How do I get to

Transcription

1 Networking Primer* *caveat: this is just a brief and incomplete introduction to networking to help students without a networking background learn Network Security.

2 How do I get to Local Network Internet Destination Network

3 Layer Introduction TCP/IP Stack Application (HTTP,SMTP) Transport (TCP/UDP) Network (IP, ARP, ICMP) Data Link (Ethernet, ) Physical (wired, wireless) Application - communicate high level application information (Web, , etc) Transport - Enable communication of one process to another process across network Network host-to-host protocol, enables communication from one device to another Data Link/Physical enable communication over some transmission medium

4 Data Encapsulation Same if TCP used instead of UDP Source: Internet Protocol Suite, Wikimedia Foundation, Inc.

5 Communicating over layers Source: Internet Protocol Suite, Wikimedia Foundation, Inc.

6 TCP/IP Address TCP/IP Stack Application (HTTP,SMTP) OS Process Number Transport (TCP/UDP) Port Number [0 (2^16)-1] Network (IP, ARP, ICMP) IP Address [ ] Data Link (Ethernet, ) Physical (wired, wireless) Physical (MAC) Address (e.g., Ethernet [00:00:00:00:00:00 ff:ff:ff:ff:ff:ff])

7 Wireshark Examples Wireshark Obtain from Don t use on networks you don t own (such as WSU campus networks) as this may violate IT security/privacy policies!!!

8 Overview of Layers/Protocols

9 Data Link/Physical Layer

10 Data Link/Physical Layer Enables delivery of packets from one system to another within a network Covers How do we convert the data into the 0 s and 1 s on the physical media (encoding, framing) Physical transmission medium (e.g., wired, wireless) Addressing of systems How access to physical transmission medium is manage Example: Ethernet, Wifi (802.11)

11 Ethernet is standard for wired Ethernet Physical connection is copper or fiber optic cable Physically connects to an Ethernet switch How packets are formatted How to schedule access to shared bus Logically bus topology Machine only reads packet if it has the packet s destination address Theoretically

12 Topology Packet 1. Ethernet Hub 1. Ethernet Switch Source Source Destination Destination Layer 2 - Hub Layer 2 - Switch

13 Ethernet Header Source: Ethernet Frame, Wikimedia Foundation, Inc. Ethernet Address Called media access control (MAC) Address 6 bytes, example: 01:23:45:67:89:0a Key fields Destination Address Source Address Every Ethernet card has unique MAC address EtherType what is the network packet type IPv4, IPv6, ARP, etc..

14 Network Layer

15 Network Layer Protocols IP ICMP ARP

16 Internet Protocol (IP) Transport packets across routed network/internet Packets called datagrams Systems on Internet have unique IP address Enables Routing!!! Unreliable Performs best effort deliver Leaves reliability to higher level packets Data Fragments IP datagram can be large (2^16 bytes) May need to go into smaller link-layer protocols (Ethernet) Has to broken up or fragmented, before transmission and then reassembled when received

17 IPv4 vs IPv6 IPv4 Old (from ) Problems No built in security Small address space (2^32 or ~4 billion addresses) IPv6 Larger address space 2^128 Other improvements Slow adoption

18 IP Header Key fields Source Address Destination Address Protocol what higher level protocol is used (TCP, UDP) Total Length Header Checksum - verify integrity of header (not payload) Fragment Offset - Source: RFC 791 Internet Protocol

19 IP Addresses IP Address: 32 bit address, range [ ] Example: Example in binary: Address has two parts: Network Address First x bits of address Identifies the network of the host Host Address: Last (32-x) bits of address Identifies the host on the network Netmask determines what is Network Address and Host Address netmask is just a number the length of the Network Address

20 Net Mask Example Example: IP: In binary: Netmask : Network Addr: Host Addr: Netmask : 24 Network Addr: Host Addr:.35

21 Routing Systems use Network Address to know where to send packets If Destination Address!= Current Network Addr. Send to router Else Delver to host on local network Systems/routers have route table which contains either: Known Network Addresses and direction Default route path for everything

22 Local Network Routing Example Internet Destination Network

23 IP Addresses continued Other weirdness Private (non-routable) addresses For use on private/internal networks 10.X.X.X, X.X, X.X X.X Localhost ( ) So system can communicate with self

24 Address Resolution Protocol (ARP) Problem: Know we need to send message to IP: But don t know what MAC address to send to ARP Asks Who has IP address: ??? Machine with IP , should respond MAC address 00:11:22:33:44:55, for Then can craft packet with correct MAC address Also does reverse (called RARP)

25 ICMP Protocol to support network diagnosis Defines numerous error messages to support IP communications Destination host unreachable Packet reassembly failed Checksum incorrect Ping (or ICMP Echo Request) Receiver sends acknowledgement

26 Transport Layer

27 Transport Layer Protocols TCP UDP Introduces client and server Server always running, waits for connection Client initiates connection

28 User Datagram Protocol (UDP) Transport layer protocol Disadvantages Connectionless, unreliable Advantages Simple No overhead (e.g. connection setup) Common Uses DNS, NTP Streaming media

29 UDP Header Fields Source port ( ) Dest. port ( ) Length - # total bytes Checksum 16 bits Source: RFC 768 User Datagram Protocol,

30 Transmission Control Protocol (TCP) Reliable delivery of packets Used to carry HTTP (web), SMTP ( ), etc. Reliability though the development of a connection Detects and retransmits lost packets

31 TCP Header Key Fields Seq. number Ack. number Flags Syn Ack Fin Rst Source: RFC 793 Transmission Control Protocol.

32 Connection (simplified) syn syn-ack ack ack ack Handshake Established fin ack fin ack Tear Down

33 Connection Reliability Sender/receiver use sequence number and acknowledgement number to keep track of all data sent and received Sequence number: represents number of bytes sent Incremented as data is sent Acknowledgement number: represents the next byte expected by receiver Incremented as data is received If sender notices acknowledgement number not incremented, knows to resend that packet

34 Flow/Congestion Control Flow Control Receiver sets receive window to be how much data it is willing to buffer Prevents sender from overwhelming receiver by sending too much data Congestion Control Algorithms that attempt to minimize data lost

35 Application Layer

36 Applications Examples DNS - HTTP SMTP

37 Domain Name System (DNS) Problem Want to go to but don t know the IP address Solution DNS queries Name Servers to get correct IP address

38 MORE DNS Terminology Name server Domain hierarchy Zone Resource record Record types NS, A, MX, CNAME

39 Root Server has zone of entire tree dns Generally delegates authority to other servers 13 across world (still?) Primary Server stores information about a zone Maintain zone files Secondary Server - Remove?

40 DNS Hierarchy net com gov edu org jp cn de google wsu www mail eecs www mail

41 Resolution Types Recursive initial resolver responsible for finding correct response Iterative - client chases down own DNS response by querying additional servers

42 How do find randomsite s IP? Local Network Internet Destination Network

43 DNS Resolution Example Local Network 6 1 Local Name Server 2 3 Internet Root Name Server 5 4 RandomSite Network RandomSite Name Server

44 Record Types A IP address AAAA IPv6 address NS Name server MX Mail server CNAME canonical name (alias/nickname)

45 Example