TCP/IP Fundamentals

1 7/25/991 TCP/IP FundamentalsTCP/IP FundamentalsEdmund LamIT Audit ManagerUniversity of we will discuss:What we will discuss: TCP/IP related toOSI Layers History of TCP/IPand what is it? TCP/IP Structure IP Address Structure IP AddressNumbering IP AddressSubnetting IP Routing Two Types ofRouters IP SecurityConcerns IPv6 High LevelDiscussion7/25/993 What we will not Discuss: Auditing of TCP/IP Network Vulnerability Internet Security Network Troubleshooting7/25/994 InternetProxyServerProxyServerM ail S erverServerW orkstationW orkstationW orkstationW orkstationM ail S erverServerW orkstationW orkstationW orkstationW orkstationFirewallFirewallFirewallE m ail, through Port 25 ofProxy Server, is passedthrough through the Firewallinto the E m ail S erver7/25/995 Open Systems Interconnections(OSI)Open Systems Interconnections(OSI)Reference ModelReference Model Physical Layer - Physical Connections betweenComputers and the network.

2 Converts bits intovoltages or light pulse. This defines topology(Connected through repeaters) Data Link -- Defines Protocol that Computers mustfollow. Token Ring, Ethernet (Connected withBridges) Network Layer -- Defines how the small packets ofdata are routed and relayed. (Connected withRouters)7/25/996 Open Systems Interconnections(OSI)Open Systems Interconnections(OSI)Reference Model (Cont d)Reference Model (Cont d) Transport -- Defines how to address the physicallocations/devices on the network. Presentation -- Defines how applications can enterthe network. This layers allows devices to bereferenced as name rather than addresses. Application -- Interfaces with users, gets informationfrom databases, and transfer whole files. (Connectedthrough Gateways)7/25/997 Application(Advise)Presentation(Person)S ession(Sales)Transport(Trust)Network(Not )Data Link(Do)Physical(Please)Application(Advi se)Presentation(Person)Session(Sales)Tra nsport(Trust)Network(Not)Data Link(Do)Physical(Please)OSI LayersOpen System InterconnectionsOpen System InterconnectionsReference Model:Reference Model:7/25/998 Connectors:Connectors.

3 Physical -- 4 pairs, Fiber Optics, Coax, NetworkInterface Card Datalink -- Token Ring, Ethernet Network -- IPX, IP Transport -- TCP, UDP, NetBEUI, SPX Session -- FTP, Telnet, NCP Presentation -- SMB, NCP Applications -- Email, Appletalk, NFS7/25/999 Email Application(Advise)Presentation(Person)S ession(Sales)Transport(Trust)Network(Not )D ata Link(Do)Physical(Please)Email Application(Advise)Presentation(Person)S ession(Sales)Transport(Trust)Network(Not )D ata Link(Do)Physical(Please)OSI LayersLocalConnectivityInternet workConnectivityLocal NetworkC onnectivityApplicationInteroperationFunc tions7/25/9910 OSI Reference Model TCP/IP Reference Model ApplicationApplicationPresentationNetBIO SS essionWindows SocketsNetBIOS overTCP/IPTDI InterfaceTransportTCPUDPT ransportNetworkIPInternetNDIS InterfaceData LinkNIC DriversPhysicalEthernetFDDIN etworkAdapterPPPF rame RelayNetworkInterface7/25/99117/25/9912 Three Services that are important:Three Services that are important.

4 DNS -- Domain Name Server (This server providesthe translation between IP address and DomainName to ) WINS -- Windows Internet Name Service (Microsoftonly device to resolve name resolution) DHCP -- Dynamic Host Configuration Protocol(Aservice that enables the assignment of dynamicTCP/IP network addresses, based on a specifiedpool of available addresses)7/25/9913 TCP/IPTCP/IPDefinition:An industry standard suite ofprotocols providing communicationin a heterogeneous environment. Itprovides a routable, enterprisenetworking protocol and access tothe Internet and its resources7/25/9914 TCP/IP HistoryTCP/IP History DOE commissioned APANET in 1969 First Telnet specification(RFC 318) in 1972 File Transfer Protocol(FTP-RFC 454)introduced in1973 TCP specified in 1974 IP standard(RFC -791) published 1981 Defense Communications Agencies establishedTCP/IP as a suite in 1982 Domain Name System (DNS) introduced in 19847/25/9915 TCP (Transmission Control Protocol)TCP (Transmission Control Protocol) Connection - oriented Session is established before exchangingdata Reliable Delivery Sequence numbers Acknowledgements(ACKs) Byte-Stream Communications Uses Port Numbers as Endpoints toCommunicate7/25/9916 Some of the Well Know TCP Ports.

5 Some of the Well Know TCP Ports:A TCP port provides a specific location for delivery of TCPS egments. Port Numbers below 1024 are well-known, and areassigned by Internet Assigned Numbers Authority (IANA) Refer toRFC Port Number Description20 FTP (Data Channel)21 FTP (Control Channel)23 Telnet25 Email80 HyperText TransferProtocol(HTTP) used for the WWW139 NetBIOS Session Service7/25/9917 TCP Packet Structure:TCP Packet Structure:TCP Source Port - Port of sending Port Port of End Point #. Sequence of Bytes transmitted in asegment, required to verify all bytes are Number The sequence number of thebyte the local host expects to receive Length Length of the TCP for Future Specified what content is in the How much space is currently available in theTCP Verify that the Header is not Pointer When urgent data is being Packet StructureIP Packet Structure Source IP Address Destination IP Address Protocol (Whether to pass up to TCP or UCP) Checksum (Verify that the packet arrivesintact) Time to Live(TTL) (Designates the number ofsecond the datagram is allowed to stay in thenetwork before it is discarded -- NT defaultsat 128 Seconds7/25/9919 Who has a UNIQUE IP addresses:Who has a UNIQUE IP addresses.)

