TCP/IP Concepts Review - CyberSDcybersd.com/secplus11/lectures2/TCP_IPReview.pdf · TCP/IP...
Transcript of TCP/IP Concepts Review - CyberSDcybersd.com/secplus11/lectures2/TCP_IPReview.pdf · TCP/IP...
1
TCP/IP Concepts Review
A CEH Perspective
2
Objectives
At the end of this unit, you will be able to:
Describe the TCP/IP protocol stack
For each level, explain roles and vulnerabilities
Explain basic IP addressing concepts
including ports, protocols, and subnetting
Identify and use the following numbering
systems
Binary
Octal, and
Hexadecimal
3
TCP/IP Overview
Transmission Control Program/Internet Protocol
Worlds most widely used protocol
Vint Cerf aka father of the Internet
TCP/IP Vulnerabilities Lack of identification and
authentication
In design, no security goals
TCP/IP Four layered stack1. Application
2. Transport
3. Internet
4. Network Interface
4
Levels of Data Structures
At the Application Level,
Stream or Message
At the Transport Level,
Segment or Datagram
At the IP Level,
Datagram
At the Media Level,
Frame
5
Transmit
and
receive
data flows
6
Layers Described
7
Application Layer
Interface between application program and
lower-layer protocols
Application program is what you see and
touch
Includes HTTP
FTP
TFTP
SNMP
SMTP
8
TCP/IP Application Protocols
9
Transport Layer
TCP
Encapsulates TCP data
into segments
TCP is connection-oriented
TCP connections begin
with a three-way
handshake
Computer A sends a SYN
packet
Computer B replies with a
SYN-ACK packet
Computer A replies with an
ACK packet
UDP
Encapsulates UDP data
into datagrams
UDP is connectionless
SSL also operates at
this level …
10
TCP Segment Headers
Critical components:
Flags
Ports source and destination
Initial Sequence Number (ISN)
To identify vulnerabilities, can be (actively)
abused
NMap
Hping
Other packet shapers
11
TCP Header
12
TCP Flags
Each flag is one bit
Either 0 (off) or 1 (on)
Six flags
SYN: synchronization
ACK: acknowledge
PSH: push
URG: urgent
RST: reset
FIN: finish
13
Initial Sequence Number (ISN)
32-bit number
Tracks packets received
Enables reassembly of large packets
Set on steps 1 and 2 of the TCP three-way handshake
14
Transport Level Ports
Port
Logical, connection component
Typically used to map a packet to a running
process
Two socket components (IP:Port)
Port numbers are 16-bit integers
216 X 2 possible ports
Both source and destination ports are utilized
Enables unneeded services to be identified
Unneeded open ports represent, potentially
serious, vulnerabilities
15
Port Categories
Well-known ports are defined as the first (lower)
1024 (Numbered 0 – 1023) ports
Well known means that they have an assigned service
In Linux, only privileged system or root processes can use
lower level ports
Example: HTTP uses port 80
Internet Assigned Numbers Authority (IANA)
maintains well-known ports list (www.iana.org)
Ports 1024 to 49151 are called the Registered Ports
Ports 49152 to 65535 are called Dynamic or Private
Ports
16
TCP Port Examples
Ports 20 and 21 File Transfer Protocol (FTP)
Use for sharing files over the Internet
Requires a logon name and password
Port 25 Simple Mail Transfer Protocol (SMTP)
E-mail servers listen on this port
Port 53 Domain Name Service (DNS)
Helps users connect to Web sites using URLs instead of IP addresses
Port 69 Trivial File Transfer Protocol
Used for transferring router configurations
17
TCP Port Examples Expanded
Port 80 Hypertext Transfer Protocol
(HTTP)
Used when connecting to a Web server
Port 110 Post Office Protocol 3
(POP3)
Used for retrieving e-mail
Port 389 Active Directory
Port 135 Remote Procedure Call
(RPC)
Critical for the operation of Microsoft Exchange Server and Active Directory
Port 139 NetBIOS
Used by Microsoft’s NetBIOS Session Service
Port 143 Internet Message Access
Protocol 4 (IMAP4)
Used for retrieving e-mail
Better than POP3
18
User Datagram Protocol (UDP)
Fast, unreliable (connectionless) transport
layer protocol
No delivery verification
Does not even check that receiver is listening
Higher TCP/IP stack layers may provide
reliability
19
Internet Layer
Responsible for:
1. Logical addressing and
2. Routing packets to their destination
Uses a logical IP addresses
IP is connectionless
20
Internet Layer
Nothing can be directly sent to a logical (IP) Address.
