Review of TCP/IP Internetworking

Review of TCP/IP Internetworking Chapter 3

Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path Path Frame Server Host Client Host Trunk Link Access Link Server Host Mobile Client Host

Frame Organization Frame Trailer Data Field Header Other Header Field Destination Address Field Message Structure

1 2 3 4 5 6 Station A Station B Station C Station D Switching Decision Switch receives A frame, sends It back out Based on Destination Address Switch Frame with Station C In the destination Address field

Figure 3-1: Internet • An internet is two or more individual switched networks connected by routers Switched Network 1 Router Switched Network 3 Switched Network 2

Figure 1.11: An Internet Multiple Networks Connected by Routers Path of a Packet is its Route Single Network Routers Packet Route Single Network

Figure 1.13: The Internet The global Internet has thousands of networks Network Webserver Software Browser Packet Packet Router Route Router Router Packet

Figure 3-6: Frames and Packets Frame 1 Carrying Packet in Network 1 Packet Router A Frame 2 Carrying Packet in Network 2 Switch Client PC Frame 3 Carrying Packet in Network 3 Packet Switch Router B Server

Figure 1.12: Frames and Packets • Like passing a shipment (the packet) from a truck (frame) to an airplane (frame) at an airport. Receiver Shipper Same Shipment Airport Airport Truck Truck Airplane

Figure 3-2: TCP/IP Standards (Study Figure) • Origins • Defense Advanced Research Projects Agency (DARPA) created the ARPANET • An internet connects multiple individual networks • Global Internet is capitalized • Internet Engineering Task Force (IETF) • Most IETF documents are requests for comments (RFCs) • Internet Official Protocol Standards: List of RFCs that are official standards

Figure 3-2: TCP/IP Standards (Study Figure) • Hybrid TCP/IP-OSI Architecture (Figure 3-3) • Combines TCP/IP standards at layers 3-5 with • OSI standards at layers 1-2 TCP/IP OSI Hybrid TCP/IP-OSI Application Application Application Presentation Session Transport Transport Transport Internet Network Internet Subnet Access: Use OSI Standards Here Data Link Data Link Physical Physical

Figure 3-2: TCP/IP Standards (Study Figure) • OSI Layers • Physical (Layer 1): defines electrical signaling and media between adjacent devices • Data link (Layer 2): control of a frame through a single network, across multiple switches Physical Link Frame Switched Network 1 Data Link

Figure 3-2: TCP/IP Standards • Internet Layer • Governs the transmission of a packet across an entire internet. Path of the packet is its route Packet Switched Network 1 Router Switched Network 3 Route Switched Network 2

Figure 3-2: TCP/IP Standards (Study Figure) • Frames and Packets • Frames are messages at the data link layer • Packets are messages at the internet layer • Packets are carried (encapsulated) in frames • There is only a single packet that is delivered from source to destination host • This packet is carried in a separate frame in each network

Router 1 Router 2 Router 3 Figure 3-7: Internet and Transport Layers Transport Layer End-to-End (Host-to-Host) TCP is Connection-Oriented, Reliable UDP is Connectionless Unreliable Client PC Server Internet Layer (Usually IP) Hop-by-Hop (Host-Router or Router-Router) Connectionless, Unreliable

Figure 3-2: TCP/IP Standards (Study Figure) • Internet and Transport Layers • Purposes • Internet layer governs hop-by-hop transmission between routers to achieve end-to-end delivery • Transport layer is end-to-end (host-to-host) protocol involving only the two hosts • Internet Protocol (IP) • IP at the internet layer is unreliable—does not correct errors in each hop between routers • This is good: reduces the work each router along the route must do

Figure 3-2: TCP/IP Standards (Study Figure) • Transport Layer Standards • Transmission Control Protocol (TCP) • Reliable and connection-oriented service at the transport layer • Corrects errors • User Datagram Protocol (UDP) • Unreliable and connectionless service at the transport layer • Lightweight protocol good when catching errors is not important

Figure 3-8: HTML and HTTP at the Application Layer Hypertext Transfer Protocol (HTTP) Requests and Responses Webserver 60.168.47.47 Client PC with Browser 123.34.150.37 Hypertext Markup Language (HTML) Document or Other File (jpeg, etc.)

