Lesson 10 - Transport Layer

Transmission Control Protocol (TCP)

Guarantees delivery of all packets in an ordered fashion

-Reliable

-Sends out an ACK to indicate successful receipt of packet

User Datagram Protocol (UDP)

Delivers packets as fast as possible but w/ no delivery guarantee

-Unreliable

-Faster than TCP

Ports

Identifies where data is directed

-16bit

-range from 1-65,535

HTTP

80

HTTPS

443

FTP

21

SSH

22

Netstat

Displays active TCP connections, ports on which the computer is listening

Netstat - a

Displays all active TCP connections and the TCP and UDP ports in which the computer is listening

Netstat -n

Displays all active TCP connections, addresses and port numbers are expressed numerically and no attempt is made to determine names

Netstat -o

Displays all active TCP connections and includes the process ID’s (PID) for each connection

Netstat -s

Displays statistics by protocol, default statistic displayed are TCP, UDP, ICMP and IP

Sliding Window Protocol

Used with each packet so that the receiver informs the sender if the size of the receive window which is the number of bytes of data it is willing to accept before the sender has to pause and wait for the response

TCP connection

TCP Syn → Receiver

Receiver sends SYN-ACK

Sender receives SYN-ACK

Sender sends ACK

Receiver gets ACK

TCP connection established

SYN flood attack1

Instead of sending ACK message after sender receives SYN-ACK, handshake is left unfinished and in an open and occupied status, allowing for the attacker to saturate all open ports so that users cannot connect

Network Address Translation

Translates addresses in an internal network to an external address that is used for communication to and from the outside world

-implemented by placing a router in-between the internal and private network and public network

10.0.0.0-10.255.255.255

24 bits

172.16.0.0 - 172.31.0.0

20 bits

192.168.0.0 - 192.168.255.255

16 bits

TCP Session Hijacking

Hacker alters a TCP connection from another user

TCP Sequence

Creates a spoofed session, attempts to guess original sequence number sent by server at start

Blind Injection

Done without anticipating being able to see the servers response, allows for only one way communication

ACK Storms

Back and forth communication between client and server to attempt to resync communicationC

Complete Session Hijacking

Attacker needs to be on the same network, this is done through packet sniffing to see sequence then the hacker injects a packet to server using a spoofed IP.