CyberSecurity2_Module 9 & 10-My questions

• • identifying the proper application for each communication stream
• • tracking the individual communication between applications on the source and destination hosts
• • Segmenting data at the source and reassembling that data at the destination

• • Transmission Control Protocol (TCP)
• • User Datagram Protocol (UDP)

• The transport layer has no knowledge of the destination host type, the type of media over which the data must travel, the path taken by the data, the congestion on a link, or the size of the network.

• • Tracking Individual Conversations
• ○ tracking the individual communication between applications on the source and destination hosts
• • Segmenting Data and Reassembling Segments
• ○ Segmenting data at the source and reassembling that data at the destination
• • Add Header Information
• • Identifying the Applications
• ○ identifying the proper application for each communication stream
• • Conversation Multiplexing

• • IP is concerned only with the structure, addressing, and routing of packets.
• • IP does not specify how the delivery or transportation of the packets takes place.
• • IP is concerned only with the structure, addressing, and routing of packets, from original sender to final destination.
• • IP is not responsible for guaranteeing delivery or determining whether a connection between the sender and receiver needs to be established.

• • Number and track data segments transmitted to a specific host from a specific application
• • Acknowledge received data
• • Retransmit any unacknowledged data after a certain amount of time
• • Sequence data that might arrive in wrong order
• • Send data at an efficient rate that is acceptable by the receiver

Because in order to maintain the state of a conversation and track the information, TCP must first establish a connection between the sender and the receiver.

20 bytes/ 160 bits

20 bytes/160 bits

• • Source Port
• • Destination Port
• • Sequence Number
• • Acknowledgment Number
• • Header Length
• • Reserved
• • Control bits
• • Window size
• • Checksum
• • Urgent

• Source Port - A 16-bit field used to identify the source application by port number.

• Destination Port- A 16-bit field used to identify the destination application by port number.

• Reserved- A 6-bit field that is reserved for future use.

• Acknowledgment Number- A 32-bit field used to indicate that data has been received and the next byte expected from the source.

• Sequence Number-A 32-bit field used for data reassembly purposes.

• Header Length- A 4-bit field known as ʺdata offsetʺ that indicates the length of the TCP segment header.

• Control bits- A 6-bit field that includes bit codes, or flags, which indicate the purpose and function of the TCP segment.

• Window size-A 16-bit field used to indicate the number of bytes that can be accepted at one time.

• Checksum- A 16-bit field used for error checking of the segment header and data.

• Urgent- A 16-bit field used to indicate if the contained data is urgent.

• • FTP
• • HTTP
• • SMTP
• • SSH

Dose not provide reliability and flow control, which means it requires fewer header fields.

UDP datagrams is faster than TCP segments b/c it requires less overhead and data checking than TCP and UDP does not have to manage reliability and flow control and UDP does not track information sent or received between the client and server like TCP does.

UDP is an connectionless protocol, and TCP is an connection-oriented protocol

because there is no acknowledgment that the data is received at the destination.

Reliability must be handled by the application

• • Data is reconstructed in the order that it is received.
• • Any segments that are lost are not resent.
• • There is no session establishment.
• • The sending is not informed about resource availability.

• • Source Port its an 16 bit field
• • Destination Port its an 16 bit field
• • Length its an 16 bit field
• • Checksum its an 16 bit field

• Source Port - A 16-bit field used to identify the source application by port number.

• Destination Port- A 16-bit field used to identify the destination application by port number.

• Length- A 16-bit field that indicates the length of the UDP datagram header.

• Checksum- A 16-bit field used

• • DHCP
• • DNS
• • SNMP
• • TFTP
• • VolP
• • Video Conferencing

• Port Number Protocol Application
• 20 TCP File Transfer Protocol (FTP) – Data
• 21 TCP File Transfer Protocol (FTP) – Control
• 22 TCP Secure Shell (SSH)
• 23 TCP Telnet
• 25 TCP Simple Mail Transfer Protocol (SMTP)
• 53 UDP, TCP Domain Name Service (DNS)
• 67 UDP Dynamic Host Configuration Protocol (DHCP) – Server
• 68 UDP Dynamic Host Configuration Protocol – Client
• 69 UDP Trivial File Transfer Protocol (TFTP)
• 80 TCP Hypertext Transfer Protocol (HTTP)
• 110 TCP Post Office Protocol version 3 (POP3)
• 143 TCP Internet Message Access Protocol (IMAP)
• 161 UDP Simple Network Management Protocol (SNMP)
• 443 TCP Hypertext Transfer Protocol Secure (HTTPS)

• • The combination of the source IP address and source port number, or the destination IP address and destination port number
• • Example: 192.168.1.5:1099 or 192.168.1.7:80

An sockets pair

• What is a 3-way handshake?
• • It establishes an connection between two hosts.
• • the three-way handshake validates that the destination host is available to communicate.

• Step 1. SYN - The initiating client requests a client-to-server communication session with the server.

• Step 2. ACK and SYN - The server acknowledges the client-to-server communication session and requests a server-to-client communication session.

