Domain 4 Flashcards
What is a protocol?
It is an agreed upon set of rules. It defines the format and order of messages and actions taken upon receipt of the messages
Network protocols:
- determine how computers communicate with each other
- standards-based approach increase interoperability
Layered Models
- Divides networking processes into manageable layers
- Can modify one layer without affecting the others
- Easier to understand communication functions
What is encapsulation?
Encapsulates data into TCP segment into an IP packet, into a frame, into bits, across the wire.
Think 7 layers - encapsulate and decapsulate the message through the 7 layers
- Divide the network communications into 7 layers
- Divide tasks of communication into pieces for easier implementation
- Appending data around the information from on data packet to the data of another packet
- Each layer encapsulates information around the packet it received from the layer immediately above it, then sent to the layer below
- When the packed is received, the information that pertains to each layer is stripped from the packet as it moves up the protocol stack
What are the layers of the OSI model, in order?
The Open systems interconnect (OSI) model is a layered model showing the flow of information from one application on a system to another across a network. There are 7 layers in the model.
Please Do Not Throw Sausage Pizza Away
1) Physical -0’s and 1’s - bits - handles transmission across the physical media - includes such things as electircal pulses on wires, connection specifications between the interface hardware, and the network cable and voltage regulation
2) Data Link - Ethernet address and switches- Connects the physical part of the network (cables, electrical signals) with the abstract part (packets and data streams)
3) Network - IP addresses and routing - interaction with the network address scheme and connectivity over multiple network segments. Describes how systems on different network segments find and communicate with each other
4) Transport - Ports, TCP and UDP headers - interacts with you information and prepares it to be transmitted across the network. It is this layer that ensures reliable connectivity from end to end. The transport layer also handles the sequencing of packets in a transmission
5) Session - Data - hands the establishment and maintenance of connections between systems. It negotiates the connection, sets it up, maintains it and makes sure that information exchanged across the connection is in syn on both sides
6) Presentation - Data - present the data to the application in a way it makes sense - makes sure that the data sent from one side of the connection is received in a format that is useful to the other side (compresses, decompresses)
7) Application - application and its data - interacts with the application to determine which network services will be required. When a program requires access to the network, the application layer will manage requests from the program to the other layers down the stack
What are the attributes of the OSI model Layer 7 - Application Layer
- This is the layer that is closest to the users and programs.
- Identification of communication partners
- Determines security aspects of communication
- When a program requires access to the network, the Application Layer will manage request from the program to the other layers down the stack
- PDF, adobe, browser, etc live here
What are the attributes of the OSI model Layer 6 - Presentation Layer
- Provides representation of information to be processed by the application
- Provides translation services, such as EBCDIC to ASCII
- Performs encoding, compression and decompression
- makes sure that the data sent from on side of the connection is received in a format that is useful to the other side
What are the attributes of the OSI model Layer 5 - Session Layer
- Establishment and maintenance of connections between systems.
- Organizes and synchronizes communication
- Management of data exchange
- Establishes lines of communication and initial contact to destination computers
- Maintains the session allowing recovery and Restoration
- Allows both half-duplex and full-duplex communications
What are the attributes of the OSI model Layer 4 - Transport Layer
- TCP and UDP
- Optimizes network service usage
- Uniquely identifies endpoints by transport address
- ports live here
- Reliable and cost-effective data transfer and connectivity
- Maintains communication integrity
- Sequence control of packets in transmission, error detection and possible error recovery
- Prepares your information to be transmitted across the networ.
What are the attributes of the OSI model Layer 3 - Network Layer
- IPv4 and IPv6
- Routers
- Handles interaction with the network address scheme and connectivity over multiple network segments. It describes how systems on different network segments find and communicate with each other
- Provides network addressing to identify endpoints
- Performs routing and flow control
- Establishes network connection allowing transfer of data from one network endpoint to another
- Provides network path
What are the attributes of the OSI model Layer 2 - Data Link Layer
- Ethernet
- MAC addresses
- Switches
- Maps IP addresses to MAC addresses
- Connects the physical part of the network with the abstract part
- formats messages to allow for transfer of physical media
- Provides addressing for physical hardware
What are the attributes of the OSI model Layer 1 - Physical Layer
- Bits
- Cables
- Radio Waves
- Electrcity
- Light (fiber optics)
- Handles transmission across the physical media
- Provides for mechanical and electrical activation, maintenance and deactivation of physical connections for transmission
- Converts bits into electrical signals or light impulses for transmission
What are the layers of TCP/IP?
