DO NOT REPLICATE. Analyze IP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of IP.

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "DO NOT REPLICATE. Analyze IP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of IP."

Transcription

1 Advanced TCP/IP Overview There is one primary set of protocols that runs networks and the Internet today. In this lesson, you will work with those protocols: the Transmission Control Protocol (TCP) and the Internet Protocol (IP). In order to manage the security of a network, you must become familiar with the details of how TCP/IP functions, including core concepts, such as addressing and subnetting, and advanced concepts, such as session establishment and packet analysis. Objectives To better understand advanced TCP/IP concepts, you will: 2A 2B 2C 2D 2E 2F Define the core concepts of TCP/IP. Given a machine running TCP/IP, you will define the core concepts of TCP/IP, including the layering models, RFCs, addressing and subnetting, VLSM and CIDR, and the TCP/IP suite. Analyze sessions of TCP. Given a Windows Server 2003 computer, you will examine control flags, sequence numbers, and acknowledgement numbers, and you will use Network Monitor to view and analyze all of the fields of the three-way handshake and session teardowns. Analyze IP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of IP. Analyze ICMP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of ICMP. Analyze TCP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of TCP. Analyze UDP. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze all the fields of UDP. LESSON 2 Data Files tftp.cap fragment.cap ping.txt ping.cap ftp.txt ftp.cap Lesson Time 6 hours Lesson 2: Advanced TCP/IP 31

2 2G 2H Analyze fragmentation. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze network traffic fragmentation. Complete a full session analysis. Given a Windows Server 2003 computer, you will use Network Monitor to view and analyze a complete FTP session, frame by frame. 32 Tactical Perimeter Defense

3 Topic 2A TCP/IP Concepts In order for two hosts to communicate, there must first be an agreed-upon method of communication for both hosts to use. The protocol that the Internet was built on, and the protocol that all hosts on the Internet use is TCP/IP, or Transmission Control Protocol/Internet Protocol. Because the two hosts agree on the protocol they will use, we can go right into the details of the protocol itself. The TCP/IP Model In order for data to move from one host to another, it must be transmitted and received. There are several ways this could happen, in theory. The data file could be sent as a whole file, intact, from one host to another. The data file could be split in half and sent, sending and receiving two equal sized pieces. The data file could be split into many smaller pieces, all sent and received in a specific sequence. It is this last method that is actually used. For example, if a user is at a host and wants to view a web page on a different host, the request and subsequent response will take many small steps to complete. In Figure 2-1, you can see the four layers of the TCP/IP Model, along with the browser s request for a web page going to the web server. Figure 2-1: A web request moving along the TCP/IP Model. The four layers of the TCP/IP Model are: The Application Layer The Transport Layer The Internet Layer (also called the Network Layer) The Network Access Layer (also called the Link Layer) Many of the Concepts in this topic were covered in the prerequisite courses, but are provided here for review. host: A single computer or workstation; it can be connected to a network. server: A system that provides network service such as disk storage and file transfer, or a program that provides such a service. A kind of daemon that performs a service for the requester, which often runs on a computer other than the client machine. Lesson 2: Advanced TCP/IP 33

4 network: Two or more machines interconnected for communications. OSI: (Open Systems Interconnection) A set of internationally accepted and openly developed standards that meet the needs of network resource administration and integrated network components. The reason that there are alternate names for these layers is that there has never been an agreed-upon standard for the names to which the industry agrees. Each of these layers are detailed as follows: The Application Layer is the highest layer in the model, and communicates with the software that requires the network. In our example, the software is the web page request from a browser. The Transport Layer is where the reliability of the communication is dealt with. There are two protocols that work at this layer, TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). An immediate difference between the two is that TCP does provide for reliable delivery of data, whereas UDP provides no such guarantee. The Internet Layer (or Network Layer) provides the mechanism required to address and move the data from one host to the other. The primary protocol you will examine at this layer is IP (Internet Protocol). The Network Access Layer (or Link Layer) is where the data communication interacts with the physical medium of the network. This is the layer that does the actual sending and receiving of the data. As you saw in Figure 2-1, as the web page request was initiated on the host, it moved down the layers, was transmitted across the network, and moved up the layers on the web server. These are the layers on which all network communication using TCP/IP is based. There is a different set of layers, however, called the OSI Model. The OSI Model The TCP/IP Model works well for TCP/IP communications, but there are many protocols and methods of communication other than TCP/IP. A standard was needed to encompass all of the communication protocols. The standard developed by the International Organization for Standardization (ISO) is called the OSI Model. The Open Systems Interconnect (OSI) Model has seven layers, compared to the four layers of the TCP/IP Model. The seven layers of the OSI Model are: The Application Layer The Presentation Layer The Session Layer The Transport Layer The Network Layer The Data Link Layer The Physical Layer 34 Tactical Perimeter Defense

5 The names of these layers are fixed, as this is an agreed upon standard. The details of each layer are as follows: The Application Layer is the highest layer of the OSI Model, and deals with interaction between the software and the network. The Presentation Layer is responsible for data services such as data compression and data encryption/decryption. The Session Layer is responsible for establishing, managing (such as packet size), and ending a session between two hosts. The Transport Layer is responsible for error control and data recovery between two hosts. Both TCP and UDP work at this layer. The Network Layer is responsible for logical addressing, routing, and forwarding of datagrams. IP works at this layer. The Data Link Layer is responsible for packaging data frames for transmission on the physical medium. Error control is added at this layer, often in the form of a Cyclic Redundancy Check (CRC). This layer is subdivided into the LLC (Logical Link Control) and MAC (Media Access Control) sublayers. The MAC sublayer is associated with the physical address of the network device and the LLC sublayer makes the association between this physical address (such as the 48-bit MAC address if using Ethernet) and the logical address (such as the 32-bit IP address if using IP) at the Network Layer. The Physical Layer is responsible for the actual transmission and receipt of the data bit stream on the physical medium. The OSI Model and the TCP/IP Model do fit together. In Figure 2-2, you can see that the two primary layers of concern in the TCP/IP Model (the Transport and Internet Layers), match directly with the Transport and Network Layers of the OSI Model, while the other two TCP/IP Model layers encompass two or more layers of the OSI Model. Figure 2-2: A comparison of the OSI and TCP/IP Models. As the data from one host flows down the layers of the model, each layer attaches a small piece of information relevant to that layer. This attachment is called the header. For example, the Network Layer header will identify the logical addresses (such as IP addresses) used for this transmission. This process of adding a header at each layer is called encapsulating. Figure 2-3 shows a visual representation of the header and the encapsulation process. packet: A block of data sent over the network transmitting the identities of the sending and receiving stations, errorcontrol information, and message. Lesson 2: Advanced TCP/IP 35

6 Figure 2-3: Headers and the encapsulation process as data moves down the stack. When the second host receives the data, and as the data moves up the layers, each header will let the host know how to handle this piece of data. After all the headers have been removed, the receiving host is left with the data as it was sent. RFCs With all the standards defined in the previous section, you may be asking where to go to find the standards. The answer is to the RFCs. A Request For Comments (RFC) is the industry location for standards relating to TCP/IP and the Internet. RFCs are freely available documents to read and study, and if you ever want to go directly to the source, be sure to use the RFC. Although you will find RFCs listed all over the Internet, to view them all online go to: This is the website with a searchable index of all RFCs. There are several RFCs you should be familiar with, and that you should know by name to look up. This way you will not have to search hundreds of responses to find what you need. The RFCs you should know are: The Internet Protocol (IP): RFC 791. The Internet Control Messaging Protocol (ICMP): RFC 792. The Transmission Control Protocol (TCP): RFC 793. The User Datagram Protocol (UDP): RFC 768. The Function of IP The Internet Protocol (which works at the Network layer of both the OSI and the TCP/IP models), by definition, has a simple function. IP identifies the current host via an address and using addressing, moves a packet of information from one host to another. Each host on the network has a unique IP address, and each packet the host sends will contain its own IP address and the IP address to which the packet is destined. The packets are then directed, or routed, across the network, using the destination address, until they reach their final destination. The receiving host can read the IP address of the sender and send a response, if required. 36 Tactical Perimeter Defense

