Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop"

Transcription

1 Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop R. David Idol Department of Computer Science University of North Carolina at Chapel Hill Abstract Data is commonly exchanged between hosts over the Internet using the Transmission Control Protocol (TCP) and Internet Protocol (IP) protocols. TCP, built on top of IP, associates each piece of data (packet) sent between two unique applications on different hosts with an ongoing connection, or flow, between these hosts. This paper presents an overview of TCP flows, a methodology for detecting flows given a large network traffic trace file, and the results of analyzing a 20GB trace. This analysis provides information about the average duration of a flow, average number of packets sent during a flow, average number of bytes sent during a flow, average idle time during a flow, and average throughput during a flow. These results are further categorized by known application protocols, and an analysis of the different characteristics of each protocol is given. 1. Introduction Transmission Control Protocol (TCP) is a transport-layer networking protocol used for sending and receiving data over the Internet. TCP allows the sending of data packets, or finite-sized chunks of information, between two hosts. TCP is built on top of the Internet Protocol (IP), which has its own notion of data segments (called frames). One important aspect of the IP protocol is the concept of an IP address, which is a unique number used (in the range of 0 to for IPv4) to represent a host on the Internet. IP frames that are sent over the Internet include the source and destination IP addresses inside header fields, and these fields are used to route the frame to the destination IP address. TCP packets add an additional routing layer on top of IP addresses known as a port number. A port number is a unique number (in the range of 0 to for IPv4/6) that specifies which application running on the host should receive the packet. The source and destination port numbers are included in the TCP packet headers. The use of port numbers allows applications to receive only the data relevant to it rather than having to filter through all of the data received by that host. The routing of TCP packets to specific applications is done internally on the given host by the Operating System (OS), as opposed to IP address routing, which is handled by the routers along the network. Because the OS uses TCP port numbers to determine which packets are relevant to which applications, certain applications have port numbers that are reserved for that application. These applications provide their own application-layer protocols on top of TCP/IP (typically) and expect packets received on their specific protocols to conform to these particular protocol specifications. In general, ports 0 to 1024 are special reserved ports that applications cannot use unless they are implementing the associated application-layer protocol, as enforced by the OS. While higher numbered ports do not have this restriction, many applications will still use a specific port number for all associated traffic (in a sense

2 reserving that port). On the other hand, some applications may choose to use a dynamic or random port number, and as such it may not be possible to determine the originating application of a packet with a specific port number. TCP is a connection-oriented protocol, which means that an abstract connection is established between the two hosts. This connection is must be created with a special handshake protocol, and once active, all packets sent between the two hosts are guaranteed to be delivered reliably and in the order in which they are sent. Because the IP protocol provides no such guarantees, TCP must utilize special mechanisms in order for these properties to hold. TCP packets are given sequence numbers and every packet received by a remote host must be acknowledged by sending an ACK packet back to the original sender. If a packet is not acknowledged or it is determined that packets were not received in the correct order, then the original sender will retransmit the packets as many times as needed to correct this. All packets sent during a single, ongoing TCP connection is known as a flow. This paper presents analysis of TCP flows for several common protocols using data collected from the University of North Carolina s campus network. The approach and methodology used to gather the data and perform the analysis is discussed in Section 2. Section 3 presents the results and analysis. Section 4 concludes the paper. 2. Approach and Methodology In order to analyze common protocol flows in a way that is both general and significant, it is important to select a proper data set for analysis. The data set should be large to reduce the statistical weight of outliers and ensure a large sample size, it should be obtained from multiple types of users and hosts to introduce a variety of use cases, and it should include all significant information about the flows in order to produce meaningful analysis. The data set chosen for the analysis in this paper is a trace of all traffic on the UNC campus network taken over a period of several hours during the evening of August 3, As such, the trace satisfies the requirement of being large (more than one million packets are recorded in the trace the entire file exceeds 20GB in size). Given that the trace covers traffic from all users of the university s network, it arguably satisfies the requirement that many different types of users are represented in the trace, although there is clearly a bias towards the types of users present on a university network (namely students and faculty). Thus, we cannot conclude that any analysis of this trace applies directly to the general public. The network trace was recorded in libpcap format, a binary-based format that contains records of all TCP/IP packet information as well as a timestamp of when each packet was sent. This format is commonly used to record network traces, as it is space-efficient and can be parsed quickly. Many common traffic-sniffing tools, such as tcpdump and Wireshark, use the libpcap format. In order to preserve anonymity and protect the privacy of the university network s users, all packet payload content was removed. As such, only the packet headers are recorded in the trace. Due to the fact that the data set is so large, traditional tools for analysis were not feasible. Placing the data into a traditional relational database on a single computer and using traditional Structured Query Language (SQL) queries, for example, would be impractical due to the sequential nature of the query operations. In order to perform fast analysis of the data, the Apache Hadoop framework was used. This framework allows for parallel processing of large data sets over a distributed system. This processing is done using

