COMP 5730 Test 3

OSI Model

Application

Presentation

Session

Transport

Network

Datalink

Physical

TCP handshake

1. Client sends a syn

2. Server sends a syn ack

3. Client sends ack ack

DNS

Domain Name System

ARP

Address Resolution Protocol - maps IP’s to MAC Addresses

Types of ARP Messages

ARP Announcement

ARP Request

ARP Response

ARP Announcement

a host sends out their MAC and IP address

ARP Request

Send a message asking for the IP address of a particular MAC address

ARP Response

Message stating IP address for a specified MAC Address

ARP poisoning

Spoofing your MAC address to receive messages meant for another host

ARP Flooding

Attacker floods switches memory with requests wiping out all previous knowledge of MAC address, IP pairs

Sticky MAC’s

when a new device joins the switch remembers the address until the connection is severed

Defenses against ARP attacks

Sticky MAC’s

set up network topology so that ARP happens in a small area

Types of Denial of Service attacks

Asymmetry

Traffic Flood

Reflection attack

Amplification attack

Botnet

Asymmetric attack

When the attacker requires limited resources to start the attack and the defender needs expensive resources to stop the attack

Traffic Flood

attack floods victim with traffic

Reflection attack

attacker forges source IP and have a 3rd party send a lot of traffic to a victim

Amplification attack

attacker sends small DNS packets returning large packets that the defender must absorb

Defenses against denial of service attacks

Overprovisioning

IPS

Captcha’s

Mirai botnet

Compromised over 600k IoT devices and took down many high profile services

DMZ

zones that stand between your network and the internet or another network