BASIC ANALYSIS OF TCP/IP NETWORKS

Transcription

1 BASIC ANALYSIS OF TCP/IP NETWORKS INTRODUCTION Communication analysis provides powerful tool for maintenance, performance monitoring, attack detection, and problems fixing in computer networks. Today networks are mostly based on TCP/IP family of protocols, which is supported by a wide number of devices including home appliances and mobile devices. Network analysis can be performed using simple utilities included in operating systems ( nslookup, ping, tracert etc.) or special instruments like packet sniffer (e.g. Wireshark). Using these instruments network administrator is able to identify a problem, its location and fix it. Network analysis can also be misused for illegal activities (e.g. illegal access to network resources) and, of course, for defence against such attacks. Packet sniffers use so called promiscuous mode of the NIC (Network Interface Card). In this mode the NIC is receiving all frames including those with different than local MAC addresses. Communication channel interception is another requirement for the packet sniffer application. This is quite easy when the network infrastructure is based on hubs, but for switching infrastructure, where the frame is forwarded only to its destination, it has to be managed explicitly. The most often used method is port mirroring (the switch mirrors all frames forwarded to selected port also to the mirror port), which is used in this lab. Other methods include physical channel branching (can be detected), physical layer interception (e.g. for optical fibre channels), destruction of internal switching table or direct sniffer installation on a network node (not always possible). Similar approaches can be used for both wired and wireless technologies (wireless are usually better secured). ANALYSED NETWORK You will perform basic analysis of simple network with scheme depicted on following picture. There are just two devices within network. 1

2 Default gateway operating as network access point. It s a router with one interface dedicated for accessing the outside network (denoted as WAN interface). Other router s interfaces are operating as a switch for local network (denoted as LAN interfaces). Additionally, all communication from the LAN and WAN interfaces is mirrored to a single LAN interface, denoted as mirror interface. All LAN interfaces of the gateway share a single static IP address. Monitored PC connected to one of the LAN interfaces of network gateway. This device is source of all analysed communication. The IP address of monitored PC is acquired from the DHCP server within default gateway. Additionally, sniffer PC is connected to the mirror interface of default gateway. However, it s not a part of the analysed network, because it has no assigned IP address. WIRESHARK The content of Wireshark s window upon program launch is depicted on following picture. In order to start the frames capture, select the Ethernet adapter from the list of available network interfaces (1). Afterwards, start the capture by clicking on capture control button in top-left part of main window (2). The content of Wireshark s window upon capture start is depicted on following picture. The window is divided into following four parts. 2

3 The filter panel is located under the Wireshark s toolbar and contains set of predefined filters. The captured frames list is located under the filter panel and displays basic information about each captured frame. User can display detailed information about particular frame in the detailed view (2), as well as frame raw data in the lower part of main window (3) by clicking on it. The detailed view contains various information about selected frame structure, headers and data payload. It s also possible (and desirable) to save captured data for later analysis. PROTOCOL ANALYSIS During this lab, you will perform a basic analysis of some elementary, usually application protocols of TCP/IP family and get yourself familiar with their purpose and basic principles. To analyse each protocol, capture a network traffic by Wireshark with use of properly selected predefined filter. Additionally, there is a lecture about TCP/IP protocols located on the desktop of the sniffer PC (file TCPIP_prednaska.pdf ), which you can use for finding necessary information about analysed protocol. Execute following steps in order to start the analysis. Open the command line on the monitored PC. Release current network configuration of monitored PC by command ipconfig release and disconnect monitored PC from network. Launch Wireshark on the sniffer PC and start the frames capture. Connect the monitored PC into network and wait until it s IP address is assigned. DYNAMIC HOST CONFIGURATION PROTOCOL The DHCP is a protocol of application layer of the OSI model and the TCP/IP stack designated for dynamic configuration of new network hosts. Usually configured parameters are e.g. host IP address, subnet mask, gateway IP address and DNS server IP addresses, however, there are many more configurable parameters. More information about DHCP can be found in the lecture. On the sniffer PC, capture network traffic using Wireshark with predefined filter DHCP, analyse process of dynamic configuration of the monitored PC and note following information. o The IP address assignment procedure. o Source and destination L2 and L3 addresses of frames / packets with DHCP datagrams. o The IP address lease time. o The monitored PC hostname. o The leased IP address. o The subnet mask. o The default gateway IP address. o The DHCP server IP address. On the monitored PC, use command ipconfig all and verify, if all found information are correct. ADRESS RESOLUTION PROTOCOL The ARP is designated for address translation. Its primary purpose is to allow translation from known L3 (IP) address to a L2 (MAC) address, but there is also reverse variant of this protocol. Because ARP operates as an interconnection between two layers, it s hard to classify it as a protocol of one particular layer. Therefore, it s often denoted as a protocol between link and network layers of OSI model and TCP/IP stack. More information about ARP can be found in the lecture. 3