3 the MapReduce model, in which a large data set is split into chunks, processed in parallel, and analyzed to produce outputs; at which point the outputs are assembled back together [1]. More specifically, after a master process splits the input file into chunks, each chunk is given to a mapper processes that then maps the chunk into a collection of keys with associated values. These collections are then further processed in parallel by the reducer processes, which perform the actual analysis of the mapped data. In this case, a Hadoop cluster, consisting of approximately 300 interconnected machines utilizing the MapReduce model, was used to process the data. One challenge of using Hadoop is that the input data must be easily parsed as well as partitioned. The libpcap format does not allow data partitioning at arbitrary locations it must be read as a whole rather than allowing reads to begin at arbitrary positions. Thus is due to the fact that packets are represented as dense binary data and can be arbitrary lengths (thus splitting at an arbitrary offset may end up splitting in the middle of a packet) [2]. Some recent open source solutions to parse pcap files using Hadoop do exist, such as the hadoop-pcap library [3]. After several failed attempts at using such libraries no an actual Hadoop cluster, however, an alternative solution was explored. In order to solve this problem and run quick and effective Hadoop-based analysis programs, the data set was converted to a tab-delimited, plaintext format (Figure 1). This conversion process was done as a preprocessing step using the tool tshark, a part of the Wireshark command line tool suite [4]. The exact command used to process the data is as follows: tshark -T fields -n -r inputdata.pcap -e frame.time -e tcp.len -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport > outputdata.txt As seen in the above command, the timestamp, length (size in bytes), source IP address, source TCP port, destination IP address, and destination TCP port fields of the packet were selected to be saved in the output text and the rest of the data was discarded. Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Aug 3, :00: Figure 1: Converted plaintext data These fields were chosen because they are sufficient to determine which TCP flow the packet belongs to as well as useful in recording statistics about that flow. The goal of the analysis was two-fold: the first goal was to logically partition the input data into TCP flows and gather information about the number of packets transmitted during the flow, number of bytes sent during the flow, duration, idle time, and average throughput of the flow. Afterwards, the second goal was to take that flow data and perform an additional analysis of application flows that use well-known port numbers (as described in the Introduction). The desired output information for the per-protocol analysis consists of the averages of the above metrics (number of packets transmitted in a flow for that protocol, the average duration of a flow, the average number of bytes sent during a flow, the average idle time of a flow, and the average throughput of a flow). These numbers were obtained by running two Hadoop programs: the first program processed the plaintext input to determine flows. In order to determine the individual flow of a given packet, the source IP

4 address/port number and the destination IP address/port number were extracted. Given that a flow is any communication between these two endpoints, it contains both packets sent from host A to host B as well as packets sent from host B to host A. For each flow, the size of each packet was added to a running total used to determine the total number of bytes sent in the flow. Subtracting the timestamp of the last packet sent in the flow from the timestamp of the first packet sent in the flow produces the duration of the flow. Calculating idle time required setting a delay threshold between packet transmissions (1 minute), above which any time elapsed is considered idle time. After these metrics were calculated, the ratio of bytes sent/duration was calculated for each flow to determine the average throughput. The second Hadoop program reduced the scope of the analysis to a subset of known protocols: File Transfer Protocol (FTP), Secure Shell (SSH), Simple Mail Transfer Protocol (SMTP), Hyper Text Transfer Protocol (HTTP), Quicktime streaming, Valve Steam, Xbox Live, AOL Instant Messenger (AIM), Virtual Network Computing (VNC), and Gnutella network. These protocols were chosen partly due to their variety (streaming vs. non-streaming data, text-based vs. binary-based, etc.) and partly due to the fact that they use well known port numbers, thus reducing the likelihood that packets associated with other unknown/unconsidered protocols are factored into the results. The second Hadoop program was supplied with a list of the port numbers for each of the above protocols as input. From there, it grouped each flow that had an endpoint with a known port number together and performed analysis by totaling all of the metrics collected by the first program and then averaging them over all of the associated flows. 3. Results The results of the first program, giving analysis on a per-flow basis, are too large to include completely in this document as over 300,000 flows were identified and analyzed. The averages are as follows: Avg. duration (ms) Avg. num. packets sent Avg. num. bytes sent Avg. idle time (ms) Avg. throughput (bytes/sec) The results of the second program, giving analysis of all flows on a per-protocol basis, are as follows: Duration (ms) Number of packets Number of bytes sent Avg. idle time (ms) Avg. throughput (bytes/sec) FTP data (port 20) HTTP (port 80) AIM (port 5190) VNC (port 5800) SSH (port 22) Quicktime Streaming (port 554)

5 Xbox Live (port 3074) SMTP (port 25) Steam (port 1725) Gnutella (port 6346) Avg. duration (ms) Figure 2: Average duration per protocol Avg. number of packets Figure 3: Average number of packets per protocol

6 Avg. number of bytes sent Figure 4: Average number of bytes sent per protocol Avg. idle time (ms) Figure 5: Average idle time per protocol

