Ethical Hacking Ch. 2

Bus

straight line that all systems connect to

Star

all devices cable back to a central networking device

Ring

devices appear to be connected in a circle, though this may only be an appearance rather than how they are connected physically

Mesh

systems are connected directly to one another, as needed (the Internet is a mesh network)

Hybrid

a star-bus hybrid is common where multiple stars are connected by a bus

OSI Model

Seven layers – physical, data link, network, transport, session, presentation, application

What does the Physical Layer include?

• Cables

• Switches

• Routers

• Network interface cards

• Wireless adapters

• Protocol data unit -- symbol

What happens in the Data Link Layer

• Where data is converted to signals to send out on the wire

• Addressing is media access control (MAC)

• All local communications happen at layer 2 – system to system is always done using the MAC address

• Ethernet has elements in this layer

• Protocol data unit is frame

What happens at the network layer?

• Networks are defined at this layer

• Communication is no longer local – network addresses enable transmission from one location to another

• Routing happens at this layer

• Crossing a layer 3 boundary refers to using a routine device to move from one network (as defined by the IP address and subnet mask)

• Protocol data unit is a packet

What happens at the transport layer?

• Allows for multiplexed communications

• Without the transport layer, you could only have a single communication stream from one system to another

• Applications are assigned ports, which is the addressing scheme used at this layer

• TCP and UDP exist at this layer

• Protocol data unit is a segment for TCP and a datagram for UDP

What happens at the Session Layer

• Manages longer term connections

• Responsible for opening, closing and managing sessions between end-user application and server

• Authentication and authorization are services at this layer

• NetBIOS is an example of a protocol at this layer

• Protocol data unit is data

What happens at the presentation Layer

• Formatting and processing of data

• Translates data from the network to the application

• JPEG is an example of a format that exists at this layer

• Protocol data unit is data

What happens at the Application Layer?

• Application programming interfaces

• User interface

• Direct interaction with the user from the application

• HTTP, SMTP are examples of protocols at this layer

• Protocol data unit is data

TCP/IP Architecture

• Only four layers – Link, Internet, Transport, Application

• Link layer is the data link and physical layer from the OSI model

• Application layer is session, presentation and application from the OSI model

Internet Protocol

• Current predominant version is IPv4, though IPv6 is common

• Provides logical addressing and routing between networks. IPv4 uses source/destination IP addresses and supports fragmentation.

Transmission Control Protocol

• Used to multiplex network communications – ports allow multiple applications to communicate at the same time

• Requires a three-way handshake to establish connection between endpoints ( SYN,SYN/ACK,ACK)

• Handshake establishes existence and availability of other party SYN establishes sequence number, used to order messages

• Considered to be guaranteed delivery

IPv6

Introduced to resolve address exhaustion with IPv4

• Address now 128 bits rather than 32 bits

• Addresses now represented as hexadecimal pairs (e.g.,

fe4b:36b6:60a3:1:10a7:6460:ba5d:d022)

• Leading 0s dropped (see :1: above)

• Empty octets (0000) are dropped – represented with :: to indicate where the octets would be

• Introduces security (IPsec)

• Authentication Headers

• Encapsulating Security Payload

• Security Associations

Dynamic Addressing

• Uses neighbor and network discovery

• Part of address may be MAC address concatenated with network address

• Removes the need for DHCP

IP Address

• Consists of four bytes, represented by decimal values separated by a . (dot). Sometimes called a dotted quad.

• One part of the address is the network, which allows hosts to determine whether a destination is local or remote

• The other part is the host

• Subnet mask is used to indicate what portion is network

• IPv6 address is 16 bytes, four times longer than IPv4

Subnet mask

Always filled from the most significant bit, logical AND is used to distinguish host from network

CIDR Notation

• Classless Interdomain Routing

• a notation used to indicate the network portion

• It is faster than using a subnet mask

• Used to transition away from traditional classful addresses (Class A, Class B, Class C, etc)

Special Ranges

Private address ranges (by convention, not routable over the Internet)

• 10.0.0.0/8

• 172.16.0.0/12

• 192.168.0.0/16

• 224.0.0.0/4 is used for multicast addresses

• 127.0.0.0/8 is used for localhost addressing