4 In order to prevent unnecessary network load due to address translation request before each IP packet transmission, operating systems usually cache mappings between L3 and L2 addresses into ARP cache. A record is held in a ARP cache usually few minutes, until it s removed from the cache. On the sniffer PC, capture network traffic using Wireshark with predefined filter ARP, analyse process of resolution of MAC address of default gateway and note following information. o The default gateway IP address resolution procedure. o Source and destination L2 addresses of ARP frames. o Payload of ARP frames. On the monitored PC, use command arp a in order to display content of ARP cache. o Analyse content of ARP cache and verify that it contains MAC address of default gateway. INTERNET CONTROL MESSAGE PROTOCOL The ICMP serves as diagnostic and control protocol of IP layer of TCP/IP stack. Examples of well-known diagnostic messages used by ICMP are Echo Request and Echo Reply messages used e.g. by ping and tracert commands. Example of control message is e.g. Destination Unreachable message, which is sent by intermediary L3 device (i.e. router) upon detection of unreachability of packet s destination, e.g. when route to destination is unknown or when routing is not possible due to traffic filtration. As ICMP helps to ensure transfer of information between communication endpoints, it can be classified as a protocol of the network layer of OSI model and TCP/IP stack. More information about this protocol can be found in the lecture. On the monitored PC use command ping On the sniffer PC, capture network traffic using Wireshark with predefined filter ICMP and analyse captured ICMP messages. o Note the payload of Echo Request and Echo Reply messages. The Echo Request and Echo Reply messages can be used to determine exact number of intermediary L3 device between two endpoint hosts by periodic sending of the Echo Reply message with increasing value of Time-To- Live field of the message s IP header. This is exactly what tracert command does. On the monitored PC, use command tracert and determine number of routers between monitored PC and arbitrary server. DOMAIN NAME SYSTEM The DNS is a protocol of application layer of OSI model and TCP/IP stack designated for translation of domain names (i.e. hostnames that can be easily read by humans) of hosts into their L3 addresses. The DNS protocol uses system of hierarchically structured domain servers containing information about L3 addresses of hosts and domain servers in particular domain. More information about DNS can be found in the lecture. Similarly to the case of ARP, operating systems usually store mapping between domain names and L3 addresses of network hosts into DNS cache in order to reduce network load. On the monitored PC, open web browser and enter address On the sniffer PC, capture network traffic using Wireshark with predefined filter DNS, analyse process of resolution of IP address of the server and note following information. o The server IP address resolution procedure. o Source and destination L2 a L3 addresses of frames / packets with DNS datagrams. o The requested domain name. 4

5 o The resolved IP address. It s of course necessary to maintain the mapping between domain name and L3 address of some host in the system of the domain servers. This service is usually paid and temporarily limited. On the internet, there is number of public databases containing registrations of domain names (i.e. who s services). Use arbitrary public database of domain names (i.e. whois service) and determine date of the domain name registration expiration of arbitrary server. HYPERTEXT TRANSFER PROTOCOL The HTTP is a text-oriented protocol of application layer of OSI model and TCP/IP stack designated for transfer of data in textual form and its primary purpose is to transfer web pages. However, it s also possible to use it for transfer of object-oriented data or remote procedure call. More information about HTTP can be found in the lecture. On the monitored PC, open web browser and access arbitrary web page. On the sniffer PC, capture network traffic using Wireshark with predefined filter HTTP, analyse process of webpage transfer and note following information. o Content of request sent by web browser. o Content of server s response. o Determine the number of servers, from which parts of webpage has been loaded. FILE TRANSFER PROTOCOL The FTP is a protocol of application layer of OSI model and TCP/IP stack designated for file transfer. Opposed to the majority of TCP/IP protocol, its actively uses two ports. One for transfer of control information and other for transfer of binary data. More information about FTP can be found in the lecture. On the monitored PC, open FileZilla program and connect to the FTP server using following credentials. o IP address of server: o Username: student_low. o Password: A3B38DSY. On the sniffer PC, capture network traffic using Wireshark with predefined filter FTP and analyse process of FTP client login. o Try to find captured user credentials (i.e. username and password). o Analyse the connection initiation mechanism (i.e. 3-way handshake) of the TCP protocol. On the monitored PC, use FileZilla for the upload of the RUR_CZ.txt text file on the FTP server. On the sniffer PC, analyse file transfer procedure and verify following TCP protocol congestion control mechanisms. o The slow start mechanism. o The data-flow mechanism (i.e. regulation of the value of Window Size field of the TCP header). SECURITY Today, most of personalized web services is secured. Try to capture and analyse secured communication with arbitrary web service (e.g. or social network). On the monitored PC, open web browser and access arbitrary secured web service. On the sniffer PC, capture network traffic using Wireshark without any predefined filter (use Clear button in order to cancel the filtration of captured data) and try to analyse captured data. o Try to explain, why it s difficult to capture and analyse secured communication. 5