7 Avg. throughput Figure 6: Average throughput per protocol The results of the above analysis show that application protocols that involve the sending or receiving of large files (such as FTP and Quicktime Streaming) typically have more packets sent than those that do not (such as SMTP). Surprisingly, the average flow duration between the different protocols is roughly the same. A degree of error was likely introduced to these results given that the port numbers of the applications outside the range of reserved ports may not be stable or correct. In addition, some applications rely on specialized protocols that affect the lifecycle of a TCP connection such as load balancers, in which a client makes an initial request to a known server that is subsequently handled by an entirely different server on a possibly different IP address or TCP port number, thus segmenting what is conceptually one flow into multiple TCP connections. 4. Concluding Remarks In addition to providing data and analysis relevant to the specific application protocols examined in this paper, it is the hope of the author that these methods continue to be used to give insight into protocols at the flow level. Application layer protocols are seldom analyzed at such a high level typically analysis is done at the packet or message (concatenated packets that make up a single application-level transmission) level. Such information leads to a greater understanding of the protocol as it works over time as well as how factors such as user interaction delay can affect response time and throughput. For example, factors such as flow duration can be important due to the fact TCP connections have associated overhead to set up and tear down. The analysis presented in this paper could easily be extended to provide important metrics such as the average number of packet retransmissions caused by TCP, the average size of a file transferred in a specific FTP session, etc.

8 5. References [1] Dean, J., Ghemawat, S., MapReduce: Simplified Data Processing on Large Clusters, Proceedings of OSDI, 2004 [2] Harris, G., Development/LibpcapFileFormat, Wireshark, March [3] Nagele, W., RIPE-NCC/hadoop-pcap, GitHub, January [4] Wireshark Documentation, tshark The Wireshark Network Analyzer 1.8.0, Wireshark,

LESSON 3.6. 98-366 Networking Fundamentals. Understand TCP/IP

LESSON 3.6. 98-366 Networking Fundamentals. Understand TCP/IP Understand TCP/IP Lesson Overview In this lesson, you will learn about: TCP/IP Tracert Telnet Netstat Reserved addresses Local loopback IP Ping Pathping Ipconfig Protocols Anticipatory Set Experiment with

More information

Transport Layer Protocols

Transport Layer Protocols Transport Layer Protocols Version. Transport layer performs two main tasks for the application layer by using the network layer. It provides end to end communication between two applications, and implements

More information

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2

More information

Solution of Exercise Sheet 5

Solution of Exercise Sheet 5 Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????

More information

Understand the OSI Model

Understand the OSI Model Understand the OSI Model Part 2 Lesson Overview In this lesson, you will learn information about: Frames Packets Segments TCP TCP/IP Model Well-known ports for most-used purposes Anticipatory Set Review

More information

How do I get to www.randomsite.com?

How do I get to www.randomsite.com? Networking Primer* *caveat: this is just a brief and incomplete introduction to networking to help students without a networking background learn Network Security. How do I get to www.randomsite.com? Local

More information

Overview of TCP/IP. TCP/IP and Internet

Overview of TCP/IP. TCP/IP and Internet Overview of TCP/IP System Administrators and network administrators Why networking - communication Why TCP/IP Provides interoperable communications between all types of hardware and all kinds of operating

More information

Analyze TCP traces to learn about capturing network path metrics and events. Produce and analyze your own traces.

Analyze TCP traces to learn about capturing network path metrics and events. Produce and analyze your own traces. Ricky Mok 1 Analyze TCP traces to learn about capturing network path metrics and events. Produce and analyze your own traces. Warning! This lab is NOT easy. Ask questions if you get lost. 2 Reliable data

More information

Protocols and Architecture. Protocol Architecture.

Protocols and Architecture. Protocol Architecture. Protocols and Architecture Protocol Architecture. Layered structure of hardware and software to support exchange of data between systems/distributed applications Set of rules for transmission of data between

More information

IP Network Layer. Datagram ID FLAG Fragment Offset. IP Datagrams. IP Addresses. IP Addresses. CSCE 515: Computer Network Programming TCP/IP

IP Network Layer. Datagram ID FLAG Fragment Offset. IP Datagrams. IP Addresses. IP Addresses. CSCE 515: Computer Network Programming TCP/IP CSCE 515: Computer Network Programming TCP/IP IP Network Layer Wenyuan Xu Department of Computer Science and Engineering University of South Carolina IP Datagrams IP is the network layer packet delivery

More information

Module 11: TCP/IP Transport and Application Layers

Module 11: TCP/IP Transport and Application Layers Module 11: TCP/IP Transport and Application Layers 11.1 TCP/IP Transport Layer 11.1.1 Introduction to the TCP/IP transport layer The primary duties of the transport layer are to transport and regulate

More information

We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall

We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,

More information

A Layered Approach to Computer Networks

A Layered Approach to Computer Networks A Layered Approach to Computer Networks Physical Layer Data Link Layer Network Layer Transport Layer Session Layer Presentation Layer Application Layer Different layer of abstraction Different error control

