Why do we need networks? Networking Basics and Network Security Shared Data and Functions Availability Performance, Load Balancing What is needed for a network? ISO 7-Layer Model Physical Connection Wired: Ethernet, t USB, Wireless: Bluetooth, WLAN, Logic Connection Networking Software (OS) Network Applications WWW, E-Mail, Telnet, Application Layer Presentation Layer Session Layer Transport Layer Network Layer Data Link Layer Physical Layer Web-Browser, FTP HTML, ASCII HTTP, SMTP TCP, UDP, SPX IP, IPX IEEE 802.3, 802.11 Cables, Radio 1
Benefits from layering A simple Example Each layer uses the services provided by the next lower one and provides services to the next one Users don t see the lower layers Programmers can rely on well defined interfaces Improved interoperability Frederic Sumaye Translator Office Swahili Translated Text Conversation English Telegrams Megawati Sukarnoputri Indonesia Translator Translated Text Office Physical Layer (1) Data Link Layer (2) Bit- / Baudrate Mechanical Dimensions Electrical Specification Functional Specification Protocol (Handshaking, etc.) Examples: ISDN, Ethernet, Token-Ring, Wireless-LAN Error-Recognition and -Recovery Flow Control Commonly used: Shared Media -> Collision Detection necessary Ethernet: CSMA/CD ATM, GSM: assigned Timeslots 2
Network Layer (3) Main Task: Routing Packets Routing Requirements: simple, robust, stable, fair, optimal Internet (IPv4 / IPv6): globally unique addresses AppleTalk / SMB (Windows): addresses only valid in a local scope Transport Layer (4) Connected or connection-less Services UDP: User Datagram Protocol very simple, connection-less protocol no flow-control, packets can be lost TCP: Transmission Control Protocol reliable, connection oriented protocol flow-control, supports QoS Session Layer (5) Presentation Layer (6) Not implemented in TCP/IP Networks Standards d for Presentation ti Layer are well defined: ASCII, HTML, PNG, No automatic conversion! Gateways: UNIVIS-DB Access via Web, Internet to X.400 Mail Relays, The Network is hidden Automatic Address resolution No routing, etc. visible Comfortable Application Layer (7) 3
Overview ISO 7-Layer Model Networking Hardware Physical Layer: Repeater, Hub simple electrical l amplifier Data Link Layer: Bridge, Switch separates collision domains Network Layer: Router, Layer 3 Switch forwarding between different networks Higher Layers: Gateways (Software) Internet Protocols (1) Internet Protocols (2) IP: Internet Protocol Routing-Information: ToS-Flags, Protocol-ID, Header-Checksum, Addresses ICMP: Internet Control Message Protocol Ping, Traceroute UDP: User Datagram Protocol Connection-Less Protocol Ports, Data-Length and Checksum TCP: Transmission Control Protocol Ports (widely used for many services in upper layers) Connection-Based Protocol Sequence- and Acknowledge- Numbers Connection establishment: 3-Way Handshake CRC-Checksum (like UDP) 4
Network Security (Problems) No Security Mechanisms implemented in TCP/IP (IPv4) Problems: Traffic can be observed (Passwords, Credit Cards, ) manipulated (Bank Transfers, ) faked (DoS Attacks, ) Server Programs are vulnerable! Enhancing Network Security Cryptographic Protocol Extensions (HTTPS, SSH, ) Inhibit Data-Manipulation and -Observation Protocol dependant Can t prevent DoS-Attacks Can t protect vulnerable Servers Network-Infrastructure is vulnerable! Firewalls Protect Servers against Hackers Allow / disallow traffic based on simple rules (Addresses, Protocol, Ports, ) Example: Web-Server Incoming: only on Port 80 Outgoing: only responses Detect typical Attacks Simple Firewall: Packet Filters Filter Rules only match IP-Addresses, Protocol and TCP/UDP-PortsPorts FTP: big holes in Firewall necessary! Hackers can still find hidden Servers Example (Linux): iptables -A INPUT -p tcp --destination-port!80 -j DROP 5
Better: Stateful Inspection TCP: Connection-based Protocol Recognize Packets belonging to an established Connection Can allow FTP-Session from Server to Client Machine UDP: no Connections but Sessions Can allow DNS-responses but disallow malicious packets ( spoofing ) DMZ : Demilitarized Zone Internet Absolutely insecure! Private Network: Incoming: not allowed Outgoing: Masquerading DMZ : NAT Incoming: only selected services (Web, Mail, ) Outgoing: limited (DNS) Masquerading Only 4 Billion IPv4 addresses available Clients usually don t need official IPs Address translation Internal: private addresses (defined in RFC1918) External: one official address Table for open connections Automatically hides private network Outgoing traffic appears to come from one computer. NAT : Network Address Translation Mapping of one IP address to another without the sender noticing. E.g.: Gateway accepts packets for web server in DMZ and forwards them internally. Response appears to come from the original destination address. Forwarding of packets on specific ports possible (e.g. port 80 for www). Other packets are discarded. 6
VPN : Virtual Private Networks The Main Points Again... Clients connect to an internal network ( intranet ) through the Internet. Sessions are authenticated. Traffic is usually encrypted. Comfortable for the user: Access to internal servers as if he was in his office Works with all IP based services. Certificates are used for authentication and encryption. Networking Basics ISO/OSI Model Internet Protocols: IPv4 / IPv6 UDP: Connection-less TCP: Connection-based TCP Connection establishment Network Security Security Risks Protocol Dependant Solutions Firewalls: Packet Filter Stateful Inspection DMZ, Masquerading, NAT, VPN 7