6 Each Server, workstation,printer, router and otherInternet enabled devices7/25/9920IP FormatIP FormatNetwork IDHost IDEach IP address is a 32 bits long, and is composed of 4 8-bit fields, calledOctets. Each Octet represents a decimal number in the range of 0-255. Thisformat is called dotted decimal Binary number as follow: Dotted Decimal notation: IP Address from Binary toConverting IP Address from Binary toDecimalDecimal111111111286432168421 Binary Code Bit Values Decimal Value 00000000000000000111000000112+1300000111 4+2+17000011118+4+2+1150001111116+8+4+2+ 1310011111132+16+8+4+2+1630111111164+32+ 16+8+4+2+112711111111128+64+32+16+4+2+12 557/25/9922 Address Classes:Address Classes:Network IDHost ID0 Class A Address Range 0 . H . H . HNetwork IDHost ID10 Class B Address Range 128 N.

7 N . H . HNetwork IDHost ID110 Class C Address Range 192 N . N . N . H7/25/9923 Possible Values for Each ClassPossible Values for Each ClassNumber ofNetworksNumber of Hostsper NetworkRange of Network Ids(First Octet)Class A12616,777,2141 126(Note 1)Class B16,38465,534128-191(Note 2)Class C2,097,152254192 223 (Note 3)Note 1 First Digit in first Octet is a 0 , and 127 is reserved for 2 First two Digits in first Octet are 10 .Note 3 First three Digits in the first Octet are 110 7/25/9924 Other IP Address Rules:Other IP Address Rules: Net ID cannot be 127 Net ID and Host ID cannot be 255(Allbits set to 1), it is reserved for broadcast cannot be Network ID and Host ID cannot be 0 (Allbits set to 0), it means local networkonly cannot be Host ID Must be unique to the Network cannot have two networks on the samephysical wire7/25/9925 Typical Network IP NumberingTypical Network IP orkstationW orkstationServerW orkstationLaptop com puterW orkstationW orkstationServerW orkstationLaptop com puterROUTERROUTERIN TE R N E Mask:Subnet Mask: A 32 bit address used to.

8 Block out a portion of the IP address todistinguish the network ID from the host ID Specify whether the destination host s IPaddress is located on a local or remotenetwork7/25/9927 Default Subnet Mask:AddressClassBits Used for Subnet MaskNetworkPrefixDottedDecimalNotationCl ass A111111110000000000000000 00000000 B111111111111111100000000 00000000 C111111111111111111111111 00000000 Using a Class B Subnet Mask: IP Address: Subnet Mask: Network ID: Host ID: All bits that corresponds to the Net ID are 1s All bits that corresponds to the Host ID are 0s7/25/9928 Determining the Network IP Address:Determining the Network IP Address: Use the logic of the AND Gate to calculate thefinal result to identify the Net ID 1 and 1 is a 1 1 and 0 is a 0 0 and 0 is a 0 Network ID -- Host ID - Subnet?

9 Why Subnet? As Class A, B, and C IP Addresses are not available,this allows a business/organization to separatenetworks into different sub-networks as it grows Overcome limitations of current technologies, such asexceeding the maximum number of hosts persegments Reduce network congestion as traffic grows within oroutside Process:Subnetting Process: Determine the number of Required NetworkIds Determine the number of Required Host Idsper Subnet Define One Subnet Mask Based onRequirements Define a Unique Subnet ID for Each PhysicalSegment Based on the Subnet Mask Define Valid Hosts Ids for Each SubnetBased on the Subnet ID7/25/9931 Determine the Number ofDetermine the Number ofNetworksNetworks One for each subnet One for each wide-area networkconnections Subnetting allows NetworkAdministrator to set up more networksthan the number of Class A/B/C IPaddresses the Number of Host IdsDetermines the Number of Host Idsper Subnetper Subnet One required for each TCP/IP host One required for each router interface By limiting the number of Hosts ID oneach subnet -- especially for smallernetworks.

10 The Network Administratorcan implement more networks within theorganizations to enhance traffic flow7/25/9933 How Subnet Mask Work?How Subnet Mask Work?Network IDSubnet IDHost IDFor a normal Class B AddressNumber of Network 1 Number of Subnets 255 (0 254)Total number of Hosts 65280 (255 Subnets X 256/Subnet)7/25/9934 Defining Subnet Mask from a PartialDefining Subnet Mask from a PartialOctetOctetNetwork IDSubnetIDHostIDHost IDFor a normal Class B AddressSubnet Mask : or/21 (2^7+2^6+2^5+2^4+2^3 = 248)Number of Network 1 Number of Subnets 32 (2^4+2^3+2^2+2^1+1)All Zeros and All Ones cannot be used as a Subnet or Host IDsTotal number of Hosts 65472 (32 Subnets X 2046/Subnet)7/25/9935 Subnet Conversion Tables:Subnet Conversion Tables:(Class A)(Class A)Number of Subnets No.