More information

Protocols. Packets. What's in an IP packet

Protocols. Packets. What's in an IP packet Protocols Precise rules that govern communication between two parties TCP/IP: the basic Internet protocols IP: Internet Protocol (bottom level) all packets shipped from network to network as IP packets

More information

PART OF THE PICTURE: The TCP/IP Communications Architecture

PART OF THE PICTURE: The TCP/IP Communications Architecture PART OF THE PICTURE: The / Communications Architecture 1 PART OF THE PICTURE: The / Communications Architecture BY WILLIAM STALLINGS The key to the success of distributed applications is that all the terminals

More information

Hands-on Network Traffic Analysis. 2015 Cyber Defense Boot Camp

Hands-on Network Traffic Analysis. 2015 Cyber Defense Boot Camp Hands-on Network Traffic Analysis 2015 Cyber Defense Boot Camp What is this about? Prerequisite: network packet & packet analyzer: (header, data) Enveloped letters inside another envelope Exercises Basic

More information

Sage ERP Accpac Online

Sage ERP Accpac Online Sage ERP Accpac Online Mac Resource Guide Thank you for choosing Sage ERP Accpac Online. This Resource Guide will provide important information and instructions on how you can get started using your Mac

More information

Sage 300 ERP Online. Mac Resource Guide. (Formerly Sage ERP Accpac Online) Updated June 1, 2012. Page 1

Sage 300 ERP Online. Mac Resource Guide. (Formerly Sage ERP Accpac Online) Updated June 1, 2012. Page 1 Sage 300 ERP Online (Formerly Sage ERP Accpac Online) Mac Resource Guide Updated June 1, 2012 Page 1 Table of Contents 1.0 Introduction... 3 2.0 Getting Started with Sage 300 ERP Online using a Mac....

More information

- TCP and UDP - Transport Layer Protocols

- TCP and UDP - Transport Layer Protocols 1 Transport Layer Protocols - TCP and UDP - The Transport layer (OSI Layer-4) does not actually transport data, despite its name. Instead, this layer is responsible for the reliable transfer of data, by

More information

Networks and Security Lab. Network Forensics

Networks and Security Lab. Network Forensics Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite

More information

By: Chunyan Fu, PhD, Ericsson Canada

By: Chunyan Fu, PhD, Ericsson Canada TCP/UDP Basics By: Chunyan Fu, PhD, Ericsson Canada Internet Model Application TCP/UDP IP Link layer Physical layer Transport Service Overview Provide service to application layer by using the service

More information

TCP Packet Tracing Part 1

TCP Packet Tracing Part 1 TCP Packet Tracing Part 1 Robert L Boretti Jr (robb@us.ibm.com) Marvin Knight (knightm@us.ibm.com) Advisory Software Engineers 24 May 2011 Agenda Main Focus - TCP Packet Tracing What is TCP - general description

More information

TCP - Introduction. Features of TCP

TCP - Introduction. Features of TCP TCP - Introduction The Internet Protocol (IP) provides unreliable datagram service between hosts The Transmission Control Protocol (TCP) provides reliable data delivery It uses IP for datagram delivery

More information

Internet Protocol: IP packet headers. vendredi 18 octobre 13

Internet Protocol: IP packet headers. vendredi 18 octobre 13 Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)

More information

1. The Web: HTTP; file transfer: FTP; remote login: Telnet; Network News: NNTP; e-mail: SMTP.

1. The Web: HTTP; file transfer: FTP; remote login: Telnet; Network News: NNTP; e-mail: SMTP. Chapter 2 Review Questions 1. The Web: HTTP; file transfer: FTP; remote login: Telnet; Network News: NNTP; e-mail: SMTP. 2. Network architecture refers to the organization of the communication process

More information

TCP/IP Concepts Review. A CEH Perspective

TCP/IP Concepts Review. A CEH Perspective TCP/IP Concepts Review A CEH Perspective 1 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP

More information

(Refer Slide Time: 02:17)

(Refer Slide Time: 02:17) Internet Technology Prof. Indranil Sengupta Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture No #06 IP Subnetting and Addressing (Not audible: (00:46)) Now,

More information

To see the details of TCP (Transmission Control Protocol). TCP is the main transport layer protocol used in the Internet.

To see the details of TCP (Transmission Control Protocol). TCP is the main transport layer protocol used in the Internet. Lab Exercise TCP Objective To see the details of TCP (Transmission Control Protocol). TCP is the main transport layer protocol used in the Internet. The trace file is here: http://scisweb.ulster.ac.uk/~kevin/com320/labs/wireshark/trace-tcp.pcap

More information

Limitations of Packet Measurement

Limitations of Packet Measurement Limitations of Packet Measurement Collect and process less information: Only collect packet headers, not payload Ignore single packets (aggregate) Ignore some packets (sampling) Make collection and processing

More information

Networking Test 4 Study Guide

Networking Test 4 Study Guide Networking Test 4 Study Guide True/False Indicate whether the statement is true or false. 1. IPX/SPX is considered the protocol suite of the Internet, and it is the most widely used protocol suite in LANs.