Application = layer 7, 6, 5
Host to Host transport = layer 4
Internet = layer 3
Network Access = Layer 2, 1
What is the Internet Protocol (IP)?
Most common Layer 3 protocol
- Works at the internet layer of the TCP/IP stack
- Deals with transmission of packets between endpoints
- The fundamental protocol of the internet
IPv4 - 32 bit source and desitnation addresses
What is Classless Inter-Domain Routing (CIDR)?
This is an IPv4 address class that allows for more flexible network sizes than those allowed by classful addresses. It allows for many network sizes beyond the arbitrary classful network sizes.
- Slash notation, for example /8 of /20 or /10
- Helps conserve IP addresses by allowing flexible subnet sizes
Once networks are in CIDR notation, additional routable network sizes are possible. Need 128 IP addresses? Chop Class C (/24) in half, resulting in two /25 networks. Need 64 IP addresses? Chop a /24 network into quarters resulting in four /26 networks with 64 IP addresses each
Designed to cut networks up more finely
What is classful addressing: A through E
Class A: 16.7M addresses – /8
Class B: /16
Class C: /24 - the first 24 bits describe the network and the remaining 8 describe the host
Class D: Multicast
Class E: Reserved (formally experimental)
What is IPv4 Broadcast Address and a SMURPH attack?
One to all type of address
- Sender will send ping to all hosts on a given network segment
Two Types:
1) Directed Broadcast - you direct to a specific network and the host portion is set to all 1s (255) which means it will send to all
2) Limited Broadcast - sends to everyone on the internet - all 1s which is 255.255.255.255. Routers block this by default otherwise you will ping the entire internet and if you get responses back its bad
SMURPH ATTACK: When you forge the address a ping is coming from to someone elses address. You ping the whole internet or a very large network. When the responses are received, it creates DOS for the address you forged the ping was coming from
What is Private Network Addressing
Maps private addresses to public addresses
Private IP addresses are only used internally, they are not used publically on the internet - your router assignes a private IP
IPv4 address space is scarce
- how do we solve this problem?
Set aside private addresses and marry this with NAT (network address translation). When you cross the firewall, the firewall will map you to a public address through NAT. Many people can use the public address. CIDR also allows smaller networks.
RFC 1918 is the private addresses
What is network address translation?
NAT - translates one IP address to another. It maps IPs and ports. It maps public to private and private to public so that not all IPv4 public addresses are used up for every single device. One router will
- One to one - one internal maps to one external
- Many to one - multiple map to one external
- Pool NAT - maps to a set of public addresses. Commonly used in large. If you have too much traffic and you fill the NAT table, new connections will break. Pool NAT throws in something like a firewall to increase the number addresses available to avoid losing connection because of an overflow from too much traffic.
What is the Domain Name System (DNS)?
The DNS is the protocol for translating IP addresses to domain names and back again.
Root level servers for top-level domains (.com, .org,, .edu, .gov, etc.).
www.microsoft.com translates to the IP address.
Various networks on the internet are divided up into groups called domains. The domains are structured in a hierarchy like a tree. The top level of the tree is called the root or top level domain. There are a handful of these like .com. EAch level down the hierarchy tree ads another level to the domain. Each level can be another domain or a host computer itself
DNS has security issues:
- no built-in security
- Attacker can spoof responses by guessing or brute forcing the DNS transaction ID and client source port. Once this is done, the network will cache that website so anyone on the network will automatically be brought to the spoofed website instead. This is a cache poisoning attack.
- Domain hijacking. It allows an attacker to take over a domain and redirect communications from a good domain to a bad one
**DNSSEC: Protect against DNS spoofing with DNSSEC (Domain name system security extentions). protect against cache poisoning and DNS spoofing. It uses encryption and PKI to provide origin authority and data integrity. It does not provide confidentiality. It authenticates the DNS server as the sender. Also has denial of existence check proving a DNS record does not exist. It is a digital signature for a packet - it can tell what you requested did not change
What are the DNS queries?
1) gethostbyname: when you have the fully qualified domain name or the local name within your private network and need the address
2) gethostbyaddr: When you have the address and need the name
What is IPv6?