7 Although it sounds straightforward, and does work, there are drawbacks. For instance, when packets are sent from one host to another, they may be received out of order. IP has no mechanism for dealing with that problem. Also, packets can get lost or corrupted during transmission, again a problem IP does not manage. These problems are left to an upper protocol to manage. Often that protocol will be TCP, as you will see in the following topic. Binary, Decimal, and Hexadecimal Conversions Even though you may be familiar with the concept of binary math, you may wish to review this section briefly. In binary, each bit has the ability to be either a1or a 0. In computers, these bits are stored in groups of 8. Since each bit can be either a 1 or a 0, each location is designated a power of 2. A byte, therefore, has binary values from 2 0 through 2 7. In Figure 2-4, you can see the value of each of the 8 bits in a byte. When the bits are presented as a byte, the value of each of the 8 locations is added to present you with the decimal equivalent. For example, if all 8 bits were 1s, such as , then the decimal value would be 255 or Here are a few other quick binary to decimal conversions: Binary is decimal 192 or Binary is decimal 128 or Binary is decimal 130 or Binary is decimal 90 or The IP addresses that are either manually or dynamically assigned to a host are 32-bit fields, often shown as four decimal values for ease of reading. For example, a common address would be Each number is an 8-bit binary value, or an octet. In this example, the first octet is 192, the second 168, the third 10, and the fourth 1. Even though the fourth octet is given a decimal value of 1, it is still given an 8-bit value in IP addressing. Each bit of the 32-bit address must be represented, so the computer sees a decimal 1 in an IP address as Keeping this in mind, the full decimal IP address of is seen to the computer as binary IP address: In tools that are designed to capture and analyze network traffic, the IP address is often represented in its hexadecimal (Hex) format. The ability to view and recognize addressing in Hex format is a useful skill to have when you are working with TCP/IP. In hexadecimal format, the IP address is C0-A8-0A- 01. The following is a quick summary on Hex conversions. Lesson 2: Advanced TCP/IP 37

8 To convert the decimal address to hexadecimal, convert each of its octets, then combine the results, as follows: 1. Divide 192 by 16. The result is 12, with a remainder of 0. Because decimal 12 is the same as Hex C and decimal 0 is the same as Hex 0, decimal 192 is equal to Hex C0. 2. Divide 168 by 16. The result is 10, with a remainder of 8. Because decimal 10 is the same as Hex A and decimal 8 is the same as Hex 8, decimal 168 is equal to Hex A8. 3. Decimal 10 is the same as Hex A. 4. Decimal 1 is the same as Hex Combining the results of each conversion shows that decimal is equal to Hex C0A80A01. Another way to derive this result is to first convert from decimal to binary, then convert binary to hexadecimal four bits at a time, and finally, combine the results, as shown here: 1. Decimal 192 is the same as binary Decimal 168 is the same as binary Decimal 10 is the same as binary Decimal 1 is the same as binary Binary 1100 (the first four bits of the first octet) is the same as Hex C. 6. Binary 0000 is the same as Hex Binary 1010 is the same as Hex A. 8. Binary 1000 is the same as Hex Binary 0000 is the same as Hex Binary 1010 is the same as Hex A. 11. Binary 0000 is the same as Hex Binary 0001 is the same as Hex Combining the Hex equivalents shows that decimal is equal to Hex C0A80A01. IP Address Classes There are five defined classes of IP addresses: Class A, Class B, Class C, Class D, and Class E. The details of each class are as follows: Class A IP addresses use the first 8 bits of an IP address to define the network, and the remaining 24 bits to define the host. This means there can be more than 16 million hosts in each Class A network (2 24 2, because all 1s and all 0s cannot be used as host addresses). All Class A IP addresses will have a first octet of 0xxxxxxx in binary format is an example of a Class A IP address. Class B IP addresses use the first 16 bits to define the network, and the remaining 16 bits to define the host. This means there can be more than 65,000 hosts in each Class B network (2 16 2). All Class B IP addresses will have a first octet of 10xxxxxx in binary format is an example of a Class B IP address. Class C IP addresses use the first 24 bits to define the network, and the remaining 8 bits to define the host. This means there can be only 254 hosts 38 Tactical Perimeter Defense

9 in each Class C network (2 8 2). All Class C IP addresses will have a first octet of 110xxxxx in binary format is an example of a Class C IP address. Class D IP addressing is not used for hosts, but is often used for multicasting (which will be discussed later), where there is more than one recipient. The first-octet binary value of a Class D IP address is 1110xxxx is an example of a Class D IP address. Class E IP addressing is used for experimental functions and for future use. It does have a defined first-octet binary value as well. All Class E IP addresses have a first octet binary value of 11110xxx is an example of a Class E IP address. Figure 2-4: IP address classes and their first-octet values. Private IP Addresses and Special-function IP Addresses There are several ranges of IP addresses that are not used on the Internet. These addresses are known as private, or reserved, IP addresses. Defined in RFC 1918, any host on any network can use these addresses, but these addresses are not meant to be used on the Internet, and most routers will not forward them. By using these reserved IP addresses, organizations do not have to be as concerned with address conflicts. The defined private addresses for the three main address classes (A, B, and C) are: Class A: to Class B: to Class C: to In addition to the private address ranges listed, there are a few other address ranges that have other functions. The first, is the range of to This address range is used for diagnostic purposes, with the common address of used to identify IP on the host itself. The second range is to This address range is used by Microsoft to allocate addresses to hosts, for Automatic Private IP Addressing (APIPA). Lesson 2: Advanced TCP/IP 39

10 The Subnet Mask Along with an IP address, each host that uses TCP/IP has a subnet mask. The subnet mask is used during a process called ANDing to determine the network to which the host belongs. The way the mask identifies the network is by the number of bits allocated, or masked, for the network. A bit that is masked is identified with a binary value of 1. By default, a Class A IP address has 8 bits masked to identify the network, a Class B IP address has 16 bits masked to identify the network, and a Class C IP address has 24 bits masked to identify the network. These default subnet masks use contiguous bits to create the full mask. The following table shows the default subnet masks for the three classes, first in binary, then in the more traditional dotted decimal format. Default Subnet Masks Class Binary Format Dotted Decimal Format A B C The subnet mask can be represented in different formats. For example, one common format is to list the IP address followed by the full subnet mask, such as this: Another option, and one that is easier to write, is to count and record the number of bits that are used as 1s in the subnet mask. For example, in the default subnet mask for Class C, there are 24 bits designated as 1. So, to use the second format, list the IP address followed by a slash and the number of bits masked, such as this: /24. Subnetting Example In the event that you need to split a network into more than one range, such as having different buildings or floors, you will need to subdivide the network. The following example will step you through the process of splitting a network and creating the subnet mask necessary to support the resulting subnetworks. Let s say you have been assigned the network with the subnet mask, and need to break this up into 12 network ranges to support, for example, the 12 major departments in your corporate building. Here s what you should do: 1. Determine how many bits, in binary, it takes to make up the number of subnetworks you need to create. In binary, 12 is 1100, so you will need 4 bits. 2. Take 4 bits from the host side of the subnet mask and, AND them to the network side, effectively changing your subnet mask from to As you know, the subnet mask tells you where the dividing line between network and host bits reside. You started with a network ID of and subnet mask of , which in binary looks like this: (IP address for network) (subnet mask) Your dividing line is at the end of the first octet (eight bits starting from the left). You have one big network with a network ID of , a 40 Tactical Perimeter Defense

11 range of usable addresses from: to , and a broadcast address of The new, divided network looks like this: (IP address for network) (subnet mask) Notice that the network/host dividing line is now in the middle of the second octet. All of your networks will have binary addresses that will look like this: xxxx yyyy.yyyyyyyy.yyyyyyyy, where x represents one of the variable bits used to create your subnetworks and y represents a bit on the host side of the address. 3. Determine the subnetwork addresses by changing the value of the x bits. The first possible permutation is the network; the second is the network, and so forth. The following table lists all of the possible subnetwork addresses (notice the pattern?). Subnetwork Binary Address Decimal Address First Second Third Fourth Fifth Sixth Seventh Eighth Ninth Tenth Eleventh Twelfth Thirteenth Fourteenth Fifteenth Sixteenth For the first network, the network ID is with a subnet mask of The first usable address is , and the last usable address is The broadcast address is (the next possible IP address would be , which is the network ID of the second network). The second network has an ID of , a usable range of to , and a broadcast address of Notice that you needed only 12 networks, but you have 16. That can happen, depending on the number of networks needed. For example, if you had needed 20 networks, you would have needed to move the network/host dividing line over 5 bits to the right (20 in binary is 10100, so 5 bits must be used). In that case, you would have had a subnet mask of (instead of the that you used for the first example), which would have given you 32 subnetworks, even though you needed only 20. Consider it room for corporate growth! Lesson 2: Advanced TCP/IP 41