More information

Technical Support Information Belkin internal use only

Technical Support Information Belkin internal use only The fundamentals of TCP/IP networking TCP/IP (Transmission Control Protocol / Internet Protocols) is a set of networking protocols that is used for communication on the Internet and on many other networks.

More information

Frequently Asked Questions

Frequently Asked Questions Frequently Asked Questions 1. Q: What is the Network Data Tunnel? A: Network Data Tunnel (NDT) is a software-based solution that accelerates data transfer in point-to-point or point-to-multipoint network

More information

Access Control: Firewalls (1)

Access Control: Firewalls (1) Access Control: Firewalls (1) World is divided in good and bad guys ---> access control (security checks) at a single point of entry/exit: in medieval castles: drawbridge in corporate buildings: security/reception

More information

INTERNET ENABLED SYSTEMS NETWORK PROTOCOLS

INTERNET ENABLED SYSTEMS NETWORK PROTOCOLS DEVICES AND COMMUNICATION BUSES FOR DEVICES NETWORK Lesson-24: INTERNET ENABLED SYSTEMS NETWORK PROTOCOLS 1 Internet enabled embedded system Communication to other on the Internet. Use html (hyper text

More information

Lecture 2-ter. 2. A communication example Managing a HTTP v1.0 connection. G.Bianchi, G.Neglia, V.Mancuso

Lecture 2-ter. 2. A communication example Managing a HTTP v1.0 connection. G.Bianchi, G.Neglia, V.Mancuso Lecture 2-ter. 2 A communication example Managing a HTTP v1.0 connection Managing a HTTP request User digits URL and press return (or clicks ). What happens (HTTP 1.0): 1. Browser opens a TCP transport

More information

What TCP/IP Protocol Headers Can Tell Us About the Web

What TCP/IP Protocol Headers Can Tell Us About the Web at Chapel Hill What TCP/IP Protocol Headers Can Tell Us About the Web Félix Hernández Campos F. Donelson Smith Kevin Jeffay David Ott SIGMETRICS, June 2001 Motivation Traffic Modeling and Characterization

More information

Note! The problem set consists of two parts: Part I: The problem specifications pages Part II: The answer pages

Note! The problem set consists of two parts: Part I: The problem specifications pages Part II: The answer pages Part I: The problem specifications NTNU The Norwegian University of Science and Technology Department of Telematics Note! The problem set consists of two parts: Part I: The problem specifications pages

More information

3. MONITORING AND TESTING THE ETHERNET NETWORK

3. MONITORING AND TESTING THE ETHERNET NETWORK 3. MONITORING AND TESTING THE ETHERNET NETWORK 3.1 Introduction The following parameters are covered by the Ethernet performance metrics: Latency (delay) the amount of time required for a frame to travel

More information

CPS221 Lecture: Layered Network Architecture

CPS221 Lecture: Layered Network Architecture CPS221 Lecture: Layered Network Architecture Objectives last revised 9/10/12 1. To discuss the OSI layered architecture model 2. To discuss the specific implementation of this model in TCP/IP Materials:

More information

Question: 3 When using Application Intelligence, Server Time may be defined as.

Question: 3 When using Application Intelligence, Server Time may be defined as. 1 Network General - 1T6-521 Application Performance Analysis and Troubleshooting Question: 1 One component in an application turn is. A. Server response time B. Network process time C. Application response

More information

Guide to TCP/IP, Third Edition. Chapter 5: Transport Layer TCP/IP Protocols

Guide to TCP/IP, Third Edition. Chapter 5: Transport Layer TCP/IP Protocols Guide to TCP/IP, Third Edition Chapter 5: Transport Layer TCP/IP Protocols Objectives Understand the key features and functions of the User Datagram Protocol Explain the mechanisms that drive segmentation,

More information

Understanding TCP/IP. Introduction. What is an Architectural Model? APPENDIX

Understanding TCP/IP. Introduction. What is an Architectural Model? APPENDIX APPENDIX A Introduction Understanding TCP/IP To fully understand the architecture of Cisco Centri Firewall, you need to understand the TCP/IP architecture on which the Internet is based. This appendix

More information

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002 INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before

More information

Overview of Computer Networks

Overview of Computer Networks Overview of Computer Networks Client-Server Transaction Client process 4. Client processes response 1. Client sends request 3. Server sends response Server process 2. Server processes request Resource

More information

IP - The Internet Protocol

IP - The Internet Protocol Orientation IP - The Internet Protocol IP (Internet Protocol) is a Network Layer Protocol. IP s current version is Version 4 (IPv4). It is specified in RFC 891. TCP UDP Transport Layer ICMP IP IGMP Network

More information

Safe network analysis

Safe network analysis Safe network analysis Generating network traffic captures within a virtual network. Presented by Andrew Martin 1 Introduction What is a sniffer How does sniffing work Usages Scenarios Building safe repositories

