Some networking basics - Network Security

chroniccommand

[-----------------------------------]
Originally meant for an addon to Xinapses guide
Author: Chroniccommand
I will be continuing with this on my free time. Enjoy.
[-----------------------------------]
Table of Contents:
0x01..OSI Model....
0x02..Sockets......
0x03..Packets......

0x01 OSI Model:
To understand the underlying framework of networking, you must understand the OSI Model. First of all, OSI stands for Open Systems Interconnection. The OSI model is the standard communication system used in networking. It works on layers, layers 1 - 7. I will list the layers and explain them here.

First layer - Physical layer
The first layer is the physical layer. The physical layer deals with actual connections. It deals with things such as cables and communicating between them. The first layer mainly deals with connecting and terminating connections. But it doesn't exactly do the virtual connection. When I say it deals with connections, it deals with the communication between mediums. An example of a medium would be a router.
Subsection: What is a router?
So what exactly is a router? Well a router is just a computer. Yes, a computer. Like the one you're on now. Except it's stripped. It has a minimal Operating System, like BSD. It doesn't have a GUI or anything fancy, nor does it have a monitor. It's a piece of hardware that deals with communicating. Now when you connect to another system, your computer sends a socket to the router. The router uses the physical layer to connect from your computer to the router for computer B. So it would look a little something like this:


|----------|
|Packet A  |   Contains header info etc
|----------|
     |
     |
     |                                        |-----------|
|----------|                                  |Computer B |
|Router A  |                                  |-----------|
|----------|      
     |                                             |
     |                                             |
     |                                             |
|----------------------------------|               |
|Passed through physical data layer| --------&gt; |----------|
|----------------------------------|           |Router B|
                                               |----------|

So computer A sends packet A which contains all info. It is then sent to router A. Router A just sends this packet through the physical data layer to Router B(Of course hitting other places in the process). Router B then identifies the packet and sends it to Computer B.

Anyway, back to the OSI model.
Layer 2 - Data link layer
The second layer in the OSI model is the Data link layer. This layer will transfer data and correct errors in the Physical layer. That's all I'll go into for now with this layer.

Layer 3 - Network layer
The third layer is the Network layer. This layer is another layer I won't go too much into. This layer is responsible for transporting data sequences. It also fragments and re-assembles network connections.

Layer 4 - Transport layer
The fourth layer is the Transport layer. This layer is mainly responsible for transfer of data between end users. TCP and UDP both use this layer, so know this layer!

Layer 5 - Session layer
This layer is the fifth layer. The Session layer. It manages and terminates connections between both remote and local connections. It is also responsible for closing connections in TCP.

Layer 6 - Presentation layer
The sixth layer is the Presentation layer. This is another layer I won't go much into. All you really need to know is that it will provide independence from representation of data.

Layer 7 - Application layer
The seventh and last layer of the OSI model is the Application layer. This layer will interact with network applications. That's the basics of that layer.

If you'd like to learn more about the OSI model, google :p

0x02 Sockets
So what exactly is a socket? You probably hear it all the time when you're talking about networking. But do you really know what it is? Well basically a socket allows bi-directional communication flow. Basically it looks kinda like this.
Socket 1 <------------> Socket 2

Sockets will let you send packets information over a network and lets you communicate. Sockets are the base of every networking application. There are 2 main socket types, and one not so known one.
[list=1]
[*]TCP(Transmission Control Protocol)[/*:m]
[*]UDP(User Datagram Protocol)[/*:m]
[*]Raw[/*:m][/list:o]
Now to go over the basics of each.
TCP
TCP stands for Transmission Control Protocol. TCP is part of the IP(Internet Protocol) suite. TCP provides a reliable connection using sockets. With a TCP socket, data is sent as one continuous stream until the connection is closed. This is more reliable than UDP, as UDP sends data less reliably and it may even lose parts of the message.

UDP
UDP stands for User Datagram Protocol. It works a bit differently from TCP. As I stated above, it sends data less reliably and parts of the message may even be lost. Even though this may happen, UDP has its uses. Some users for UDP are:
[list]
[*]DNS[/*:m]
[*]VoIP[/*:m]
[*]Online games[/*:m][/list:u]

Raw
A raw socket is the most simple type of socket out of the three. Basically it allows sending of data without encapsulating the packet for the Operating System. Basically that's all there is to really know about Raw IP packets.

0x03 IP
IP stands for Internet Protocol. It is used for communication using sockets. It is also responsible for mapping packets across networks. There are currently two major versions of IP
[list]
[*]IPv4[/*:m]
[*]IPv6[/*:m][/list:u]
IPv4 is the first major version. It is currently used the most. An IPv4 address looks like so:

255&#46;255&#46;255&#46;255

This allows for tons of combinations of IP's. Unfortunately, IPv4 addresses are rapidly running out. Mainly because of the boom of mobile devices that require/have internet.