Designed to meet addressing growth
- 128 bits = 340 undecillion addresses (7 addresses for each atom of every human)
- offers greater flexibility in allocating addresses
- Faster than V4 - every packet had to check a check sum in v4. Router would check the check sum at every hop, server would check the checksum at the TCP layer. So the check was done by the server. For v6 - they said drop the layer 3 checksum - routers dont check the check sum so it passes through the router faster.
Features:
- Tunnel v6 over v4 - carry the packet right over there TCP goes.
- If you tunnel v6 over v4 IDS have a terrible time detecting stuff
- You should detect v6 over v4 tunneling in your environment
- can support v4 on v6 backbone by translating v4 to v6
What is IPv6 addressing
- use hexidecimal notation
- No more NAT - and no more DHCP - how do systems assign themselves addresses?
- Autoconfiguration - use your MAC address which is unique and embed it in your address and assign the network prefix
Network prefix - represented in the first 48 bits (6 bytes)
Subnet ID - configured according to the addressing needs of the org.
Interface identification - uniquely identifies the v6 node. With v6 autoconfiguration, the MAC address of the client populates the interface identification portion of the v6 address.
Take the MAC and split it in half and append the network prefix.
They now added DHCP.
Packet: - The header information has changed to accommodate the v6 protocol:
- Hop Limit - renamed time to live (TTL) - was described as seconds. But now its more a accurate because its not seconds its a hop limit.
What is UDP? User datagram protocol
Connectionless communications
- sends packets out, doesnt care if they get there
- Much less overhead
- Good if small amount of packet loss is acceptable
- used for things like streaming audio because can afford to lose one or two packets - do less error checking so can move faster
Testable***:
- UDP ports:
- — DNS (53)
- — NTP - Network Time protocol) (123)
- — BOOTP/DHCP (dynamic host configuration protocol) (67 and 68)
- — SNMP (161)
It has an 8 byte header
- source port
- destination port
- message length
- checksum (only for v6)
So simple, build what you want
Faster and less reliable and is often the basis for query-type applications (NTP, DNS, NFS)
What is TCP - transmission control protocol?
Connection oriented communications
- ensures reliable packet delivery
- expensive overhead
- 3 way handshake
- — SYN
- — SYN-ACK
- — ACK
- establishes a virtual connection known as a session between hosts
- reliable connection over unreliable networks
- you waste 6 packets on every connection sending no data - you have SYN and FIN (which is used for shut down)
Header:
- urgent porter is useless (2 bytes)
- sequence number makes sure packets stay in sync - so you know if something is missing or out of order
- 20 bytes total
- a lot more in the header than UDP and IPv6
- *Key fields you need to know:
- Source port
- Destination port
- sequence number - track packets and provide reliable delivery of information
- acknowledgement number - used to acknowledge the receipt of information
- SYN bit - establish the connection
- ACK bit - system acknowledges the receipt of information
Slower but offers reliable delivery and is the basis for most internet applications
Well known TCP protocols memorize
Know that FTP classical uses 2 ports (active FTP)
**Active FTP - clients port connects to server 21. Then download from server 20 to client. Brand new connection. - firewall would break the connection.
Passive FTP works normally - not a backwards connection with a separate session
1) 20 - FTP data - download data from a server source is 20 - active FTP - broke firewalls. second connection. firewall views second connection as an unrelated connection and broke firewalls. Its a separate connection but for the same session you are trying to perform
2) 21 - FTP - connect to a server from port 21
3) 22 - SSH
4) 23 - Telnet
5) 25 - SMTP
6) 53 - Domain Name System (DNS)
7) 79 - Finger
8) 80 - HTTP
9) 443 - HTTPS
you can use any ports you want but if you use your own port assignments, no one will be able to communicate with you.
What are the TCP Code Bits
U - URG (urgent) - lets the other end of the connection know that some important data is coming. most applications never use URG flag.
A - ACK (acknowledgement) - indicate that the sender is acknowledging receipt of some data - look in the acknowledgement number field to see which data is being ACKed
P - PSH (push) - TCP stacks usually buffer incoming data until a certain amount has been collected and then pass it in a chunk to the application. The push flag indicates that a packet shouldnt be buffered but instead it should be passed immediately to the remote application for processing.
R - RST (Reset) - upon receipt of a packet with a reset flag, a host should terminate the connection that contained that packet - tear it down, things were out of synch
S - SYN (synchronize) - synchronize flag indicates a connection request
F - FIN (Finish) - indicates that a connection is being shut down in an orderly fashion. gracefully closes down the connection vs. RST terminates it
What is TCP Port Scanning?