More information

Network Traffic Analysis

Network Traffic Analysis 2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing

More information

Lecture 28: Internet Protocols

Lecture 28: Internet Protocols Lecture 28: Internet Protocols 15-110 Principles of Computing, Spring 2016 Dilsun Kaynar, Margaret Reid-Miller, Stephanie Balzer Reminder: Exam 2 Exam 2 will take place next Monday, on April 4. Further

More information

TCP/IP: An overview. Syed A. Rizvi

TCP/IP: An overview. Syed A. Rizvi TCP/IP: An overview Syed A. Rizvi TCP/IP The Internet uses TCP/IP protocol suite to establish a connection between two computers. TCP/IP suite includes two protocols (1) Transmission Control Protocol or

More information

COMP416 Lab (1) Wireshark I. 23 September 2013

COMP416 Lab (1) Wireshark I. 23 September 2013 COMP416 Lab (1) Wireshark I 23 September 2013 2 Before the lab Review the content of communication architecture. Review TCP/IP model and protocol suite. Understand data transferring, layering, and encapsulation/demultiplexing.

More information

Measurement of the Usage of Several Secure Internet Protocols from Internet Traces

Measurement of the Usage of Several Secure Internet Protocols from Internet Traces Measurement of the Usage of Several Secure Internet Protocols from Internet Traces Yunfeng Fei, John Jones, Kyriakos Lakkas, Yuhong Zheng Abstract: In recent years many common applications have been modified

More information

Network Packet Analysis and Scapy Introduction

Network Packet Analysis and Scapy Introduction Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative

More information

Objectives of Lecture. Network Architecture. Protocols. Contents

Objectives of Lecture. Network Architecture. Protocols. Contents Objectives of Lecture Network Architecture Show how network architecture can be understood using a layered approach. Introduce the OSI seven layer reference model. Introduce the concepts of internetworking

More information

COMP 3331/9331: Computer Networks and Applications. Lab Exercise 3: TCP and UDP (Solutions)

COMP 3331/9331: Computer Networks and Applications. Lab Exercise 3: TCP and UDP (Solutions) COMP 3331/9331: Computer Networks and Applications Lab Exercise 3: TCP and UDP (Solutions) AIM To investigate the behaviour of TCP and UDP in greater detail. EXPERIMENT 1: Understanding TCP Basics Tools

More information

Pig Laboratory. Additional documentation for the laboratory. Exercises and Rules. Tstat Data

Pig Laboratory. Additional documentation for the laboratory. Exercises and Rules. Tstat Data Pig Laboratory This laboratory is dedicated to Hadoop Pig and consists of a series of exercises: some of them somewhat mimic those in the MapReduce laboratory, others are inspired by "real-world" problems.

More information

Network Traffic Evolution. Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig

Network Traffic Evolution. Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig Network Traffic Evolution Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig 1 Example trace Name port % bytes % packets bytes per packet world-wide-web 80???????????? netnews 119???????????? pop-3 mail 110????????????...

More information

Ethernet. Ethernet. Network Devices

Ethernet. Ethernet. Network Devices Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking

More information

ΕΠΛ 674: Εργαστήριο 5 Firewalls

ΕΠΛ 674: Εργαστήριο 5 Firewalls ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized

More information

Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP

Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe

More information

CS 268: Lecture 5 (TCP/IP Architecture)

CS 268: Lecture 5 (TCP/IP Architecture) CS 268: Lecture 5 (TCP/IP Architecture) Ion Stoica February 1, 2006 The Problem Before Internet: different packet-switching networks (e.g., ARPANET, ARPA packet radio) - only nodes on the same network

More information

Encapsulating Voice in IP Packets

Encapsulating Voice in IP Packets Encapsulating Voice in IP Packets Major VoIP Protocols This topic defines the major VoIP protocols and matches them with the seven layers of the OSI model. Major VoIP Protocols 15 The major VoIP protocols

More information

Firewall Introduction Several Types of Firewall. Cisco PIX Firewall

Firewall Introduction Several Types of Firewall. Cisco PIX Firewall Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls

More information

Announcements. Lab 2 now on web site

Announcements. Lab 2 now on web site Lab 2 now on web site Announcements Next week my office hours moved to Monday 4:3pm This week office hours Wednesday 4:3pm as usual Weighting of papers for final discussion [discussion of listen] Bro:

More information

EXPLORER. TFT Filter CONFIGURATION

EXPLORER. TFT Filter CONFIGURATION EXPLORER TFT Filter Configuration Page 1 of 9 EXPLORER TFT Filter CONFIGURATION Thrane & Thrane Author: HenrikMøller Rev. PA4 Page 1 6/15/2006 EXPLORER TFT Filter Configuration Page 2 of 9 1 Table of Content

More information

Network Security TCP/IP Refresher

Network Security TCP/IP Refresher Network Security TCP/IP Refresher What you (at least) need to know about networking! Dr. David Barrera Network Security HS 2014 Outline Network Reference Models Local Area Networks Internet Protocol (IP)

More information

Computer Networks & Security 2014/2015

Computer Networks & Security 2014/2015 Computer Networks & Security 2014/2015 IP Protocol Stack & Application Layer (02a) Security and Embedded Networked Systems time Protocols A human analogy All Internet communication is governed by protocols!