IPv6 is less used, but will soon be used by almost everything as we slowly transition from 4 to 6. IPv6 is a bit more advanced than IPv4. A typical IPv6 address will look something like this:

2001&#58;0db8&#58;85a3&#58;0000&#58;0000&#58;8a2e&#58;0370&#58;7334&#46;

This is of course more hard to remember than

255&#46;255&#46;255&#46;255

Packets
Packets are sent over a socket. Packets contain information such as a header and a body. Much like a letter. Think of it like this.
Computer A crafts a packet with header information and body information. Much like a letter. Computer A sends it over to Computer B. Computer B gets the packet, dissects it and reads the header information, and proceeds to read the body.

Packets are a big part of networking as without packets we couldn't really communicate information.

Security against packets
A typical security issue is Packet sniffing. This involves capturing packets using an MITM(Man In The Middle) attack. The packet is then dissected to get the header and body information. This can be used to see what computer A is doing, since computers send packets to communicate information. This can of course be stumped by SSL. But of course SSL can be stripped.

Another security issue against packets is packet crafting. This involves an MITM attack. The man in the middle(the attacker), crafts a packet and sends it to computer A. Thus tricking computer A to think it's an official packet, even though it's the crafted packet created by the attacker.

Xin

Nice paper chronic really informative

Sh3llc0d3

Can I point out there are errors in this paper, a) a router is an OSI layer 3 device and also probably worth mentioning a gateway is a layer 4 device. Layer one devices for example would be 'dumb' devices such as network hubs, network hubs don't perform any function apart from passing on communications. Because network hubs blindly send out information anyway they can they make a network very insecure as a computer connected can packet-sniff everything without much trouble. Other examples would be usb devices and bluetooth. Opposite the hub would be on level 2 the smart switch which actually 'learns' where devices (computers) are on the network and knows pretty much automatically where to send data due to it's addressing tables and intercepting headers in "frames" being sent through the network.

Another problem is you are being specific between "bit", "frame" and "packet". Layer 1 packets aren't involved, it's bit's, layer 2: frames and layer 3: packets.

I'm guessing McKittrick hasn't been online otherwise he'd probably notice this lol

sangf

ctrl+a, ctrl+c, hwnd = FindWindow(0, "assignment_1.doc - Microsoft Word"); SetForegroundWindow(hwnd);, ctrl+v, thanks D:

Sh3llc0d3

said:

ctrl+a, ctrl+c, hwnd = FindWindow(0, "assignment_1.doc - Microsoft Word"); SetForegroundWindow(hwnd);, ctrl+v, thanks D:

:P Like I said I've done networking long before the past few weeks.

chroniccommand

said:

Can I point out there are errors in this paper, a) a router is an OSI layer 3 device and also probably worth mentioning a gateway is a layer 4 device. Layer one devices for example would be 'dumb' devices such as network hubs, network hubs don't perform any function apart from passing on communications. Because network hubs blindly send out information anyway they can they make a network very insecure as a computer connected can packet-sniff everything without much trouble. Other examples would be usb devices and bluetooth. Opposite the hub would be on level 2 the smart switch which actually 'learns' where devices (computers) are on the network and knows pretty much automatically where to send data due to it's addressing tables and intercepting headers in "frames" being sent through the network.

Another problem is you are being specific between "bit", "frame" and "packet". Layer 1 packets aren't involved, it's bit's, layer 2: frames and layer 3: packets.

I'm guessing McKittrick hasn't been online otherwise he'd probably notice this lol

Ah yes thanks for correcting this. It really wasn't much of a paper that was supposed to dive too deep into networking. Didn't wanna confuse people ;P

Sh3llc0d3

Fair enough just thought i'd point it out as networking is one area that everyone should know the theory of, or at least a basic understanding.

Hanna

I have issues with some information
posted here. Why list the OSI layers, with some incorrect information and then gloss over important issues by saying you won't go into much?

"Layer 3 - Network layer
The third layer is the Network layer. This layer is another layer I won't go too much into."

Why bother even listing it then? There is also no mention of the three-way handshake on the transport layer. This is a pretty important feature for TCP. Think about the different nmap flags for scanning. It's relevant.

The role of the physical layer is to
encode frames from the data link layer into signals. These signals are sent on the media, which consists
of wireless, fiber optic or copper wires. A router is NOT an example
of a medium. It is an intermediate device. They operate at layer 3
and exist to forward packets to the next hop. Routers really have no
reason to be mentioned at layer one, aside from the fact that they can accept
connectors, like RJ-45 for unshielded twisted-pair (UTP) cabling used
in ethernet.

You don't want to confuse by going to deep and yet list vague information at the surface.

I don't like it.

McKittrick

you could also mention the data types for each layer---as in:

2-FRAMES

3-PACKETS

4-SEGMENTS

5-7-APPLICATIONS/DATA?

also, who is "Hanna"?

Howdy, Stranger!

Top Posters

Who's Online (3)