail Used for retrieving e-mail More features than POP3 More features than POP3

20. Demonstration Telnet to hills.ccsf.edu and netstat to see the connections Telnet to hills.ccsf.edu and netstat to see the connections Port 23 (usual Telnet) Port 23 (usual Telnet) Port 25 blocked off campus, but 110 connects Port 25 blocked off campus, but 110 connects Port 21 works, but needs a username and password Port 21 works, but needs a username and password

21. Demonstration Wireshark Packet Sniffer Wireshark Packet Sniffer TCP Handshake: SYN, SYN/ACK, ACK TCP Handshake: SYN, SYN/ACK, ACK TCP Ports TCP Ports TCP Status Flags TCP Status Flags

22. User Datagram Protocol (UDP) Fast but unreliable protocol Fast but unreliable protocol Operates on transport layer Operates on transport layer Does not need to verify whether the receiver is listening Does not need to verify whether the receiver is listening Higher layers of the TCP/IP stack handle reliability problems Higher layers of the TCP/IP stack handle reliability problems Connectionless protocol Connectionless protocol

23. The Internet Layer Responsible for routing packets to their destination address Responsible for routing packets to their destination address Uses a logical address, called an IP address Uses a logical address, called an IP address IP addressing packet delivery is connectionless IP addressing packet delivery is connectionless

24. Internet Control Message Protocol (ICMP) Operates in the Internet layer of the TCP/IP stack Operates in the Internet layer of the TCP/IP stack Used to send messages related to network operations Used to send messages related to network operations Helps in troubleshooting a network Helps in troubleshooting a network Some commands include Some commands include Ping Ping Traceroute Traceroute

25. ICMP Type Codes

26. 26 Wireshark Capture of a PING

27. Warriors of the Net Network+ Movie Network+ Movie Warriorsofthe.net (link Ch 2d) Warriorsofthe.net (link Ch 2d)

28. IP Addressing Consists of four bytes, like 147.144.20.1 Consists of four bytes, like 147.144.20.1 Two components Two components Network address Network address Host address Host address Neither portion may be all 1s or all 0s Neither portion may be all 1s or all 0s Classes Classes Class A Class A Class B Class B Class C Class C

30. IP Addressing (continued) Class A Class A First byte is reserved for network address First byte is reserved for network address Last three bytes are for host address Last three bytes are for host address Supports more than 16 million host computers Supports more than 16 million host computers Limited number of Class A networks Limited number of Class A networks Reserved for large corporations and governments (see link Ch 2b) Reserved for large corporations and governments (see link Ch 2b) Format: network.node.node.node Format: network.node.node.node

31. IP Addressing (continued) Class B Class B First two bytes are reserved for network address First two bytes are reserved for network address Last two bytes are for host address Last two bytes are for host address Supports more than 65,000 host computers Supports more than 65,000 host computers Assigned to large corporations and Internet Service Providers (ISPs) Assigned to large corporations and Internet Service Providers (ISPs) Format: network.network.node.node Format: network.network.node.node CCSF has 147.144.0.0 – 147.144.255.255 CCSF has 147.144.0.0 – 147.144.255.255

32. IP Addressing (continued) Class C Class C First three bytes are reserved for network address First three bytes are reserved for network address Last byte is for host address Last byte is for host address Supports up to 254 host computers Supports up to 254 host computers Usually available for small business and home networks Usually available for small business and home networks Format: network.network.network.node Format: network.network.network.node

33. IP Addressing (continued) Subnetting Subnetting Each network can be assigned a subnet mask Each network can be assigned a subnet mask Helps identify the network address bits from the host address bits Helps identify the network address bits from the host address bits Class A uses a subnet mask of 255.0.0.0 Class A uses a subnet mask of 255.0.0.0 Also called /8 Also called /8 Class B uses a subnet mask of 255.255.0.0 Class B uses a subnet mask of 255.255.0.0 Also called /16 Also called /16 Class C uses a subnet mask of 255.255.255.0 Class C uses a subnet mask of 255.255.255.0 Also called /24 Also called /24

34. Planning IP Address Assignments Each network segment must have a unique network address Each network segment must have a unique network address Address cannot contain all 0s or all 1s Address cannot contain all 0s or all 1s To access computers on other networks To access computers on other networks Each computer needs IP address of gateway Each computer needs IP address of gateway

35. 35 Planning IP Address Assignments TCP/IP uses subnet mask to determine if the destination computer is on the same network or a different network TCP/IP uses subnet mask to determine if the destination computer is on the same network or a different network If destination is on a different network, it relays packet to gateway If destination is on a different network, it relays packet to gateway Gateway forwards packet to its next destination (routing) Gateway forwards packet to its next destination (routing) Packet eventually reaches destination Packet eventually reaches destination

36. In-Class Exercises These aren’t in the handout, but you can practice them by doing project X1 for extra credit.

37. Good Network 192.168.1.101 255.255.255.0 192.168.1.1 192.168.1.102 255.255.255.0 192.168.1.1 192.168.1.103 255.255.255.0 192.168.1.1 255.255.255.0 147.144.51.1 IP Address Subnet Mask Default Gateway Hub To the Internet A B CD Network: 192.168.1.0

38. Duplicate IP Address 192.168.1.101 255.255.255.0 192.168.1.1 192.168.1.101 255.255.255.0 192.168.1.1 192.168.1.103 255.255.255.0 192.168.1.1 255.255.255.0 147.144.51.1 IP Address Subnet Mask Default Gateway Hub To the Internet A B CD Network: 192.168.1.0

39. IP Address Outside Subnet 192.168.1.101 255.255.255.0 192.168.1.1 192.168.2.102 255.255.255.0 192.168.1.1 192.168.1.103 255.255.255.0 192.168.1.1 255.255.255.0 147.144.51.1 IP Address Subnet Mask Default Gateway Hub To the Internet A B CD Network: 192.168.1.0

40. Wrong Subnet Mask 192.168.1.101 255.255.255.0 192.168.1.1 192.168.1.102 255.255.0.0 192.168.1.1 192.168.1.103 255.255.255.0 192.168.1.1 255.255.255.0 147.144.51.1 IP Address Subnet Mask Default Gateway Hub To the Internet A B CD Network: 192.168.1.0

41. Wrong Default Gateway 192.168.1.101 255.255.255.0 192.168.1.1 192.168.1.102 255.255.255.0 192.168.1.101 192.168.1.103 255.255.255.0 192.168.1.1 255.255.255.0 147.144.51.1 IP Address Subnet Mask Default Gateway Hub To the Internet A B CD Network: 192.168.1.0

42. IPv6 Modern operating systems like Windows 7 use IPv6 in addition to IPv4 Modern operating systems like Windows 7 use IPv6 in addition to IPv4 IPv6 addresses are much longer: 128 bits instead of the 32 bits used by IPv4 IPv6 addresses are much longer: 128 bits instead of the 32 bits used by IPv4