More information

Guide to TCP/IP Fourth Edition. Chapter 9: TCP/IP Transport Layer Protocols

Guide to TCP/IP Fourth Edition. Chapter 9: TCP/IP Transport Layer Protocols Guide to TCP/IP Fourth Edition Chapter 9: TCP/IP Transport Layer Protocols Objectives Explain the key features and functions of the User Datagram Protocol and the Transmission Control Protocol Explain,

More information

BASIC ANALYSIS OF TCP/IP NETWORKS

BASIC ANALYSIS OF TCP/IP NETWORKS BASIC ANALYSIS OF TCP/IP NETWORKS INTRODUCTION Communication analysis provides powerful tool for maintenance, performance monitoring, attack detection, and problems fixing in computer networks. Today networks

More information

SSL DOES NOT MEAN SOL What if you don t have the server keys?

SSL DOES NOT MEAN SOL What if you don t have the server keys? SSL DOES NOT MEAN SOL What if you don t have the server keys? J. Scott Haugdahl Architect, Blue Cross Blue Shield MN Robert Bullen Systems Engineer, Blue Cross Blue Shield MN Setting Expectations This

More information

Introduction to Computer Networks

Introduction to Computer Networks Introduction to Computer Networks Chen Yu Indiana University Basic Building Blocks for Computer Networks Nodes PC, server, special-purpose hardware, sensors Switches Links: Twisted pair, coaxial cable,

More information

Chakchai So-In, Ph.D.

Chakchai So-In, Ph.D. Application Layer Functionality and Protocols Chakchai So-In, Ph.D. Khon Kaen University Department of Computer Science Faculty of Science, Khon Kaen University 123 Mitaparb Rd., Naimaung, Maung, Khon

More information

TCP/IP Tutorial. Transmission Control Protocol Internet Protocol

TCP/IP Tutorial. Transmission Control Protocol Internet Protocol TCP/IP Tutorial Transmission Control Protocol Internet Protocol 1 TCP/IP & OSI In OSI reference model terminology -the TCP/IP protocol suite covers the network and transport layers. TCP/IP can be used

More information

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols

More information

2057-15. First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring

2057-15. First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring 2057-15 First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring 7-25 September 2009 TCP/IP Networking Abhaya S. Induruwa Department

More information

Unix System Administration

Unix System Administration Unix System Administration Chris Schenk Lecture 08 Tuesday Feb 13 CSCI 4113, Spring 2007 ARP Review Host A 128.138.202.50 00:0B:DB:A6:76:18 Host B 128.138.202.53 00:11:43:70:45:81 Switch Host C 128.138.202.71

More information

Connecting with Computer Science, 2e. Chapter 5 The Internet

Connecting with Computer Science, 2e. Chapter 5 The Internet Connecting with Computer Science, 2e Chapter 5 The Internet Objectives In this chapter you will: Learn what the Internet really is Become familiar with the architecture of the Internet Become familiar

More information

Transport and Network Layer

Transport and Network Layer Transport and Network Layer 1 Introduction Responsible for moving messages from end-to-end in a network Closely tied together TCP/IP: most commonly used protocol o Used in Internet o Compatible with a

More information

Overview. Protocol Analysis. Network Protocol Examples. Tools overview. Analysis Methods

Overview. Protocol Analysis. Network Protocol Examples. Tools overview. Analysis Methods Overview Capturing & Analyzing Network Traffic: tcpdump/tshark and Wireshark EE 122: Intro to Communication Networks Vern Paxson / Jorge Ortiz / Dilip Anthony Joseph Examples of network protocols Protocol

More information

Network Simulation Traffic, Paths and Impairment

Network Simulation Traffic, Paths and Impairment Network Simulation Traffic, Paths and Impairment Summary Network simulation software and hardware appliances can emulate networks and network hardware. Wide Area Network (WAN) emulation, by simulating

More information

Network Security In Linux: Scanning and Hacking

Network Security In Linux: Scanning and Hacking Network Security In Linux: Scanning and Hacking Review Lex A lexical analyzer that tokenizes an input text. Yacc A parser that parses and acts based on defined grammar rules involving tokens. How to compile

More information

CIT 480: Securing Computer Systems. TCP/IP Security

CIT 480: Securing Computer Systems. TCP/IP Security CIT 480: Securing Computer Systems TCP/IP Security Topics 1. Internet Protocol (IP) 2. IP Spoofing and Other Vulnerabilities 3. ICMP 4. Transmission Control Protocol (TCP) 5. TCP Session Hijacking 6. UDP

More information

Internet Protocol. IP Datagram, Fragmentation and Reassembly

Internet Protocol. IP Datagram, Fragmentation and Reassembly Internet Protocol IP Datagram, Fragmentation and Reassembly IP Datagram Header Data Data (variable length) IP Packet Header number of IP protocol Current version is 4 6 has different header format IP Packet

More information

Lab 3. According to above figure, the client computer (source) s IP address is and the TPC port number is 1161.