• Step 3. ACK - The initiating client acknowledges the server-to-client communication session.

The Finish (FIN) control flag must be set

• Step 1. FIN -When the client has no more data to send in the stream, it sends a segment with the FIN flag set.

• Step 2. ACK -The server sends an ACK to acknowledge the receipt of the FIN to terminate the session from client to server.

• Step 3. FIN -The server sends a FIN to the client to terminate the server-to-client session.

• Step 4. ACK -The client responds with an ACK to acknowledge the FIN from the server.

• • It establishes that the destination device is present on the network.
• • It verifies that the destination device has an active service and is accepting requests on the destination port number that the initiating client intends to use.
• • It informs the destination device that the source client intends to establish a communication session on that port number.

• • URG - Urgent pointer field significant
• • ACK - Acknowledgment flag used in connection establishment and session termination
• • PSH - Push function
• • RST - Reset the connection when an error or timeout occurs
• • SYN - Synchronize sequence numbers used in connection establishment
• • FIN - No more data from sender and used in session termination

is the number of the next expected byte

the number of bytes that can be sent before expecting an acknowledgment.

is the number of bytes that the destination device of a TCP session can accept and process at one time.

The initial window size is agreed upon when the TCP session is established during the three-way handshake.

Maximum Segment Size

The MSS is part of the options field in the TCP header that specifies the largest amount of data, in bytes, that a device can receive in a single TCP segment.

No

• • by subtracting the IP and TCP headers from the Ethernet maximum transmission unit (MTU).
• • MSS =MTU - IP -TCP

Window size

by adjusting the rate of data flow between source and destination for a given session.

• TCP Reliability – Sequence Numbers and Acknowledgements
• TCP Reliability - Data Loss and Retransmission
• TCP Flow Control - Window Size and Acknowledgments:

• • Dynamic Host Configuration Protocol
• • Dynamic Host Configuration Protocol for IPv4.
• • Dynamic Host Configuration Protocol for IPv6

It automates the assignment of IPv4 addresses, subnet masks, gateways, and other IPv4 networking parameters.

general purpose hosts, such as end user devices.

Is a range of available addresses that the DHCP server can chooses from.

It’s the amount of time that an IP address is assigned/leased to a host.

When the lease period expires or the DHCP server gets a DHCPRELEASE message the address is returned to the DHCP pool for reuse.

Its usually located on a local, dedicated PC-based server.

the DHCP server is usually located on the local router that connects the home network to the ISP.

Static addressing is used for network devices, such as gateway routers, switches, servers, and printers.

• • DHCPv6 does not proved gateway address.
• • This can only be obtained dynamically from the Router Advertisement message of the router.

• Step 1: the client broadcasts a DHCP discover (DHCPDISCOVER) message to identify any available DHCP servers on the network.

• Step 2: A DHCP server replies with a DHCP offer (DHCPOFFER) message, which offers a lease to the client.

• Step 3: the host sends a DHCP request (DHCPREQUEST) message back to the server that identifies the explicit server and lease offer that the client is accepting.

• Step 4: the DHPC server returns a DHCP acknowledgment (DHCPACK) message the host that acknowledges to the client that the lease has been finalized

• The offer message contains the IPv4 address and subnet mask to be assigned, the IPv4 address of the DNS server, and the IPv4 address of the default gateway, and the duration time of the lease.

The client may receive multiple DHCPOFFER messages if there is more than one DHCP server on the local network.

• DHCPv4: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK, DHCPNAK.

• DHCPv6: SOLICIT, ADVERTISE, INFORMATION REQUEST, and REPLY.

• NOTE: that DHCPACK stans for DHCP acknowledged, and DHCPNAC stand for DHCP Not acknowledged

within the UDP transport protocol.

Specifies the general type of message. A value of 1 indicates a request message; a value of 2 is a reply message.

Identifies the type of hardware used in the network. For example, 1 is Ethernet, 15 is Frame Relay, and 20 is a serial line. These are the same codes used in ARP messages.

Controls the forwarding of messages. Set to 0 by a client before transmitting a request.

Used by the client to match the request with replies received from DHCPv4 servers.

Identifies the number of seconds elapsed since a client began attempting to acquire or renew a lease. Used by DHCPv4 servers to prioritize replies when multiple client requests are outstanding.

Used by a client that does not know its IPv4 address when it sends a request. Only one of the 16 bits is used, which is the broadcast flag. A value of 1 in this field tells the DHCPv4 server or relay agent receiving the request that the reply should be sent as a broadcast.

Used by a client during lease renewal when the address of the client is valid and usable, not during the process of acquiring an address. The client puts its own IPv4 address in this field if and only if it has a valid IPv4 address while in the bound state; otherwise, it sets the field to 0.

Used by the server to assign an IPv4 address to the client.

Used by the server to identify the address of the server that the client should use for the next step in the bootstrap process, which may or may not be the server sending this reply. The sending server always includes its own IPv4 address in a special field called the Server Identifier DHCPv4 option.