Attempt to determine all open TCP or UDP ports on a system.
Sending a TCP SYN packet may result in:
- SYN / ACK: port is open and unfiltered
- RST / ACK: port is closed and unfiltered - host received the packet and said no
- no response: unknown
- a filter may be blocking the request
- cannot determine if the port is actually open or closed in this case
NMAP is a port scanning tool used to conduct a port scan
What is a socket pair?
It uniquely identifies a connection so that you can tell the difference between two separate connections.
Consists of the following:
- source IP address
- source port number
- destination IP address
- destination port number
If you connect to port 80 for two separate connections, everything above will be the same except for the source port number
What is ICMP? Internet control message protocol
It is a helper protocol to help IP run
Two purposes is:
1) to report errors - rather than transfer information - network troubleshooting
2) to provide network information. Ping and traceroute are the best known IMP applications - echo request/echo reply or ping. Ping is used to find whether a given internet host is reachable or not. Traceroute is built on ping and used to plot out the path a packet took through the network
It can also be used for flow control, rerouting packets and collecting network information
Each packet has a code and type field.
Helps troubleshoot errors
What is a ping?
A Ping is used to see whether a host is active. It sends an ICMP echo request and waits for an ICMP echo reply.
What is a traceroute?
Trace the route across the network hop by hop using ICMP - see the path taken
Shows you the path packets may take to get to a destination. May tell you the external router for a site and therefore, be used to map a network.
Cannot tell if my packets are going through all the hops. Traceroute is what does this. it lists the routers.
traceroute uses combination of TTL and ICMP replies to map out the route packets take from one computer to another. The command works by sending a series of packets all going to the same destination with TTL values starting at 1. They will receive a TTL expire at the first hop so they now know the first router. Then they will do TTL 2 and learn the second router and so on.
What is Secure Shell (SSH)?
An application layer security protocol.
- It is TCP port 22
- supports authentication, compression, confidentiality and integrity
- RSA certificate exchange for authentication
- Supports a wide variety of ciphers, including Triple DES, AES, Blowfish and many others
- SSH version 1 was vulnerable to a man in the middle attack, version 2 is strongly recommended
What is Secure Multipurpose Internet Mail Extensions? (S/MIME)
Secure email.
Allows users to easily exchange encrypted and digitally signed messages, even if they use different email programs.
What is SSL and TLS?
Secure Socket Layer and Transport Layer Security
They are both application layer protocols
- SSL was released by Netscape in 1994
- TLS version 1.0 is SSL version 3.1
- TLS is an upgrade to SSL 3.0
- Retains backward-compatibility with SSL
- Current version of TLS is 1.2
- TLS may be used as a tunneling protocol - not just encryption for web traffic but also email, chat, etc.
What are some other TCP/IP protocols?
1) Telnet - Terminal emulation across a network. Cleartext authentication and data transfer - no confidentiality
2) File Transfer Protocol (FTP) - allows file transfer over network. cleatext authentication and data transfer. No confidentiality - only cleartext. TCP port 21. Extra TCP port for data channel
* *Note that FTP uses two ports.
- — TCP port 21 where commands are sent
- — TCP port 20 where data is transferred - Active
** Many firewalls will block the active FTP data connection. Passive FTP addresses this issue by keeping all communication from client and server
– active gets blocked by firewalls and passive does not
–passive maintains client server order. active changes the client server order
3) Simple Mail Transfer Protocol (SMTP) - used to send and receive email between mail servers. TCP Port 25
4) Trivial File Transfer Protocol (TFTP) - allows file transfer over network. Not authentication or confidentiality - only cleartext
UDP port 69
What is SNMP? - Simple Network Management Protocol
Primary use-case involves monitoring of network devices for performance metrics and error conditions
SNMP uses read and write strings to act as passwords.
Version 2 and older use cleartext community strings - allows you to read the device. If you have access to the read string it allows read access to the managed device. Write access allows modification of a device such as changing the router configuration.
Version 3 support encryption - V3 is is strongly recommended
Very dangerous if you dont secure it. especially the write strings
UDP port 161
What are multilayer protocols?