12 router: An interconnection device that is similar to a bridge but serves packets or frames containing certain protocols. Routers link LANs at the Network Layer. Note that any combination of addressing can be represented in different text. For example, you may come across a resource that defines the IP address in decimal, and the subnet mask in hexadecimal. You must be able to quickly recognize the addressing as defined. Use the following task to test your ability to quickly perform these conversions. TASK 2A-1 Layering and Address Conversions 1. Describe how layering is beneficial to the function of networking. By using a layered model, network communications can be broken into smaller chunks. These smaller chunks can each have a specific purpose, or function, and in the event an error happens in one chunk, it is possible that only that error be addressed, instead of starting over from scratch. 2. If you have an IP address of and a subnet mask of FF-FF , to which IP network does your computer belong? Provide both decimal and Hex notations. In decimal, the network address is ; in Hex, the network address is C0-A If you have an IP address of C0-A8-0A-01 and a subnet mask of /16, to which IP network does your computer belong? Provide both decimal and Hex notations. In decimal, the network address is ; in Hex the network address is C0-A Routing You will get into routing in more detail later, but at this stage, you will address the basics. Being familiar with a network and how one host will communicate with another host within the same network, what do you think will happen if a host needs to send information to a host that is not in its network? This is exactly the situation where routing is needed. You need to route that information from your network to the receiving host s network. Of course, the device that makes this possible is the router. The first router you will encounter on your way out of your network is the default gateway. This is the device that your computer will send all traffic to, once it determines that the destination host is not local (on the same network as itself). After the default gateway gets a packet of information destined for host User1 on network X, it looks at its routing table (think of this as a sort of directory telling the router that traffic destined for networks C, G, F, and X should go out interface 1, traffic destined for networks E, A, B, and R should go out interface 2, and so forth), then the router forwards the packet out through interface 1. The destination network may or may not be attached to interface 1 the router doesn t really care at this point it just forwards the packet on according to the information in its routing table. This process 42 Tactical Perimeter Defense

13 repeats from one router to the next until the packet finally reaches the router that is attached to the same network as the destination host. When the packet reaches this router, which is usually also the destination host s default gateway, it is sent out on the network as a unicast directed to the destination host User1. VLSM and CIDR The standard methods of subnet masking discussed earlier are effective; however, there are instances where further subdividing is required, or more control of the addressing of the network is desired. In these cases, you can use either of the following two options: Variable Length Subnet Masking (VLSM) or Classless Interdomain Routing (CIDR). Think back to the previous example of subnet masking. In particular, let s take a closer look at the fourth network. It was intended to be used by the IT staff; however, they want to break the rather large network block given to them into smaller, more manageable blocks. Specifically, they need five smaller subnetworks to be created from their network block of with a subnet mask of This time, let s represent the IP addresses and subnet masks using the slash method: /12. Notice the IP address stays the same, but we replace the subnet mask with /12 to tell others that the subnet mask has 12 1s in it (which, of course, corresponds to ). Now, back to the IT staff s networking issue. You have an already subnetted network ( /12) that you would like to split into five smaller networks. To begin, you need to ask the same starting question: How many bits does it take to make 5? In binary, 5 is 101, so you will need three bits. Then, add three bits to the present subnet mask (don t worry that it has already been subnetted before that doesn t matter). So, now you have /15 as your first network address and new subnet mask. The new variable range is xxx y.yyyyyyyy.yyyyyyyy, where the binary numbers will not change, x represents the variable bits that will make up the networks, and y designates the host bits. So, what are the new network addresses? Subnetwork Binary Address Decimal Address First Second Third Fourth Fifth Sixth Seventh Eighth Lesson 2: Advanced TCP/IP 43

14 44 Tactical Perimeter Defense For the first network, the network ID is , the usable addresses are to , and the broadcast address is ; for the second, the network ID is , the usable addresses are to , and the broadcast address is , and so forth. Did you notice that you have eight possible networks when you needed only five? Again, you can consider it just having more room for expansion. X-casting When a packet is sent from one host to another, the process of routing functions and the packet is sent as defined. However, the process is different if one host is trying to reach more than one destination, or if one message is to be received by every other host in the network. These types of communication are referred to as broadcasting, multicasting, and unicasting. Unicast is a term that was created after multicasting and broadcasting were already defined. A unicast is a directed communication between a single transmitter and a single receiver. This is how most communication between two hosts happens, with Host A specifically communicating with Host B. A broadcast is a communication that is sent out from a single transmitting host and is destined for all possible receivers on a segment (generally, everyone in the network, since the routers that direct traffic from one network to another are generally used to stop broadcasts, thereby creating broadcast domain boundaries). Broadcasting can be done for many reasons, such as locating another host. For a MAC broadcast, the broadcast address used is FF:FF:FF:FF:FF:FF. For an IP broadcast, the address used is based on the network settings. For example, if you are on network /24, the broadcast address is A multicast is a communication that is sent out to a group of receivers on the network. Multicasting is often implemented as a means for directing traffic from the presenter of a video conference to the audience. In comparison to the broadcast, which all receivers on the segment will receive, those who wish to receive a multicast must join a group to do so. Group membership is often very dynamic and controlled by a user or an application. Currently, Class D addresses are used for multicasting purposes. Remember, Class D has IP addresses in the range of to TASK 2A-2 Routers and Subnetting 1. You are using a host that has an IP address of and a subnet mask of You are trying to reach a host with the IP address Will you need to go through a router? Explain your response. Yes, you will need to go through a router. Your subnet mask defines you as belonging to network , and the remote host you are trying to reach does not belong to your network. 2. Boot your computer to Windows Server 2003, and log on as Administrator, with a blank (null) password.

15 3. Choose Start Settings Network Connections. Right-click the network interface and choose Properties. 4. Select Internet Protocol (TCP/IP) and click Properties. 5. Click the Advanced button, and verify that the IP Settings tab is displayed. Under Default Gateways, record the IP address here: For the LEFT side of the classroom, the Default Gateway is For the RIGHT side, it is Select the Default Gateway IP address you just recorded, and click Remove. Click OK twice and click Close twice. 7. Open a command prompt and ping an address that is not on your local network. For instance, if you are on the LEFT side of the classroom, you could ping an address in the network, and if you are on the RIGHT side of the classroom, you could ping an address in the network. 8. Observe the message you receive. The text Destination Host unreachable is displayed. Your computer knows that the ping packet is supposed to go to a computer that is outside your local network but it does not know how to get it there. 9. Switch to the Network Connections Control Panel and display the properties of the network interface. 10. Select Internet Protocol (TCP/IP), click Properties, and then click Advanced. On the IP Settings tab, click the Add button found in the Default Gateway area. 11. In the TCP/IP Gateway Address box, enter the IP address you recorded earlier in the task and click Add. Click OK twice and click Close twice. 12. Switch back to the command prompt and try to ping the remote address again. 13. Observe the message you receive. This time, as long as the other computer s default gateway is correctly configured, you should be successful in pinging the remote computer. This is because your computer now knows to send traffic to the router if that traffic is destined for another network. (How the routers know where to send the traffic is covered later in the course.) Contact your instructor if your ping attempt is not successful. 14. Close all open windows. Be prepared to diagram or otherwise explain the classroom setup. The recommended classroom layout is shown in the figure in the setup. Students must be able to ping all computers within the classroom for the remaining tasks to work properly. If any students are not successful in the second ping attempt, help them troubleshoot the issue. Lesson 2: Advanced TCP/IP 45

16 security: A condition that results from the establishment and maintenance of protective measures that ensure a state of inviolability from hostile acts or influences. Topic 2B Analyzing the Three-way Handshake Although a great deal of emphasis is given to IP due to the addressing and masking issues, TCP deserves equal attention from the security professional. In addition to TCP, the other protocol that functions as a transport protocol is UDP. This topic will concentrate on TCP; however, a brief discussion on UDP is warranted. The following table provides a brief comparison of the two protocols. Comparing TCP and UDP TCP Connection-oriented Slower communications Considered reliable Transport Layer UDP Connectionless Faster communications Considered unreliable Transport Layer TCP provides a connection-oriented means of communication, whereas UDP provides connectionless communication. The connection-oriented function of TCP means it can ensure reliable transmission, and can recover if transmission errors occur. The connectionless function of UDP means that packets are sent with the understanding they will make it to the other host, with no means of ensuring the reliability of the transmission. UDP is considered faster because less work is done between the two hosts that are communicating. Host 1 simply sends a packet to the address of host 2. There is nothing built into UDP to provide for host 1 checking to see if host 2 received the packet, or for host 2 sending a message back to host 1, acknowledging receipt. TCP provides the functions of connection-oriented communication by using features such as the three-way handshake, acknowledgements, and sequence numbers. In addition to these features, a significant part of TCP is the use of control flags. There are six TCP control flags in a TCP header, each with a specific meaning. 46 Tactical Perimeter Defense