Routes DHCPv4 messages when DHCPv4 relay agents are involved. The gateway address facilitates communications of DHCPv4 requests and replies between the client and a server that are on different subnets or networks.

Specifies the physical layer of the client.

Used by the server sending a DHCPOFFER or DHCPACK message. The server may optionally put its name in this field. This can be a simple text nickname or a DNS domain name, such as dhcpserver.netacad.net.

Optionally used by a client to request a particular type of boot file in a DHCPDISCOVER message. Used by a server in a DHCPOFFER to fully specify a boot file directory and filename.

Holds DHCP options, including several parameters required for basic DHCP operation. This field is variable in length. Both client and server may use this field.

Domain Name System

A DNS client that sends DNS messages to obtain information about the requested domain name space.

The action taken when a DNS server is asked to query on behalf of a DNS resolver.

A DNS server that responds to query messages with information stored in Resource Records (RRs) for a domain name space stored on the server.

A DNS server that recursively queries for the information asked in the DNS query.

A Fully Qualified Domain Name is the absolute name of a device within the distributed DNS database.

A Resource Record is a format used in DNS messages that is composed of the following fields: NAME, TYPE, CLASS, TTL, RDLENGTH, and RDATA.

A database that contains information about the domain name space stored on an authoritative server.

• Step 1: The user types an FQDN into a browser application Address field.
• Step 2: A DNS query is sent to the designated DNS server for the client computer.
• Step 3: The DNS server matches the FQDN with its IP address.
• Step 4: The DNS query response is sent back to the client with the IP address for the FQDN.
• Step 5: The client computer uses the IP address to make requests of the server.

53

• • A - An end device IPv4 address
• • NS - An authoritative name server
• • AAAA - An end device IPv6 address (pronounced quad-A)
• • MX - A mail exchange record

ipconfig /displaydns

• • All types of client queries and server responses
• • Error messages
• • The transfer of resource records between servers

The question for the server. It contains the domain name to be resolved, the class of domain, and the query type.

The DNS resource record, or Resource Record RR, for the query including the resolved IP address depending on the RR type.

Contains the Resource Record RRs for the domain authority.

Relevant to query responses only. Consists of Resource Record RRs that hold additional information that will make query resolution more efficient

WHOIS is a TCP-based protocol that is used to identify the owners of internet domains through the DNS system.

NAT provides the translation of private addresses to public addresses, it also conserve public IPv4 addresses.

A NAT router typically operates at the border of a stub network.

It is one or more networks with a single connection to its neighboring network, one way in and one way out of the network.

Port Address Translation (PAT)

PAT maps multiple private IPv4 addresses to a single public IPv4 address or a few addresses. PAT is also known as NAT overload

allow for data transfers between a client and a server.

one connection for commands and replies, the other for the actual file transfer

SSH FTP

• Trivial File Transfer Protocol (TFTP)

• TFTP is a simplified file transfer protocol that uses well-known UDP port number 69.
• is popular for non-critical file transfer applications.

Server Message Block (SMB)

• • It is a client/server file sharing protocol that describes the structure of shared network resources such as directories, files, printers, and serial ports.
• • Or SMB is a client/server, request-response protocol. Servers can make their own resources available to clients on the network.

Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP), and IMAP.

• The Email client C1 creates an email and presses send. The email get sent to C1's mail server(A), mail server (A) sends the email to C2's mail server(B). Email client (C2) retrieves email using one of the two application layer protocols: POP or IMAP.
• HINT: An email client does not communicate directly with another email client when sending email. Instead, both clients rely on the mail server to transport messages.

• What is POP3?
• POP3 is used by an application to retrieve mail from a mail server.
• With POP3, mail is downloaded from the server to the client and then deleted on the server,

• IMAP is another protocol that is used by an application to retrieve mail from a mail server.
• Unlike POP3, when the user connects to an IMAP-capable server, copies of the messages are downloaded to the client application. The original messages are kept on the server until manually deleted. Users view copies of the messages in their email client software.

• • GET - A client request for data. A client (web browser) sends the GET message to the web server to request HTML pages, as shown in the figure.
• • POST - Submits data to be processed by a resource.
• • PUT - Uploads resources or content to the web server such as an image.
• • DELETE - Deletes the resource specified.
• • OPTIONS - Returns the HTTP methods that the server supports.
• • CONNECT - Requests that an HTTP proxy server forwards the HTTP TCP session to the desired destination.

inform the host application of the outcome of client requests to the server.

• • 1xx - Informational
• • 2xx - Success
• • 3xx - Redirection
• • 4xx - Client Error
• • 5xx - Server Error

• Continue
• The client should continue with the request. The Server has verified that the request can be fulfilled.
• What does HTTP statues code 200 stand for and what is its meaning?
• OK
• The request completed successfully.

• Accepted
• The request has been accepted for processing, but processing is not completed.

• Forbidden
• The request is understood by the server, but the resource will not be fulfilled. This is possibly because the requester is not authorized to view the resource.

• Not Found
• The server could not find the requested resource. This can be caused by an out-of-date or incorrect URL.

67