TCP/IP Concepts Review. A CEH Perspective

Transcription

1 TCP/IP Concepts Review A CEH Perspective 1

2 Objectives At the end of this unit, you will be able to: Describe the TCP/IP protocol stack For each level, explain roles and vulnerabilities Explain basic IP addressing concepts Appropriately utilize the following numbering systems Binary Octal, and Hexadecimal 2

3 TCP/IP Overview Transmission Control Program/Internet Protocol Worlds most widely used protocol Vint Cerf aka father of the Internet TCP/IP Vulnerabilities Lack of identification and authentication TCP/IP Four layered stack 1. Application 2. Transport 3. Internet 4. Network Interface 3

4 Levels of Data Structures Stream or Message Segment or Datagram Datagram Frame 4

5 5

6 6

7 Application Layer Interface between application program and lower-layer protocols Application program is what you see and touch Includes HTTP FTP TFTP SNMP SMTP 7

8 TCP/IP Application Protocols 8

9 Transport Layer Encapsulates TCP data into segments Encapsulates UDP data into datagrams TCP is connection-oriented TCP connections begin with a three-way handshake Computer A sends a SYN packet UDP is connectionless SSL also operates at this level Computer B replies with a SYN-ACK packet Computer A replies with an ACK packet 9

10 TCP Segment Headers Critical components: Flags Ports source and destination Initial Sequence Number (ISN) To identify vulnerabilities, can be (actively) abused NMap Hping Other packet shapers 10

11 TCP Header 11

12 TCP Flags Each flag is one bit Either 0 (off) or 1 (on) Six flags SYN: synchronization ACK: acknowledge PSH: push URG: urgent RST: reset FIN: finish 12

13 Initial Sequence Number (ISN) 32-bit number Tracks packets received Enables reassembly of large packets Set on steps 1 and 2 of the TCP three-way handshake 13

14 Transport Level Ports Port Logical, connection component Typically used to map a packet to a running process Two socket components (IP:Port) Port numbers are 16-bit integers 2 16 X 2 possible ports Both source and destination ports are utilized Enables unneeded services to be identified Unneeded open ports represent, potentially serious, vulnerabilities 14

15 Port Categories Well-known ports are defined as the first (lower) 1024 (0 1023) ports Well known means that they have an assigned service In Linux only privileged system or root processes can use lower level ports Example: HTTP uses port 80 Internet Assigned Numbers Authority (IANA) maintains wellknown ports list ( Ports 1024 to are called the Registered Ports Ports to are called Dynamic or Private Ports 15

16 TCP Port Examples Ports 20 and 21 File Transfer Protocol (FTP) Use for sharing files over the Internet Requires a logon name and password Port 25 Simple Mail Transfer Protocol (SMTP) servers listen on this port Port 53 Domain Name Service (DNS) Helps users connect to Web sites using URLs instead of IP addresses Port 69 Trivial File Transfer Protocol Used for transferring router configurations 16

17 TCP Ports Examples Port 80 Hypertext Transfer Protocol (HTTP) Used when connecting to a Web server Port 110 Post Office Protocol 3 (POP3) Used for retrieving Port 119 Network News Transfer Protocol For use with newsgroups Port 135 Remote Procedure Call (RPC) Critical for the operation of Microsoft Exchange Server and Active Directory Port 139 NetBIOS Used by Microsoft s NetBIOS Session Service Port 143 Internet Message Access Protocol 4 (IMAP4) Used for retrieving Better than POP3 17

18 User Datagram Protocol (UDP) Fast, unreliable (connectionless) transport layer protocol No delivery verification Does not even check that receiver is listening Reliability may be provided by higher TCP/IP stack layers 18

19 Internet Layer Responsible for: 1. Logical addressing and 2. Routing packets to their destination Uses a logical IP addresses IP is connectionless 19

20 Internet Layer Nothing can be directly sent to a logical (IP) Address. Information can only be directly sent to physical i.e. MAC Addresses ARP translates between IP and MAC Addresses DHCP offers IP configuration services 20

21 ICMP Internet Control Message Protocol (ICMP) Used to send messages relating to network operations Aides network troubleshooting Example commands include: Ping Traceroute 21

22 22

23 IPv4 Address Four bytes, 32 bits Two components Network address Host address Classes Class A Class B Class C 23

24 24

25 Class A IP Address Class A First byte network address Last three bytes host address Supports more than 16 million host computers Limited number of Class A networks Format: network.node.node.node 25

26 Class B IP Addressing Class B First two bytes for network address Last two bytes host address Supports more than 65,000 host computers Assigned to large corporations and Internet Service Providers (ISPs) Format: network.network.node.node 26

27 Class C IP Addressing Class C First three bytes for network address Last byte for host address Supports up to 254 host computers Usually available for small business and home networks Format: network.network.network.node 27

28 Subnetting Subnetting Each network can be assigned a subnet mask Helps separate the network address bits from the host address bits RFC

29 Class C Subnets In the final column, red represents the number of host bits, while blue represents the number of borrowed subnet bits. 29

30 Planning IP Address Assignments Each network segment requires a unique network address Addresses containing all 0s or all 1s cannot be hosts All 1s is a broadcast All 0s represents a network Accessing entities and services on other networks Requires gateway Subnet mask used to determine destination computer s network address If addresses are different, packets relayed to gateway Gateway forwards packet to its next destination Packet eventually reaches destination 30

31 Overview of Numbering Systems Binary Octal Hexadecimal 31

32 Reviewing the Binary Numbering System Uses the number 2 as its base Binary digits (bits): 0 and 1 Byte 8 bit group Can represent 2 8 = 256 different values Linux file permissions can be represented with bits 0 means removing the permission 1 means granting the permission 111 (rwx) means all permissions apply 32

33 Examples of Determining Binary Values Each position represents a power of 2 value Usually the bit on the right is the less significant bit Converting 1011 to decimal 1 x 2 0 = 1 1 x 2 1 = 2 0 x 2 2 = 0 1 x 2 3 = = 11 (decimal value) 33

34 Understanding Nibbles Half a byte or four bits Helps with reading the number by separating the byte Components High-order nibble (left side) Low-order nibble (right side) 34

35 Understanding Nibbles (continued) Converting to decimal Low-order nibble 1010 = 10 (base 10) Multiply high-order nibble by = 10 x 16 = 160 (base 10) = 170 (base 10) 35

36 Octal Numbering System Uses 8 as base Supports digits from 0 to 7 Octal digits can be represented with three bits Permissions on UNIX Owner permissions (rwx) Group permissions (rwx) Other permissions (rwx) Example binary: Octal representation

37 Hexadecimal Numbering System Uses 16 as its base Support numbers from 0 to 15 Hex number consists of two characters Each character represents a nibble Value contains alphabetic letters (A F) A representing 10 and F representing 15 Sometimes expressed with 0x in front Represent hex number in binary or decimal Convert each nibble to binary Convert binary value to decimal 37

38 Questions??? 38