1) SMTP
2) TCP/IP
3) DNP3 - distributed network protocol is
- — open protocol that supports the smart grid - used to provide interoperability between various vendors SCADA systems
- — became an IEEE standard in 2010 - IEEE 1815-2010 and allowed pre-shared keys is now deprecated
- — IEEE 1815-2012 is the current standard that supports PKI
What is Network Attached Storage? (NAS)
Network attached storage (NAS) provides file and directory access via ethernet and reading and writing entire files over a network.
Uses TCP/IP
Historically, computers used DAS, such as IDE or SATA drives and directly connected disk controllers which provide block level access. NAS does not provide direct access to blocks or clusters
NAS allows reading/writing entire files via a network
What is Storage Area Network (SAN)
SAN gives block level access - it acts like a disk that is in your computer but it is over the network.
SAN is block access via the network
NAS is reading and writing entire files
These are the key distinctions.
Common SAN solutions include Fibre channel (FC), FCoE, iSCSI
Storage is called fabric
What is iSCSI (Internet Small Computer System Interface
It offers SCSI disk access via the network (TCP/IP)
- routed via IP
- can span large areas
It is a type of SAN
What is FCoE - Fibre Channel over Ethernet?
It expands Fibre Channel (FC) which was designed for high-performance directly attached storage over the internet through ethernet netowrks
Unlike NAS - TCP/IP is not used. It runs directly on top of layer 2 (Ethernet)
It is a type of SAN - forms a network called fabric
Three flavors of Fibre Channel:
1) FC - does not use Ethernet at all. does not scale well uses channels like a telephone circuit which allows high speed with low overhead.
2) FCoE - uses custom cabling and switches. It encapsulates fibre channel frames via ethernet for layer 2 transport. This allows FCoE to use typical networking equipment such as ethernet switches, which typically offer higher speeds for lower costs compared to FC. Does not use TCP/IP - it is not routable through IP. Local subnet only. Cannot route
3) FCIP - fibre channel over IP - allows you to route
What is VoIP? Voice over internet protocol
Technology that allows phone calls to be routed and transmitted using a data network (IP).
Voice traffic is digitized before it is sent over IP.
Attributes:
- Can be used between any combination of analog telephone adapters, IP phones, and computers
- Reduce operating costs
- combines data
- is cost effective
- allows for redundancy (you can have VoIP and telephone lines)
- Exposure and Security issues - Private Branch Exchange systems - contain maintenance hooks for providing remote maintenance capabilities over the phone line. If an attacker learns the number for connecting to the back door and is able to authenticate, the attacker may be able to make calls on the company’s account or access sensitive voicemail messages.
What is the VoIP architecture? indicating he wishes
What are the ways you can integrate VoIP?
1) PSTN (public switch telephone network) PBX (private branch exchange) / VoIP integration
- — Integrate PBX connected to a public switched telephone network with a VoIP network. This allos for a phased approach to a VoIP network leveraging existing traditional voice services in conjunction with new VoIP deployment.
- — common and phased approach
- — Combines traditional and VoIP networks
2) IB PBX/PSTN integration
- — Use IP PBX and connect to PSTN network directly. All local users utilize VoIP phones to connect to the IP PBX which provides direct connectvity to the PSTN for outbound calls
- — Users must use VoIP phones
- — IP PBX (soft switch) routes call
3) Pure VoIP networks:
- — VoIP peers only
- — Call to PSTN is not available
- — also known as walled garden approach only provides connectivity to other VoIP callers
4) VoIP / PSTN integration provider services
- — cost effective and minimal investment approach
- — IP PBX on a server or workstration using commercial or free software and pay a VoIP integration provider to provide PSTN connectivity with a block of direct inbound dial (DID) phone number. The service is provided over the internet.
What are the component you need for VoIP?
1) Media gateways - converts traffic between a packet-switched network and a circuit switched network
2) Registration and location servers
3) proxy servers
4) messaging servers
5) end-user devices (Voip phones, soft phones)
What are VoIP traffic patterns?
- Call setup involves registration and location servers
- Packetized audio travels between two VoIP entities directly - two phones or a VoIP phone and gateway
- Traffic patterns may differ
Two data streams are created: a call setup stream and a voice stream.
The call setup stream is where the caller contacts his local registration server indicating he wishes to initiate a call. The registration server contacts the recipients registration server who in turn contacts the call recipient. The callers do not communicate directly in the call setup phase but exchange messages through the registration servers.
Once the call setup phase is completed, the caller create a direct connection to the recipient to establish the voice stream.