17 TCP Flags The TCP flags are: SYN, ACK, FIN, RESET, PUSH, and URGENT. These flags may also be identified as S, ack, F, R, P, and urg. Each of these flags occupies the space of one bit in the header, and if they are assigned a value of 1, they are considered on. The function of each flag is identified as follows: The SYN, or S, flag represents the first part of establishing a connection. The synchronizing of communication will generally be in the first packet of communication. The ACK, or ack, flag represents acknowledgement of receipt of data from the sending host. This is sent during the second part of establishing a connection, in response to the sending host s SYN request. The FIN, or F, flag represents the sender s intentions of terminating the communication in what is known as a graceful manner. The RESET, or R, flag represents the sender s intentions to reset the communication. The PUSH, or P, flag is used when the sending host requires data to be pushed directly to the receiving application, and not fill in a buffer. The URGENT, or urg, flag represents that this data should take precedence over other data transmissions. Sequence and Acknowledgement Numbers In addition to the TCP flags, another critical issue of TCP is that of numbers: sequence and acknowledgement numbers, to be specific. Because TCP has been defined as a reliable protocol that has the ability to provide for connectionoriented communication, there must be a mechanism to provide these features. Sequence and acknowledgement numbers are what provide this. Sequence Numbers The sequence number is found in the TCP header of each TCP packet and is a 32-bit value. These numbers allow the two hosts a common ground for communication, and allow for the hosts to identify packets sent and received. If a large web page requires several TCP packets for transmission, sequence numbers are used by the receiving host to reassemble the packets in the proper order and provide the full web page for viewing. When a host sends the request to initiate a new connection, an Initial Sequence Number (ISN) must be chosen. There are different algorithms by different vendors for the choosing of an ISN; however, RFC 793 states that the ISN is to be a 32-bit number that increments by one every 4 microseconds. Acknowledgement Numbers The acknowledgement number is also found in the TCP header of each TCP packet, and is also a 32-bit value. These numbers allow the two hosts to be given a receipt of data delivery. An acknowledgement number is in the packet header in response to a sequence number in the sending packet. In the event that the sending host does not receive an acknowledgement for a transmitted packet in the defined timeframe, the sender will retransmit the packet. This is how TCP provides reliable delivery. If a packet seems to have been lost, the sender will retransmit it. Lesson 2: Advanced TCP/IP 47

18 48 Tactical Perimeter Defense Connections All communication in TCP/IP is done with connections between two hosts. Each connection is opened (or established), data is sent, and the connection is closed (or torn down). These connections have very specific rules they must follow. There are two different states of the open portion of this process: Passive Open and Active Open. Passive Open is when a running application tells TCP that it is ready to receive inbound requests via TCP. The application is assuming inbound requests are coming, and is prepared to serve those requests. This is also known as the listening state, as the application is listening for requests to communicate. Active Open is when a running application tells TCP to start a communication session with a remote host (which is in Passive Open state). It is possible for two hosts in Active Open to begin communication. It is not a requirement that the remote host be in Passive Open, but that is the most common scenario. Connection Establishment In order for the sequence and acknowledgement numbers to have any function, a session between the two hosts must be established. This connection establishment is called the three-way handshake. The three-way handshake involves three distinct steps, which are detailed as follows (please refer to Figure 2-5 when reading this section): 1. Host A sends a segment to Host C with the following: SYN = 1 (The session is being synchronized.) ACK = 0 (There is no value in the ACK field, so this flag is a 0.) Sequence Number = x, where x is a variable. (x is Host A s ISN.) Acknowledgement Number = 0 2. Host C receives Host A s segment and responds to Host A with the following: SYN = 1 (The session is still being synchronized.) ACK = 1 (The acknowledgement flag is now set, as there is an ack value in this segment.) Sequence Number = y, where y is a variable. (y is Host C s ISN.) Acknowledgement Number = x + 1 (The sequence number from Host A, plus 1.) 3. Host A receives Host C s segment and responds to Host C with the following: SYN = 0 (Session is synchronized with this segment; further requests are not needed.) ACK = 1 (The ack flag is set in response to the SYN from the previous segment.) Sequence Number = x + 1 (This is the next sequence number in series.) Acknowledgement Number = y + 1 (The sequence number from Host C, plus 1.) At this point, the hosts are synchronized and the session is established in both directions, with data transfer to follow.

19 Figure 2-5: The three-way handshake. Connection Termination In addition to specific steps that are involved in the establishment of a session between two hosts, there are equally specific steps in the termination of the session. There are two methods of ending a session using TCP. One is considered graceful, and the other is non-graceful. A graceful shutdown happens when one host sends a message (using the FIN flag) to the other, stating it is time to end the session; the other acknowledges; and they both end the session. A non-graceful shutdown happens when one host simply sends a message (using the RESET flag) to the other, indicating the communication has stopped, with no acknowledgements and no further messages sent. In this section, we will investigate the details of the standard graceful termination. As you saw earlier, it requires three segments to establish a TCP session between two hosts. The other side of the session, the graceful termination, requires four segments. Four segments are required because TCP is a full-duplex communication protocol (meaning data can be flowing in both directions independently). As per the specifications of TCP, either end of a communication can end the session by sending a FIN, which has a sequence number just as a SYN has a sequence number. Similar to the Active and Passive Opens mentioned earlier, there are also Active and Passive Closes. The host that begins the termination sequence, by sending the first FIN, is the host performing the Active Close. The host that receives the first FIN is the host that is performing the Passive Close. The graceful teardown of a session is detailed as follows (please refer to Figure 2-6 when reading this section): 1. Host A initiates the session termination to Host C with the following: FIN = 1 (The session is being terminated.) ACK = 1 (There is an ack number, based on current communication.) Sequence Number (FIN number) = s (s is a variable based on the current communication.) Acknowledgement Number = p (p is a variable based on the current communication.) 2. Host C receives Host A s segment and replies with the following: FIN = 0 (This segment is not requesting closure of the session.) ACK = 1 (This segment does contain an ack number.) Sequence Number = Not Present (As there is no FIN, there is no sequence number required.) Lesson 2: Advanced TCP/IP 49

20 Acknowledgement Number = s + 1 (This is the response to Host A s FIN.) 3. Host C initiates the session termination in the opposite direction with the following: FIN = 1 (The session is being terminated.) ACK = 1 (There is an ack number.) Sequence Number = p (p is a variable based on the current communication.) Acknowledgement Number = s + 1 (This is the same as in the previous segment.) 4. Host A receives the segments from Host C and replies with the following: FIN = 0 (This segment does not request a termination, there is no SYN.) ACK = 1 (This segment does contain an ack number.) Sequence Number = Not Present Acknowledgement Number = p + 1 (This is Host C s sequence number, plus 1.) At this point the session has been terminated. Communication in both directions has had a FIN requested and an acknowledgement to the FIN, closing the session. Figure 2-6: Connection termination. Ports You have been introduced to the fact that IP deals with addressing and the sending/receiving of data between two hosts, and you have been introduced to the fact that TCP can be selected to provide reliable delivery of data. However, if a client sends a request to a server that is running many services, such as WWW, NNTP, SMTP, and FTP, how does the server know which application is supposed to receive the request? The answer is by specifying ports. 50 Tactical Perimeter Defense