Information can only be directly sent to physical i.e. MAC Addresses
ARP translates between IP and MAC Addresses
DHCP offers IP configuration services
21
ICMP
Internet Control Message Protocol (ICMP)
Used to send messages relating to network
operations
Aides network troubleshooting
Example commands include:
Ping
Traceroute
Note:
Can be misused as in a Smurf DoS attack
22
23
IPv4 Address
Four bytes, 32 bits
Two components
Network address
Host address
Classes
Class A
Class B
Class C
24
IPv6
Described in RFC 2460
Uses 128 bit address
Space for 2128 individual addresses
64 bit Host address with 64 bit Network address
Mandates IPSec support
25
IPv4 Address Classes
26
Class A IP Address
Class A
First byte network address
Last three bytes host address
Supports more than 16 million host computers
Limited number of Class A networks
Format: network.node.node.node
27
Class B IP Addressing
Class B
First two bytes for network address
Last two bytes host address
Supports more than 65,000 host computers
Assigned to large corporations and Internet Service
Providers (ISPs)
Format: network.network.node.node
28
Class C IP Addressing
Class C
First three bytes for network address
Last byte for host address
Supports up to 254 host computers
Usually available for small business and home
networks
Format: network.network.network.node
29
Subnetting
Subnetting
Each network can be assigned a
subnet mask
Helps separate the network address
bits from the host address bits
RFC 950
http://tools.ietf.org/html/rfc950
30
Class C Subnets
In the final
column, red
represents the
number of
host bits,
while blue
represents the
number of
borrowed
subnet bits.
31
Planning IP Address Assignments
Each network segment requires a unique network
address
Addresses containing all 0s or all 1s cannot be hosts
All 1s is a broadcast
All 0s represents a network
Accessing entities and services on other networks
Requires gateway
Subnet mask used to determine destination computer’s
network address
If addresses are different, packets relayed to gateway
Gateway forwards packet to its next destination
Packet eventually reaches destination
32
Numbering Systems Overview
Binary
Octal
Hexadecimal
33
Reviewing the Binary Numbering
System Uses the number 2 as its base
Binary digits (bits): 0 and 1
Byte
8 bit group
Can represent 28 = 256 different values
Linux file permissions can be represented
with bits
0 means removing the permission
1 means granting the permission
111 (rwx) means all permissions apply
34
Examples of Determining Binary
Values Each position represents a power of 2 value
Usually the bit on the right is the less significant
bit
Converting 1011 to decimal
1 x 20 = 1
1 x 21 = 2
0 x 22 = 0
1 x 23 = 8
1 + 2 + 8 = 11 (decimal value)
35
Understanding Nibbles
Half a byte or four bits
Helps with reading the number by separating
the byte
1111 1010
Components
High-order nibble (left side)
Low-order nibble (right side)
36
Understanding Nibbles (continued)
Converting 1010 1010 to decimal
Low-order nibble
1010 = 10 (base 10)
Multiply high-order nibble by 16
1010 = 10 x 16 = 160 (base 10)
160 + 10 = 170 (base 10)
37
Octal Numbering System
Uses 8 as base
Supports digits from 0 to 7
Octal digits can be represented with three
bits
Permissions on UNIX
Owner permissions (rwx)
Group permissions (rwx)
Other permissions (rwx)
Example binary: 111 101 001
Octal representation 751
38
Hexadecimal Numbering System
Uses 16 as its base
Support numbers from 0 to 15
Hex number consists of two characters
Each character represents a nibble
Value contains alphabetic letters (A … F)
A representing 10 and F representing 15
Sometimes expressed with “0x” in front
Represent hex number in binary or decimal
Convert each nibble to binary
Convert binary value to decimal
39
Questions???