Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University"

Transcription

1 Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University

2 Why ICMP? UDP and TDP are not designed to report errors Provide a simple way to report errors between hosts/routers and hosts

3 Layer 2 Protocol ICMP is encapsulated in IP It does not have ports. The receiving host may not response to the sender. No guarantee of delivery.

4 ICMP Packet 4byte header (type, code, and header check sum) followed by a message type code ICMP Check Sum Data

5 Messages A host may send a quench message to notify a sender to throttle down the delivery rate. A router may send ICMP to inform a sender of some problem. A router may respond unreachable ICMP message if a destination host cannot respond. ICMP sent by routers may be used for reconnaissance purpose!

6 Mapping Techniques Explore live hosts for attack target RingZero trojan scans TCP ports 3128, 80, and 8080 including inactive hosts > not very efficient ICMP echo request TCP Ack Scan (respond RST)

7 Tireless Mapper Scanner sends ICMP echo requests to each possible subnet addresses scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request IDS will not issue an alert for individual echo request IDS can examine more generic scan activity: single source to multiple destination within a period

8 Efficient Mapper Send ICMP echo request to broadcast address (BSD implementation) All live hosts in the subnet should respond. scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request

9 Clever Mapper What if class C subnet is further divided into smaller networks? Send to ICMP echo request to each of their broadcast addresses scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request scanner.net > : icmp: echo request The subnet is divided into 4 smaller networks each of which contains 64 addresses.

10 Cerebral Mapper Use ICMP address mask request Reconnoiter host address range in a subnet scanner.net > router.com: icmp: address mask request (DF) router.com > scanner.net: icmp: address mask is 0xffffff00 (DF)

11 Normal ICMP Traffic Host Unreachable Port Unreachable Admin Prohibited Need to Frag Time Exceeded In Transit Embedded Information I ICMP Error Messages

12 Host Unreachable An attempt to send traffic to a target host which may be down somehow router > sending.host: icmp: host target.host unreachable

13 Port Unreachable A target host responds to the sending host that it is not listening on a port. In the following, the target is not listening on ntp port (UDP network time protocol port): Target.host > sending.host: icmp: target.host udp port ntp unreachable (DF)

14 Admin Prohibited The router has access control and responds sender admin prohibited ICM message. router > sending.host: icmp: host target.host unreachable admin prohibited

15 Need to Frag A DF flag set on a IP packet that needs be fragmented. router > sending.host: icmp: target.host unreachable need to frag (mtu 1500)

16 Time Exceeded In Transit Packet dropped because of TTL router > sending.host: icmp: time exceeded in-transit

17 Embedded Information in ICMP Error Messages In case of errors, ICMP will include 28 bytes of the offending IP This extra information can be used for classifying OS used in nmap. Type Code Checksum Message IP header + 8 bytes payload (28 bytes totally)

18 Malicious ICMP Traffic Port/host scan DoS/dDoS Covert channels

19 Smurf Attack 1. ICMP echo request to broadcast addresses with victim s IP address 2. Router allows in ICMP echo request to broadcast addresses 3. All live hosts respond ICMP echo reply to the victim

20 Tribe Flood Network TFN attack enlists the help of many distributed hosts (daemon or zombie) to flood a victim. ICMP echo reply TFN master TFN daemon hosts Daemon hosts Flood victim Victim

21 WinFreeze Cause susceptible Windows host to attack itself (selfmutilation) In the following the victim will apply all the changes in its routing table! router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com router > victim.com: redirect to host victim.com

22 Loki Use ICMP as a tunneling protocol for a covert channel Client/server architecture A compromised host running Loki server will respond Loki clients server information such as /etc/passwd

23 Unsolicited ICMP Echo Replies IP Spoofing TFN Loki

24 ICMP Messages From hosts Protocol unreachable Port unreachable IP reassembly time exceeded Parameter problem Echo reply Timestamp reply Address mask reply From routers Fragmentation needed but don t fragment bit set Admin prohibited Time exceeded in transit Host unreachable

25 ICMP Messages Admin prohibited: can assist in examining what type of traffic the site blocks Address mask reply: the subnet mask of the network on which the responding host resides Time exceeded in transit: used in traceroute to discover routers and network topology Protocol unreachable: can be used to inversely map a host s listening protocols Port unreachable: can be used to inversely map a live host s listening UDP ports Fragmentation needed but don t fragment bit set: can be used to deter4mine the MTU of links for use in attacks that use fragments

26 To Block or Not to Block Unrequited ICMP Echo Requests Blocking inbound echo request Loki and TFN used echo reply! Windows tracert not working Inbound ICMP exceeded in transit used in tracert UNIX traceroute uses UDP. Fine! Inefficiency Blocking all inbound ICMP traffic may result in a sending host to keep trying until time out if the receiver is unreachable Broken Path MTU Discovery A sending host may need to find out MTU. Blocking inbound ICMP traffic means sending packets larger than MTU with DF will be dropped silently! Bottom line : Make sure to allow host unreachable and need to frag ICMP inbound traffic to your network!