21 Port numbers are located in the TCP or UDP header, and they are 16-bit values, ranging from 0 to Port numbers can be assigned to specific functions or applications. Ports can also be left open for dynamic use by two hosts during communication. There are ranges of ports for each function. There are three main categories of ports: well-known, registered, and dynamic. The well-known ports (also called reserved ports by some) are those in the range of 0 to These port numbers are assigned to specific applications and need to remain constant for the primary services of the Internet to continue to provide the flexibility and usefulness it does today. For example, the WWW service is port 80, the Telnet service is port 23, the SMTP service is port 25, and so on. The well-known port list is maintained by the Internet Assigned Numbers Authority (IANA), and can be found here: Registered ports are those in the range of 1024 to These port numbers can be registered to a specific function, but are not defined or controlled by a governing body, so multiple functions could end up using the same port. Dynamic ports (also called private ports) are those from to Any user of the Internet can use dynamic ports. When a client connects to a server and requests a resource, that client also requires a port. The client ports (also called ephemeral ports by some) are used by a client during one specific connection; each subsequent connection will use a different port number. These ports are not assigned to any default service, and are usually a number greater than There is no defined range for client ports; they can cover the numbers of both the registered and dynamic port ranges. When a client begins a session by requesting a service from a server, such as the WWW service on port 80, the client uses an ephemeral port on the client side. This enables the server to respond to the client. Data is then exchanged between the two hosts using the port numbers established for that session: 80 on the server side, and a dynamic number greater than 1023 on the client side. The combination of the IP address and port is often referred to as a socket, and the two hosts together are using a socket pair to communicate for this session. The following table lists some of the well-known ports and their associated services. Some Well-known Ports and their Services Port Service 23 Telnet 80 HTTP (Standard web pages) 443 Secure HTTP (Secure web pages) 20 and 21 FTP (Data and control) 53 DNS 25 SMTP 119 NNTP Lesson 2: Advanced TCP/IP 51

22 Trojan Horse: An apparently useful and innocent program containing additional hidden code which allows the unauthorized collection, exploitation, falsification, or destruction of data. In addition to known valid services, such as those listed previously, there are many Trojan Horse programs that use specific ports (although the port can usually be changed). Ports Associated with Trojan Horses Port Number Name of Trojan Horse NetBus 1243 Sub Seven Sub Seven Back Orifice (TCP) Back Orifice 2000 (BO2K) (UDP) Back Orifice 2000 (BO2K) Network Monitor There is a very valuable tool available with Windows called Network Monitor. This tool allows for full packet capture and lets the analyst (you) peer into the packet s contents, examining both the payload, or data, and the headers, in detail. You can see any set flags s defined sequence and acknowledgement numbers, packet size, and more. The following is a discussion on the use of Network Monitor, provided as background for you to be able to perform the tasks in this lesson. Some of the things you can do with Network Monitor are: Monitor real-time network traffic. Analyze network traffic. Filter specific protocols to capture. In this lesson, you will be focusing on the capture and analysis of IP packets, and on the details of the protocol suite. 52 Tactical Perimeter Defense

23 Figure 2-7: The default view of Network Monitor, showing the various panes. In Figure 2-7, you can see the default view of Network Monitor. In this view, the screen is split into several sections. The top bar is the standard menu bar found in Microsoft programs. The basic functions on the toolbar that you will use in this lesson are contained in the File and Capture menus. The File menu contains three commands: Open, Save As, and Exit. Choose Open to open a previously saved Network Monitor capture. Choose Save As to save a Network Monitor capture. Choose Exit to exit. The Capture menu has more commands: Start, Stop, Stop And View, Pause, and Continue. The Start, Pause, and Continue commands are self-explanatory. The difference between Stop and Stop And View is that the Stop command ends the capture. The Stop And View command ends the capture and switches Network Monitor to its next mode, Display View. The other sections of the Capture View are panes (windows in a window) called Graph, Session Stats, Station Stats, and Total Stats. The Graph pane provides five bars that measure percentages of pre-defined metrics. The top graph indicates the percentage (%) of network utilization, meaning how much the network is being used. The second graph indicates the number of frames per second, meaning frames transmitted per second over the network. The third graph indicates the number of bytes per second that are transmitted over the network. Lesson 2: Advanced TCP/IP 53

Networking Test 4 Study Guide

Networking Test 4 Study Guide Networking Test 4 Study Guide True/False Indicate whether the statement is true or false. 1. IPX/SPX is considered the protocol suite of the Internet, and it is the most widely used protocol suite in LANs.

More information

Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP

Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe

More information

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2

More information

TCP/IP Concepts Review. A CEH Perspective

TCP/IP Concepts Review. A CEH Perspective TCP/IP Concepts Review A CEH Perspective 1 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP

More information

TCP/IP Concepts Review. A CEH Perspective

TCP/IP Concepts Review. A CEH Perspective TCP/IP Concepts Review A CEH Perspective 1 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP

More information

9025- TCP/IP Networking. History and Standards. Review of Numbering Systems. Local Signaling. IP Addressing

9025- TCP/IP Networking. History and Standards. Review of Numbering Systems. Local Signaling. IP Addressing 9025- TCP/IP Networking History and Standards ARPA NCP TCP, IP, ARPANET PARC Collaborative Network Requirements One Protocol? Peer-to-Peer Protocols Documentation and RFCs RFC Categories Where to Find

More information

TCP/IP Concepts Review. Ed Crowley

TCP/IP Concepts Review. Ed Crowley TCP/IP Concepts Review Ed Crowley 1 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP addressing

More information

Chapter 7. Local Area Network Communications Protocols

Chapter 7. Local Area Network Communications Protocols Chapter 7 Local Area Network Communications Protocols IP Version 4 The most commonly used network layer protocol is IP, or the Internet Protocol. As its name would indicate, IP is the protocol used on

More information

(Refer Slide Time: 02:17)

(Refer Slide Time: 02:17) Internet Technology Prof. Indranil Sengupta Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture No #06 IP Subnetting and Addressing (Not audible: (00:46)) Now,

More information

Hands-On Ethical Hacking and Network Defense - Second Edition. Chapter 2 - TCP/IP Concepts Review

Hands-On Ethical Hacking and Network Defense - Second Edition. Chapter 2 - TCP/IP Concepts Review Objectives After reading this chapter and completing the exercises, you will be able to: Overview of TCP/IP Describe the TCP/IP protocol stack Explain the basic concepts of IP addressing Explain the binary,

More information

Ethernet. Ethernet. Network Devices

Ethernet. Ethernet. Network Devices Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking

More information

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet

1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet Review questions 1 Data information is sent onto the network cable using which of the following? A Communication protocol B Data packet C Media access method D Packages 2 To which TCP/IP architecture layer

More information

IP Addressing A Simplified Tutorial

IP Addressing A Simplified Tutorial Application Note IP Addressing A Simplified Tutorial July 2002 COMPAS ID 92962 Avaya Labs 1 All information in this document is subject to change without notice. Although the information is believed to

More information

Chapter 6 Network Communications and Protocols

Chapter 6 Network Communications and Protocols Chapter 6 Network Communications and Protocols Objectives Explain the function of protocols in a network Describe common protocol suites Guide to Networking Essentials, Fifth Edition 2 Protocols Strictly

More information

Introduction to Networking S Y STEMS

Introduction to Networking S Y STEMS Introduction to Networking CS 40: INTRODUCTION TO U NIX A ND L I NUX O P E R AT ING S Y STEMS Objectives Introduce networking, including what it is and what it contains, which includes: Networking layers

More information

TCP/IP Tutorial. Transmission Control Protocol Internet Protocol

TCP/IP Tutorial. Transmission Control Protocol Internet Protocol TCP/IP Tutorial Transmission Control Protocol Internet Protocol 1 TCP/IP & OSI In OSI reference model terminology -the TCP/IP protocol suite covers the network and transport layers. TCP/IP can be used

More information

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols

More information

cnds@napier Slide 1 Introduction cnds@napier 1 Lecture 6 (Network Layer)

cnds@napier Slide 1 Introduction cnds@napier 1 Lecture 6 (Network Layer) Slide 1 Introduction In today s and next week s lecture we will cover two of the most important areas in networking and the Internet: IP and TCP. These cover the network and transport layer of the OSI

More information

Network-Oriented Software Development. Course: CSc4360/CSc6360 Instructor: Dr. Beyah Sessions: M-W, 3:00 4:40pm Lecture 2

Network-Oriented Software Development. Course: CSc4360/CSc6360 Instructor: Dr. Beyah Sessions: M-W, 3:00 4:40pm Lecture 2 Network-Oriented Software Development Course: CSc4360/CSc6360 Instructor: Dr. Beyah Sessions: M-W, 3:00 4:40pm Lecture 2 Topics Layering TCP/IP Layering Internet addresses and port numbers Encapsulation

More information

Module 1: Reviewing the Suite of TCP/IP Protocols

Module 1: Reviewing the Suite of TCP/IP Protocols Module 1: Reviewing the Suite of TCP/IP Protocols Contents Overview 1 Lesson: Overview of the OSI Model 2 Lesson: Overview of the TCP/IP Protocol Suite 7 Lesson: Viewing Frames Using Network Monitor 14

