Review of Networking Basics: Layered Protocols and TCP/IP

1. Review of Networking Basics: Layered Protocols and TCP/IPAdvanced Network Security Peter ReiherAugust, 2014

2. Outline • Network protocol basics • Protocol layering • TCP/IP

3. Handling Network Complexity • Networks are very complex • Highly varying characteristics of link types • Time varying characteristics • Other heterogeneity caused by administration choices • How to get a handle on that complexity?

4. A Closer Look at the Complexity • Some complexity is due to different media/hardware • Wireless vs. wired • Some complexity is due to different aspects of the networking task • Moving bits across one link vs. delivery across the Internet • Some is due to the use networking is put to • Large downloads vs. telephone calls

5. Simplifying the Complexity • We typically use a divide-and-conquer strategy to handle these complexities • Build different components to handle different networking problems • Each can be specialized to its task • And ignore other complexities • But this approach introduces another complexity itself • Composing the components properly

6. Composing Our Components The basic strategy for putting the components together is layering Design network elements as separate layers Define a strict interface between layers Then compose the required layers into an overall stack

7. What Do We Layer? • In some sense, hardware • Low level HW does D/A and A/D • Higher level HW does routing, switching, buffering, etc. • But the most important layering is of protocols • Network protocols are built in layers

8. The ISO Model

9. Layering in the Internet • We commonly don’t use all the layers from the ISO model in the Internet • Especially not in a formal sense • But layers 1-4 are standard and common • Most Internet traffic uses all of these

10. Layer 1 • The physical link layer • Coding, transmission, and reception of zeros and ones • Generally very well hidden from the upper layers • E.g., no explicit headers for this layer

11. Layer 2 • The link layer • This describes how the particular link handles data • Likely to be quite different for different media • E.g, point-to-point links work differently than shared broadcast links

12. Layer 3 The network layer This layer worries about moving packets from source to destination Over multiple links Generally completely divorced from the media technology IP (IPv4 or IPv6) is by far the most common network protocol

13. Layer 4 The transport layer This layer worries about overall performance of source to destination Reliable packet delivery In order delivery Flow control Might or might not be session oriented

14. Popular Transport Protocols • TCP • For reliable flow-controlled delivery of connection-oriented data • UDP • Lighter weight transport • No flow control, no retransmission, no reordering, etc. • RTP • Real time data delivery

15. Another Perspective on Layering Layer 3 Layer 3 Layer 3 Layer 3 Layer 3 Layer 1 Layer 2 Layer 2 Layer 1

16. Layer 4 Is a Bit Different Layer 4 processing only done on the endpoints Because it’s concerned with end-to-end issues Layer 4

17. A Closer Look At TCP and IP TCP and IP are the core Internet protocols So they’re particularly important We’ll quickly review them

18. IP • The Internet Protocol • The primary protocol used to move packets on the Internet • A layer 3 protocol • It’s job is to deliver individual packets end to end

19. Basics of IP • Each packet is its own entity • But packets may need to be fragmented • And, if so, reassembled • When an IP packet arrives at a node • If it’s destined for that node, deliver it • Otherwise, send it to another node “closer” to the destination • An IP header describes the important information for handling a packet

20. The IP Header Length of entire packet “Locally” unique ID number Pad to multiple of 32 bits Which version of the protocol Where this fragment starts Hops till this packet is dropper Can specify special handling Length of the header Checksum of header only Flags related to fragmentation Protocol used in the data field IP address of receiver IP address of sender Options to change normal handling

21. The Important Aspects of IP • The various options aren’t used much • And not everyone honors them • The key fields are: • Length • Source and destination address • TTL • Protocol • Checksum

22. Security Implications of IP • Source address isn’t authenticated • TTL might be abused • Though possibilities are limited • Any destination address can be given • Some routers won’t forward to all destinations, though • Bad checksums will cause drops

23. Unauthenticated Addresses and IP Spoofing Since the source address is not authenticated, attacker can fake it Using a false source IP address is called IP spoofing An example of a problem caused by lack of authentication Has far-reaching security consequences

24. TCP • A layer 4 (transport) protocol • Thus, concerned with end-to-end issues • In TCP, those issues are: • Connection-oriented transport • Reliable, in-order packet delivery • Congestion and flow control

25. TCP and IP Designed to work with IP Meaning a TCP packet is encapsulated in an IP packet Practical use of TCP generally assumes it can find all information in IP header So TCP header doesn’t duplicate that stuff

26. TCP/IP Encapsulation A TCP/IP packet The IP header The TCP header The payload

27. The TCP Header Specifies which program receives the message Specifies which program sent the message Ack of last sequence number received Order of packet within this TCP session Size of TCP header Receiver flow control information Checksum of TCP header For rapid handling of some parts of the packet

28. Security Implications of TCP • Much broader than for IP • TCP is a much more complex protocol • Lots of things can go wrong • And sometimes attackers want them to go wrong • We’ll discuss several of these throughout the class