Figure 3-2: TCP/IP Standards (Study Figure) • Application Layer • To govern communication between application programs, which may be written by different vendors • Document transfer versus document format standards • HTTP / HTML for WWW service • SMTP / RFC 822 (or RFC 2822) in e-mail • Many application standards exist because there are many applications

Figure 3-3: TCP/IP and OSI Architectures: Recap TCP/IP OSI Hybrid TCP/IP-OSI Application Application Application Presentation Session Transport Transport Transport Internet Network Internet Subnet Access: Use OSI Standards Here Data Link Data Link Physical Physical Note: The Hybrid TCP/IP-OSI Architecture is used on the Internet and dominates internal corporate networks.

Figure 3-5: IP Packet 0100 IP Version 4 Packet Bit 0 Bit 31 Version (4 bits) Header Length (4 bits) Diff-Serv (8 bits) Total Length (16 bits) Identification (16 bits) Flags Fragment Offset (13 bits) Time to Live (8 bits) Protocol (8 bits) 1=ICMP, 6=TCP, 17=TCP Header Checksum (16 bits) Source IP Address (32 bits) Destination IP Address (32 bits) Options (if any) Padding Data Field

Figure 3-5: IP Packet • Version • Has value of four (0100) • Time to Live (TTL) • Prevents the endless circulation of mis-addressed packets • Value is set by sender • Decremented by one by each router along the way • If reaches zero, router throws packet away

Figure 3-5: IP Packet • Protocol Field • Identifies contents of data field • 1 = ICMP • 6 = TCP • 17 =UDP IP Data Field ICMP Message IP Header Protocol=1 IP Data Field TCP Segment IP Header Protocol=6 IP Data Field UDP Datagram IP Header Protocol=17

Figure 3-5: IP Packet • Header checksum to check for errors in the header only • Faster than checking the whole packet • Stops bad headers from causing problems • IP Version 6 drops eve this checking • Address Fields • 32 bits long, of course • Options field(s) give optional parameters • Data field contains the payload of the packet.

Figure 3-9: Layer Cooperation Through Encapsulation on the Source Host Application Process HTTP Message Encapsulation of HTTP message in data field of a TCP segment Transport Process HTTP Message TCP Hdr Encapsulation of TCP segment in data field of an IP packet Internet Process HTTP Message TCP Hdr IP Hdr

HTTP Message TCP Hdr IP Hdr DL Trlr HTTP Message TCP Hdr IP Hdr DL Hdr Figure 3-9: Layer Cooperation Through Encapsulation on the Source Host Internet Process Encapsulation of IP packet in data field of a frame Data Link Process Physical Process Converts Bits of Frame into Signals

Figure 3-9: Layer Cooperation Through Encapsulation on the Source Host Note: The following is the final frame for supervisory TCP segments: DL Trlr TCP Hdr IP Hdr DL Hdr

Figure 3-10: Layer Cooperation Through Decapsulation on the Destination Host Application Process HTTP Message Decapsulation of HTTP message from data field of a TCP segment Transport Process HTTP Message TCP Hdr Decapsulation of TCP segment from data field of an IP packet Internet Process HTTP Message TCP Hdr IP Hdr

HTTP Message TCP Hdr IP Hdr DL Hdr HTTP Message TCP Hdr IP Hdr DL Hdr Figure 3-10: Layer Cooperation Through Decapsulation on the Destination Host Internet Process Decapsulation of IP packet from data field of a frame Data Link Process Data Link Process Converts Signals into the Bits of the Frame

Figure 3-11: Vertical Communication on Router R1 A Internet Layer Process Router R1 Packet Port 1 DL Port 2 DL Port 3 DL Port 4 DL Decapsulation Frame PHY PHY PHY PHY • Notes: • Router R1 receives frame from Switch X2 in Port 1. • Port 1 DL process decapsulates packet. • Port 1 DL process passes packet to internet process. Switch X2

Figure 3-11: Vertical Communication on Router R1 B Internet Layer Process Router R1 Packet Port 1 DL Port 2 DL Port 3 DL Port 4 DL Encapsulation Frame PHY PHY PHY PHY • Internet process sends packet out on Port 4. • DL Process on Port 4 encapsulates packet in a PPP frame. • DL process passes frame to Port 4 PHY. Router 2

Packet Packet Packet Figure 3-12: Site Connection to an ISP Internet Backbone 1. Frame for This Data Link Site Network 2. Packet Carried in ISP Carrier Frame ISP Border Firewall 4. Data Link Between Site and ISP (Difficult to Attack) 3. Packet Carried in Site Frame ISP Router 5. Normally, Only the Arriving Packet is Dangerous—Not the Frame Fields