More information

CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs

CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs Tasks: 1 (10 min) Verify that TCP/IP is installed on each of the computers 2 (10 min) Connect the computers together via a switch 3 (10 min)

More information

- TCP and UDP - Transport Layer Protocols

- TCP and UDP - Transport Layer Protocols 1 Transport Layer Protocols - TCP and UDP - The Transport layer (OSI Layer-4) does not actually transport data, despite its name. Instead, this layer is responsible for the reliable transfer of data, by

More information

Chapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4)

Chapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4) Chapter 3 TCP/IP Networks 3.1 Internet Protocol version 4 (IPv4) Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely

More information

TCP/IP Basis. OSI Model

TCP/IP Basis. OSI Model TCP/IP Basis 高 雄 大 學 資 訊 工 程 學 系 嚴 力 行 Source OSI Model Destination Application Presentation Session Transport Network Data-Link Physical ENCAPSULATION DATA SEGMENT PACKET FRAME BITS 0101010101010101010

More information

Hands-on Network Traffic Analysis. 2015 Cyber Defense Boot Camp

Hands-on Network Traffic Analysis. 2015 Cyber Defense Boot Camp Hands-on Network Traffic Analysis 2015 Cyber Defense Boot Camp What is this about? Prerequisite: network packet & packet analyzer: (header, data) Enveloped letters inside another envelope Exercises Basic

More information

IP Network Layer. Datagram ID FLAG Fragment Offset. IP Datagrams. IP Addresses. IP Addresses. CSCE 515: Computer Network Programming TCP/IP

IP Network Layer. Datagram ID FLAG Fragment Offset. IP Datagrams. IP Addresses. IP Addresses. CSCE 515: Computer Network Programming TCP/IP CSCE 515: Computer Network Programming TCP/IP IP Network Layer Wenyuan Xu Department of Computer Science and Engineering University of South Carolina IP Datagrams IP is the network layer packet delivery

More information

Lecture Computer Networks

Lecture Computer Networks Prof. Dr. H. P. Großmann mit M. Rabel sowie H. Hutschenreiter und T. Nau Sommersemester 2012 Institut für Organisation und Management von Informationssystemen Thomas Nau, kiz Lecture Computer Networks

More information

TCP/IP Fundamentals. OSI Seven Layer Model & Seminar Outline

TCP/IP Fundamentals. OSI Seven Layer Model & Seminar Outline OSI Seven Layer Model & Seminar Outline TCP/IP Fundamentals This seminar will present TCP/IP communications starting from Layer 2 up to Layer 4 (TCP/IP applications cover Layers 5-7) IP Addresses Data

More information

Basic Networking Concepts. 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet

Basic Networking Concepts. 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet Basic Networking Concepts 1. Introduction 2. Protocols 3. Protocol Layers 4. Network Interconnection/Internet 1 1. Introduction -A network can be defined as a group of computers and other devices connected

More information

8.2 The Internet Protocol

8.2 The Internet Protocol TCP/IP Protocol Suite HTTP SMTP DNS RTP Distributed applications Reliable stream service TCP UDP User datagram service Best-effort connectionless packet transfer Network Interface 1 IP Network Interface

More information

Technical Support Information Belkin internal use only

Technical Support Information Belkin internal use only The fundamentals of TCP/IP networking TCP/IP (Transmission Control Protocol / Internet Protocols) is a set of networking protocols that is used for communication on the Internet and on many other networks.

More information

CCNA Tutorial Series SUBNETTING

CCNA Tutorial Series SUBNETTING CCNA Tutorial Series This document contains the Course Map For The Interactive flash tutorial at: http://www.semsim.com/ccna/tutorial/subnetting/subnetting.html HOME PAGE Course Objectives Pre-test By

More information

Module 11: TCP/IP Transport and Application Layers

Module 11: TCP/IP Transport and Application Layers Module 11: TCP/IP Transport and Application Layers 11.1 TCP/IP Transport Layer 11.1.1 Introduction to the TCP/IP transport layer The primary duties of the transport layer are to transport and regulate

More information

Overview of TCP/IP. TCP/IP and Internet

Overview of TCP/IP. TCP/IP and Internet Overview of TCP/IP System Administrators and network administrators Why networking - communication Why TCP/IP Provides interoperable communications between all types of hardware and all kinds of operating

More information

IP Subnetting and Addressing

IP Subnetting and Addressing Indian Institute of Technology Kharagpur IP Subnetting and Addressing Prof Indranil Sengupta Computer Science and Engineering Indian Institute of Technology Kharagpur Lecture 6: IP Subnetting and Addressing

More information

Lecture 15. IP address space managed by Internet Assigned Numbers Authority (IANA)

Lecture 15. IP address space managed by Internet Assigned Numbers Authority (IANA) Lecture 15 IP Address Each host and router on the Internet has an IP address, which consist of a combination of network number and host number. The combination is unique; no two machines have the same

More information

This unit contains the following two lessons: Lessons Pages Length Lesson 3-1: Network Layer Addressing 98-136 5 hours

This unit contains the following two lessons: Lessons Pages Length Lesson 3-1: Network Layer Addressing 98-136 5 hours Unit 3 Let s Route Overview Description This unit contains two lessons: The first lesson introduces the format for addressing data that travels across the Internet. The lesson focuses on the underlying

More information

The OSI model has seven layers. The principles that were applied to arrive at the seven layers can be briefly summarized as follows:

The OSI model has seven layers. The principles that were applied to arrive at the seven layers can be briefly summarized as follows: 1.4 Reference Models Now that we have discussed layered networks in the abstract, it is time to look at some examples. In the next two sections we will discuss two important network architectures, the

More information

Module 1. IP/MAC Addresses and TCP/IP Suite

Module 1. IP/MAC Addresses and TCP/IP Suite Module 1 IP/MAC Addresses and TCP/IP Suite Dr. Associate Professor of Computer Science Jackson State University E-mail: natarajan.meghanathan@jsums.edu Module 1 Topics 1.1 MAC Address 1.2 Class-based IP

More information

Introduction to Network Security Lab 1 - Wireshark

Introduction to Network Security Lab 1 - Wireshark Introduction to Network Security Lab 1 - Wireshark Bridges To Computing 1 Introduction: In our last lecture we discussed the Internet the World Wide Web and the Protocols that are used to facilitate communication

More information

Autumn Oct 21, Oct 21, 2004 CS573: Network Protocols and Standards 1 Oct 21, 2004 CS573: Network Protocols and Standards 2

Autumn Oct 21, Oct 21, 2004 CS573: Network Protocols and Standards 1 Oct 21, 2004 CS573: Network Protocols and Standards 2 IPv4 IP: Addressing, ARP, Routing Protocols and Standards Autumn 2004-2005 IP Datagram Format IPv4 Addressing ARP and RARP IP Routing Basics Subnetting and Supernetting ICMP Address Translation (NAT) Dynamic

More information

IP Basics Unix/IP Preparation Course July 19, 2009 Eugene, Oregon, USA

IP Basics Unix/IP Preparation Course July 19, 2009 Eugene, Oregon, USA IP Basics Unix/IP Preparation Course July 19, 2009 Eugene, Oregon, USA hervey@nsrc.org Layers Complex problems can be solved using the common divide and conquer principle. In this case the internals of

More information

Guideline for setting up a functional VPN

Guideline for setting up a functional VPN Guideline for setting up a functional VPN Why do I want a VPN? VPN by definition creates a private, trusted network across an untrusted medium. It allows you to connect offices and people from around the

More information

Module 2: Assigning IP Addresses in a Multiple Subnet Network

Module 2: Assigning IP Addresses in a Multiple Subnet Network Module 2: Assigning IP Addresses in a Multiple Subnet Network Contents Overview 1 Lesson: Assigning IP Addresses 2 Lesson: Creating a Subnet 19 Lesson: Using IP Routing Tables 29 Lesson: Overcoming Limitations

More information

How do I get to www.randomsite.com?