Lab 3. According to above figure, the client computer (source) s IP address is and the TPC port number is 1161. Lab 3 1. What is the IP address and TCP port number used by the client computer (source) that is transferring the file to gaia.cs.umass.edu? To answer this question, it s probably easiest to select an

More information

Lecture 23: Firewalls

Lecture 23: Firewalls Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital

More information

Chapter 15. Transmission Control Protocol (TCP) TCP/IP Protocol Suite 1

Chapter 15. Transmission Control Protocol (TCP) TCP/IP Protocol Suite 1 Chapter 15 Transmission Control Protocol (TCP) TCP/IP Protocol Suite 1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. OBJECTIVES: To introduce TCP as a protocol

More information

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection. A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based

More information

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet Review questions 1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet C Media access method D Packages 2 To which TCP/IP architecture layer

More information

CSE 3461 / 5461: Computer Networking & Internet Technologies

CSE 3461 / 5461: Computer Networking & Internet Technologies Autumn Semester 2014 CSE 3461 / 5461: Computer Networking & Internet Technologies Instructor: Prof. Kannan Srinivasan 08/28/2014 Announcement Drop before Friday evening! k. srinivasan Presentation A 2

More information

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users

More information

Limi Kalita / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 5 (3), 2014, 4802-4807. Socket Programming

Limi Kalita / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 5 (3), 2014, 4802-4807. Socket Programming Socket Programming Limi Kalita M.Tech Student, Department of Computer Science and Engineering, Assam Down Town University, Guwahati, India. Abstract: The aim of the paper is to introduce sockets, its deployment

More information

Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol

Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol 1 TCP/IP protocol suite A suite of protocols for networking for the Internet Transmission control protocol (TCP) or User Datagram protocol

More information

Basic Networking Concepts. 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet

Basic Networking Concepts. 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet Basic Networking Concepts 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet 1 1. Introduction -A network can be defined as a group of computers and other devices connected

More information

Hadoop Technology for Flow Analysis of the Internet Traffic

Hadoop Technology for Flow Analysis of the Internet Traffic Hadoop Technology for Flow Analysis of the Internet Traffic Rakshitha Kiran P PG Scholar, Dept. of C.S, Shree Devi Institute of Technology, Mangalore, Karnataka, India ABSTRACT: Flow analysis of the internet

More information

Networks & Security Course. Web of Trust and Network Forensics

Networks & Security Course. Web of Trust and Network Forensics Networks & Security Course Web of Trust and Network Forensics Virtual Machine Virtual Machine Internet connection You need to connect the VM to the Internet for some of the Web of Trust exercises. Make

More information

TCP/IP Protocol Suite. Marshal Miller Chris Chase

TCP/IP Protocol Suite. Marshal Miller Chris Chase TCP/IP Protocol Suite Marshal Miller Chris Chase Robert W. Taylor (Director of Information Processing Techniques Office at ARPA 1965-1969) "For each of these three terminals, I had three different sets

More information

VisuSniff: A Tool For The Visualization Of Network Traffic

VisuSniff: A Tool For The Visualization Of Network Traffic VisuSniff: A Tool For The Visualization Of Network Traffic Rainer Oechsle University of Applied Sciences, Trier Postbox 1826 D-54208 Trier +49/651/8103-508 oechsle@informatik.fh-trier.de Oliver Gronz University

More information

Protocol Data Units and Encapsulation

Protocol Data Units and Encapsulation Chapter 2: Communicating over the 51 Protocol Units and Encapsulation For application data to travel uncorrupted from one host to another, header (or control data), which contains control and addressing

More information

File Transfer And Access (FTP, TFTP, NFS) Chapter 25 By: Sang Oh Spencer Kam Atsuya Takagi

File Transfer And Access (FTP, TFTP, NFS) Chapter 25 By: Sang Oh Spencer Kam Atsuya Takagi File Transfer And Access (FTP, TFTP, NFS) Chapter 25 By: Sang Oh Spencer Kam Atsuya Takagi History of FTP The first proposed file transfer mechanisms were developed for implementation on hosts at M.I.T.

More information

Transportation Protocols: UDP, TCP & RTP

Transportation Protocols: UDP, TCP & RTP Transportation Protocols: UDP, TCP & RTP Transportation Functions UDP (User Datagram Protocol) Port Number to Identify Different Applications Server and Client as well as Port TCP (Transmission Control

More information

Computer Networks. Secure Systems

Computer Networks. Secure Systems Computer Networks Secure Systems Summary Common Secure Protocols SSH HTTPS (SSL/TSL) IPSec Wireless Security WPA2 PSK vs EAP Firewalls Discussion Secure Shell (SSH) A protocol to allow secure login to

More information