Figure 3-13: Internet Protocol (IP) • Basic Characteristics • There were already single networks, and many more would come in the future • Developers needed to make a few assumptions about underlying networks • So they kept IP simple

Figure 3-13: Internet Protocol (IP) • Connection-Oriented Service and Connectionless Service • Connection-oriented services have distinct starts and closes (telephone calls) • Connectionless services merely send messages (postal letters) • IP is connectionless

IP Packet PC Internet Process First Router Internet Process IP Packet Connectionless Packets Sent in Isolation Like Postal Letters Unreliable No Error Correction Discarded by Receiver if Error is Detected Leaves Error Correction to Transport Layer Reduces the Cost of Routers

Figure 3-13: Internet Protocol (IP)(Study Figure) • IP is Unreliable (Checks for Errors but does not Correct Errors) (Figure 3-14) • Not doing error correction at each hop between switches reduces switch work and so switch cost • Does not even guarantee packets will arrive in order

Figure 3-13: Internet Protocol (IP)(Study Figure) • Hierarchical IP Addresses • Postal addresses are hierarchical (state, city, postal zone, specific address) • Most post offices have to look only at state and city • Only the final post offices have to be concerned with specific addresses

Figure 3-15: Hierarchical IP Address Network Part (not always 16 bits) Subnet Part (not always 8 bits) Host Part (not always 8 bits) Total always is 32 bits. 128.171.17.13 The Internet UH Network (128.171) CBA Subnet (17) Host 13 126.171.17.13

Figure 3-13: Internet Protocol (IP)(Study Figure) • Hierarchical IP Addresses • 32-bit IP addresses are hierarchical (Figure 3-15) • Network part tells what network host is on • Subnet part tells what subnet host is on within the network • Host part specifies the host on its subnet • Routers have to look only at network or subnet parts, except for the router that delivers the packet to the destination host

Figure 3-13: Internet Protocol (IP)(Study Figure) • Hierarchical IP Addresses • 32-bit IP addresses are hierarchical • Total is 32 bits; part sizes vary • Network mask tells you the size of the network part (Figure 3-16) • Subnet mask tells you the length of the network plus subnet parts combined

Figure 3-16: IP Address Masking with Network and Subnet Masks

Figure 3-13: Internet Protocol (IP) • IP Addresses and Security • IP address spoofing: Sending a message with a false IP address (Figure 3-17) • Gives sender anonymity so that attacker cannot be identified • Can exploit trust between hosts if spoofed IP address is that of a host the victim host trusts

Figure 3-17: IP Address Spoofing 1. Trust Relationship 3. Server Accepts Attack Packet Trusted Server 60.168.4.6 Victim Server 60.168.47.47 2. Attack Packet Spoofed Source IP Address 60.168.4.6 Attacker’s Identity is Not Revealed Attacker’s Client PC 1.34.150.37

Figure 3-13: Internet Protocol (IP)(Study Figure) • IP Addresses and Security • LAND attack: send victim a packet with victim’s IP address in both source and destination address fields and the same port number for the source and destination (Figure 3-18). In 1997, many computers, switches, routers, and even printers, crashed when they received such a packet.

Figure 3-18: LAND Attack Based on IP Address Spoofing From: 60.168.47.47:23 To: 60.168.47.47:23 Attacker 1.34.150.37 Victim 60.168.47.47 Port 23 Open Crashes Source and Destination IP Addresses are the Same Source and Destination Port Numbers are the Same

Figure 3-13: Internet Protocol (IP)(Study Figure) • Other IP Header Fields • Protocol field: Identifies content of IP data field • Firewalls need this information to know how to process the packet • Time-to-Live field • Each router decrements the TTL value by one • Router decrementing TTL field to zero discards the packet

Figure 3-13: Internet Protocol (IP)(Study Figure) • Other IP Header Fields • Time-to-Live field • Router also sends an error advisement message to the sender • The packet containing this message reveals the sender’s IP address to the attacker • Traceroute uses TTL to map the route to a host (Figure 3-19) • Tracert on Windows machines

Figure 3-19: Tracert Program in Windows

Figure 3-13: Internet Protocol (IP)(Study Figure) • Other IP Header Fields • Header Length field and Options • With no options, Header Length is 5 • Expressed in units of 32 bits • So, 20 bytes • Many options are dangerous • So if Header Length is More Than 5, be Suspicious • Some firms drop all packets with options

Review of TCP/IP Internetworking