How do I get to www.randomsite.com? Networking Primer* *caveat: this is just a brief and incomplete introduction to networking to help students without a networking background learn Network Security. How do I get to www.randomsite.com? Local

More information

Introduction to IP v6

Introduction to IP v6 IP v 1-3: defined and replaced Introduction to IP v6 IP v4 - current version; 20 years old IP v5 - streams protocol IP v6 - replacement for IP v4 During developments it was called IPng - Next Generation

More information

TCP/IP Network Essentials. Linux System Administration and IP Services

TCP/IP Network Essentials. Linux System Administration and IP Services TCP/IP Network Essentials Linux System Administration and IP Services Layers Complex problems can be solved using the common divide and conquer principle. In this case the internals of the Internet are

More information

Module 6. Internetworking. Version 2 CSE IIT, Kharagpur

Module 6. Internetworking. Version 2 CSE IIT, Kharagpur Module 6 Internetworking Lesson 2 Internet Protocol (IP) Specific Instructional Objectives At the end of this lesson, the students will be able to: Explain the relationship between TCP/IP and OSI model

More information

Objectives. Explain the different classes of IP addresses Configure IP addresses Subdivide an IP network

Objectives. Explain the different classes of IP addresses Configure IP addresses Subdivide an IP network IP Addressing Objectives Explain the different classes of IP addresses Configure IP addresses Subdivide an IP network CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 2 Objectives (continued)

More information

PART IV. Network Layer

PART IV. Network Layer PART IV Network Layer Position of network layer Network layer duties Internetworking : heterogeneous Physical Networks To look Like a single network to he upper layers The address at Network layer must

More information

Unit 4. Introduction to TCP/IP. Overview. Description. Unit Table of Contents

Unit 4. Introduction to TCP/IP. Overview. Description. Unit Table of Contents Unit 4 Introduction to TCP/IP Overview Description This unit contains one lesson: This lesson will introduce protocols in general. You will look at how a protocol functions, the differences between a routable

More information

IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31

IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31 IP address format: 7 24 Class A 0 Network ID Host ID 14 16 Class B 1 0 Network ID Host ID 21 8 Class C 1 1 0 Network ID Host ID 28 Class D 1 1 1 0 Multicast Address Dotted decimal notation: 10000000 00001011

More information

Lab 3-1 assignment check list **Please post your answers on the bulletin board. **

Lab 3-1 assignment check list **Please post your answers on the bulletin board. ** Lab 3-1 assignment check list **Please post your answers on the bulletin board. ** Lab 3.1 o Questions 3.1.1 Lab 3.2 o Questions 3.2.1 Lab 3.3 o Questions 3.3.1 o Questions 3.3.2 o Questions 3.3.3 Lab

More information

Transport Layer. Chapter 3.4. Think about

Transport Layer. Chapter 3.4. Think about Chapter 3.4 La 4 Transport La 1 Think about 2 How do MAC addresses differ from that of the network la? What is flat and what is hierarchical addressing? Who defines the IP Address of a device? What is

More information

Transport Layer Protocols

Transport Layer Protocols Transport Layer Protocols Version. Transport layer performs two main tasks for the application layer by using the network layer. It provides end to end communication between two applications, and implements

More information

Tutorial Questions EG/ES The tutorial questions illustrate the style of examination questions for EG/ES 3567.

Tutorial Questions EG/ES The tutorial questions illustrate the style of examination questions for EG/ES 3567. The tutorial questions illustrate the style of examination questions for EG/ES 3567. The paper will be of 3 hours duration, and each student should attempt four questions during this time. You should aim

More information

Lab 10.4.1 IP Addressing Overview

Lab 10.4.1 IP Addressing Overview Lab 10.4.1 IP ing Overview Estimated time: 30 min. Objectives: Background: This lab will focus on your ability to accomplish the following tasks: Name the five different classes of IP addresses Describe

More information

2. IP Networks, IP Hosts and IP Ports

2. IP Networks, IP Hosts and IP Ports 1. Introduction to IP... 1 2. IP Networks, IP Hosts and IP Ports... 1 3. IP Packet Structure... 2 4. IP Address Structure... 2 Network Portion... 2 Host Portion... 3 Global vs. Private IP Addresses...3

More information

Understanding Layer 2, 3, and 4 Protocols

Understanding Layer 2, 3, and 4 Protocols 2 Understanding Layer 2, 3, and 4 Protocols While many of the concepts well known to traditional Layer 2 and Layer 3 networking still hold true in content switching applications, the area introduces new

More information

Networking Basics for Automation Engineers

Networking Basics for Automation Engineers Networking Basics for Automation Engineers Page 1 of 10 mac-solutions.co.uk v1.0 Oct 2014 1. What is Transmission Control Protocol/Internet Protocol (TCP/IP)------------------------------------------------------------

More information

Chapter 2 NETWORK LAYER

Chapter 2 NETWORK LAYER Chapter 2 NETWORK LAYER This chapter provides an overview of the most important and common protocols associated with the TCP/IP network layer. These include: Internet Protocol (IP), Routing protocols Routing

More information

Transport and Network Layer

Transport and Network Layer Transport and Network Layer 1 Introduction Responsible for moving messages from end-to-end in a network Closely tied together TCP/IP: most commonly used protocol o Used in Internet o Compatible with a

More information

Internetworking and IP Address

Internetworking and IP Address Lecture 8 Internetworking and IP Address Motivation of Internetworking Internet Architecture and Router Internet TCP/IP Reference Model and Protocols IP Addresses - Binary and Dotted Decimal IP Address

More information

PART OF THE PICTURE: The TCP/IP Communications Architecture

PART OF THE PICTURE: The TCP/IP Communications Architecture PART OF THE PICTURE: The / Communications Architecture 1 PART OF THE PICTURE: The / Communications Architecture BY WILLIAM STALLINGS The key to the success of distributed applications is that all the terminals

More information

Chapter 3: Review of Important Networking Concepts. Magda El Zarki Dept. of CS UC Irvine elzarki@uci.edu http://www.ics.uci.

Chapter 3: Review of Important Networking Concepts. Magda El Zarki Dept. of CS UC Irvine elzarki@uci.edu http://www.ics.uci. Chapter 3: Review of Important Networking Concepts Magda El Zarki Dept. of CS UC Irvine elzarki@uci.edu http://www.ics.uci.edu/~magda 1 Networking Concepts Protocol Architecture Protocol Layers Encapsulation

More information

Understanding the TCP/IP Internet Layer

Understanding the TCP/IP Internet Layer Lesson 4 Understanding the TCP/IP Internet Layer Overview Objectives There are various aspects to IP addressing, including calculations for constructing an IP address, classes of IP addresses designated

More information

Understand the OSI Model

Understand the OSI Model Understand the OSI Model Part 2 Lesson Overview In this lesson, you will learn information about: Frames Packets Segments TCP TCP/IP Model Well-known ports for most-used purposes Anticipatory Set Review

More information

2057-15. First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring

2057-15. First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring 2057-15 First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring 7-25 September 2009 TCP/IP Networking Abhaya S. Induruwa Department

More information

Expert Reference Series of White Papers. Basics of IP Address Subnetting

Expert Reference Series of White Papers. Basics of IP Address Subnetting Expert Reference Series of White Papers Basics of IP Address Subnetting 1-800-COURSES www.globalknowledge.com Basics of IP Address Subnetting Norbert Gregorio, Global Knowledge Instructor Introduction

More information

Protocols and Architecture. Protocol Architecture.

Protocols and Architecture. Protocol Architecture. Protocols and Architecture Protocol Architecture. Layered structure of hardware and software to support exchange of data between systems/distributed applications Set of rules for transmission of data between

More information

The OSI and TCP/IP Models. Lesson 2

The OSI and TCP/IP Models. Lesson 2 The OSI and TCP/IP Models Lesson 2 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Introduction to the OSI Model Compare the layers of the OSI and TCP/IP

More information

TCP/IP and the Internet

TCP/IP and the Internet TCP/IP and the Internet Computer networking today is becoming more and more entwined with the internet. By far the most popular protocol set in use is TCP/IP (Transmission Control Protocol/Internet Protocol).

More information

CE363 Data Communications & Networking. Chapter 6 Network Layer: Logical Addressing

CE363 Data Communications & Networking. Chapter 6 Network Layer: Logical Addressing CE363 Data Communications & Networking Chapter 6 Network Layer: Logical Addressing TCP/IP and OSI model APPLICATION APPLICATION PRESENTATION SESSION TRANSPORT NETWORK Host-Network TRANSPORT NETWORK DATA

More information

Computer Networks. Introduc)on to Naming, Addressing, and Rou)ng. Week 09. College of Information Science and Engineering Ritsumeikan University

Computer Networks. Introduc)on to Naming, Addressing, and Rou)ng. Week 09. College of Information Science and Engineering Ritsumeikan University Computer Networks Introduc)on to Naming, Addressing, and Rou)ng Week 09 College of Information Science and Engineering Ritsumeikan University MAC Addresses l MAC address is intended to be a unique identifier

More information

One of the most important topics in any discussion of TCP/IP is IP. IP Addressing

One of the most important topics in any discussion of TCP/IP is IP. IP Addressing IP Addressing 125 machine, called a RARP server, responds with the answer, and the identity crisis is over. RARP uses the information it does know about the machine s MAC address to learn its IP address

More information

Lab 10.3.5a Basic Subnetting

Lab 10.3.5a Basic Subnetting Lab 10.3.5a Basic Subnetting Objective How to identify reasons to use a subnet mask How to distinguish between a default subnet mask and a custom subnet mask What given requirements determine the subnet

More information

William Stallings Data and Computer Communications. Chapter 15 Internetwork Protocols

William Stallings Data and Computer Communications. Chapter 15 Internetwork Protocols William Stallings Data and Computer Communications Chapter 15 Internetwork Protocols Internetworking Terms (1) Communications Network Facility that provides data transfer service An internet Collection

More information

GlobalSCAPE DMZ Gateway, v1. User Guide

GlobalSCAPE DMZ Gateway, v1. User Guide GlobalSCAPE DMZ Gateway, v1 User Guide GlobalSCAPE, Inc. (GSB) Address: 4500 Lockhill-Selma Road, Suite 150 San Antonio, TX (USA) 78249 Sales: (210) 308-8267 Sales (Toll Free): (800) 290-5054 Technical

More information

The Subnet Training Guide

The Subnet Training Guide The Subnet Training Guide A Step By Step Guide on Understanding and Solving Subnetting Problems by Brendan Choi v25 easysubnetcom The Subnet Training Guide v25 easysubnetcom Chapter 1 Understanding IP

More information

GeorgeAlmeida.com. Learn IP Subnetting in 15 minutes

GeorgeAlmeida.com. Learn IP Subnetting in 15 minutes GeorgeAlmeida.com Learn IP Subnetting in 15 minutes George Almeida 3-8-2015 Contents Preface... 2 Terms and Definitions... 3 Introduction... 3 Obtaining an IP Address for the Internet... 4 Verifying TCP/IP

More information

Understanding TCP/IP. Introduction. What is an Architectural Model? APPENDIX

Understanding TCP/IP. Introduction. What is an Architectural Model? APPENDIX APPENDIX A Introduction Understanding TCP/IP To fully understand the architecture of Cisco Centri Firewall, you need to understand the TCP/IP architecture on which the Internet is based. This appendix

More information

Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets)

Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets) Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets) The diagram below illustrates four routers on the Internet backbone along with two companies that have gateways for their internal

More information

The OSI Model and the TCP/IP Protocol Suite. Pritee Parwekar ANITS 1

The OSI Model and the TCP/IP Protocol Suite. Pritee Parwekar ANITS 1 The OSI Model and the TCP/IP Protocol Suite Pritee Parwekar ANITS 1 To study To discuss the idea of multiple layering in data communication and networking and the interrelationship between layers. To discuss

More information

IP Addressing and Subnetting. 2002, Cisco Systems, Inc. All rights reserved.

IP Addressing and Subnetting. 2002, Cisco Systems, Inc. All rights reserved. IP Addressing and Subnetting 2002, Cisco Systems, Inc. All rights reserved. 1 Objectives Upon completion, you will be able to: Discuss the Types of Network Addressing Explain the Form of an IP Address

More information

- IPv4 Addressing and Subnetting -

- IPv4 Addressing and Subnetting - 1 Hardware Addressing - IPv4 Addressing and Subnetting - A hardware address is used to uniquely identify a host within a local network. Hardware addressing is a function of the Data-Link layer of the OSI

More information

UPPER LAYER SWITCHING

UPPER LAYER SWITCHING 52-20-40 DATA COMMUNICATIONS MANAGEMENT UPPER LAYER SWITCHING Gilbert Held INSIDE Upper Layer Operations; Address Translation; Layer 3 Switching; Layer 4 Switching OVERVIEW The first series of LAN switches

More information

Internet Protocols. Background CHAPTER

Internet Protocols. Background CHAPTER CHAPTER 3 Internet Protocols Background The Internet protocols are the world s most popular open-system (nonproprietary) protocol suite because they can be used to communicate across any set of interconnected

More information

Chapter 12 Supporting Network Address Translation (NAT)

Chapter 12 Supporting Network Address Translation (NAT) [Previous] [Next] Chapter 12 Supporting Network Address Translation (NAT) About This Chapter Network address translation (NAT) is a protocol that allows a network with private addresses to access information

More information

Raritan Valley Community College Academic Course Outline. CISY 253 - Advanced Computer Networking

Raritan Valley Community College Academic Course Outline. CISY 253 - Advanced Computer Networking Raritan Valley Community College Academic Course Outline CISY 253 - Advanced Computer Networking I. Basic Course Information A. Course number and Title: CISY 253- Advanced Computer Networking (TCP/IP)

More information

3 IP Addressing. Version 2.1 T.O.P. BusinessInteractive GmbH Page 1 of 25

3 IP Addressing. Version 2.1 T.O.P. BusinessInteractive GmbH Page 1 of 25 3 IP Addressing Version 2.1 T.O.P. BusinessInteractive GmbH Page 1 of 25 3 IP Addressing...1 3.1 The IP Address (1/4)...3 3.1 The IP Address (2/4)...3 3.1 The IP Address (3/4)...5 3.1 The IP Address (4/4)...6

More information

Computer Networks. Chapter 5 Transport Protocols

Computer Networks. Chapter 5 Transport Protocols Computer Networks Chapter 5 Transport Protocols Transport Protocol Provides end-to-end transport Hides the network details Transport protocol or service (TS) offers: Different types of services QoS Data

More information

Note! The problem set consists of two parts: Part I: The problem specifications pages Part II: The answer pages

Note! The problem set consists of two parts: Part I: The problem specifications pages Part II: The answer pages Part I: The problem specifications NTNU The Norwegian University of Science and Technology Department of Telematics Note! The problem set consists of two parts: Part I: The problem specifications pages

More information

Computer Networks/DV2 Lab

Computer Networks/DV2 Lab Computer Networks/DV2 Lab Room: BB 219 Additional Information: http://www.fb9dv.uni-duisburg.de/ti/en/education/teaching/ss08/netlab Equipment for each group: - 1 Server computer (OS: Windows 2000 Advanced

More information

Ethernet and IP A slightly less introductory networking class. Drew Saunders Networking Systems Stanford University

Ethernet and IP A slightly less introductory networking class. Drew Saunders Networking Systems Stanford University Ethernet and IP A slightly less introductory networking class Drew Saunders Networking Systems Stanford University Goals of Class Slightly more in-depth knowledge of Ethernet. Internet Protocol, TCP, UDP,

More information

TCP and UDP. Raj Jain. Professor of CIS The Ohio State University Columbus, OH

TCP and UDP. Raj Jain. Professor of CIS The Ohio State University Columbus, OH TCP and UDP Professor of CIS Columbus, OH 43210 Jain@ACM.Org http://www.cis.ohio-state.edu/~jain/ 12-1 Overview Key features Header format Mechanisms Implementation choices Slow start congestion avoidance

More information

Computer Networks. Lecture 3: IP Protocol. Marcin Bieńkowski. Institute of Computer Science University of Wrocław

Computer Networks. Lecture 3: IP Protocol. Marcin Bieńkowski. Institute of Computer Science University of Wrocław Computer Networks Lecture 3: IP Protocol Marcin Bieńkowski Institute of Computer Science University of Wrocław Computer networks (II UWr) Lecture 3 1 / 24 In previous lectures We learned about layer 1

More information

Network layer: Overview. Network layer functions IP Routing and forwarding

Network layer: Overview. Network layer functions IP Routing and forwarding Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application

More information

OSI Data Link & Network Layer

OSI Data Link & Network Layer OSI Data Link & Network Layer Erkki Kukk 1 Layers with TCP/IP and OSI Model Compare OSI and TCP/IP model 2 Layers with TCP/IP and OSI Model Explain protocol data units (PDU) and encapsulation 3 Addressing

More information

Networking Security IP packet security

Networking Security IP packet security Networking Security IP packet security Networking Security IP packet security Copyright International Business Machines Corporation 1998,2000. All rights reserved. US Government Users Restricted Rights

More information

hp ProLiant network adapter teaming

hp ProLiant network adapter teaming hp networking june 2003 hp ProLiant network adapter teaming technical white paper table of contents introduction 2 executive summary 2 overview of network addressing 2 layer 2 vs. layer 3 addressing 2

More information