Operational Security Capabilities for IP Network Infrastructure

Operational Security Capabilities for IP Network Infrastructure Operational Security Capabilities F. Gont for IP Network Infrastructure G. Gont (opsec) UTN/FRH Internet-Draft September 1, 2008 Intended status: Informational Expires: March 5, 2009 Status of this Memo

More information

ICMP (Internet Control Message Protocol)

ICMP (Internet Control Message Protocol) Today s Lecture ICMP (Internet Control Message Protocol) Internet Protocols CSC / C 573 I. ICMP Overview II. ICMP rror Reporting III. ICMP Query / Response Messages IV. ICMP Message Processing Fall, 2005

More information

CS 457 Lecture 11 More IP Networking. Fall 2011

CS 457 Lecture 11 More IP Networking. Fall 2011 CS 457 Lecture 11 More IP Networking Fall 2011 IP datagram format IP protocol version number header length (bytes) type of data max number remaining hops (decremented at each router) upper layer protocol

More information

Module 7 Internet And Internet Protocol Suite

Module 7 Internet And Internet Protocol Suite Module 7 Internet And Internet Protocol Suite Lesson 22 IP addressing. ICMP LESSON OBJECTIVE General The lesson will continue the discussion on IPv4 along with the idea of ICMP. Specific The focus areas

More information

ICMP (Internet Control Message Protocol)

ICMP (Internet Control Message Protocol) ABSTRACT : ICMP stands for internet control message protocol it is a vital protocol of network layer among the seven layers of OSI(open system interconnection). Here we deal with the several situations

More information

Internet Control Message Protocol (ICMP), RFC 792. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC

Internet Control Message Protocol (ICMP), RFC 792. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC Internet Control Message Protocol (ICMP), RFC 79 Prof Lin Weiguo Copyleft 009~07, School of Computing, CUC Oct 07 Overview } The IP (Internet Protocol) relies on several other protocols to perform necessary

More information

Subnets. IP datagram format. The Internet Network layer. IP Fragmentation and Reassembly. IP Fragmentation & Reassembly. IP Addressing: introduction

Subnets. IP datagram format. The Internet Network layer. IP Fragmentation and Reassembly. IP Fragmentation & Reassembly. IP Addressing: introduction The Network layer Host, network layer functions: Network layer Routing protocols path selection R, OSPF, BGP Transport layer: TCP, forwarding table Link layer physical layer protocol addressing conventions

More information

Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path. Review of TCP/IP Internetworking

Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path. Review of TCP/IP Internetworking 1 Review of TCP/IP working Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path Frame Path Chapter 3 Client Host Trunk Link Server Host Panko, Corporate

More information

To make a difference between logical address (IP address), which is used at the network layer, and physical address (MAC address),which is used at

To make a difference between logical address (IP address), which is used at the network layer, and physical address (MAC address),which is used at To make a difference between logical address (IP address), which is used at the network layer, and physical address (MAC address),which is used at the data link layer. To describe how the mapping of a

More information

Each ICMP message contains three fields that define its purpose and provide a checksum. They are TYPE, CODE, and CHECKSUM fields.

Each ICMP message contains three fields that define its purpose and provide a checksum. They are TYPE, CODE, and CHECKSUM fields. IP address ICMP Each ICMP message contains three fields that define its purpose and provide a checksum. They are TYPE, CODE, and CHECKSUM fields. The TYPE field identifies the ICMP message, the CODE field

More information

inside: THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN

inside: THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 inside: SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN & The Advanced Computing Systems Association & The System Administrators

More information

ELEC / COMP 177 Fall Some slides from Kurose and Ross, Computer Networking, 5 th Edition

ELEC / COMP 177 Fall Some slides from Kurose and Ross, Computer Networking, 5 th Edition ELEC / COMP 177 Fall 2011 Some slides from Kurose and Ross, Computer Networking, 5 th Edition One of the core protocols in the Internet Primarily used to communicate errors among routers and hosts IP datagram

More information

Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers

Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled

More information

Firewall Stateful Inspection of ICMP

Firewall Stateful Inspection of ICMP The feature categorizes Internet Control Management Protocol Version 4 (ICMPv4) messages as either malicious or benign. The firewall uses stateful inspection to trust benign ICMPv4 messages that are generated

More information

IP : Internet Protocol

IP : Internet Protocol 1/20 IP : Internet Protocol Surasak Sanguanpong nguan@ku.ac.th http://www.cpe.ku.ac.th/~nguan Last updated: July 30, 1999 Agenda 2/20 IP functions IP header format Routing architecture IP layer 3/20 defines

More information

Network layer: Overview. Network Layer Functions

Network layer: Overview. Network Layer Functions Network layer: Overview Network layer functions IP Routing and forwarding NAT ARP IPv6 Routing 1 Network Layer Functions Transport packet from sending to receiving hosts Network layer protocols in every

More information

Computer Network Fundamentals Spring Week 4 Network Layer Andreas Terzis

Computer Network Fundamentals Spring Week 4 Network Layer Andreas Terzis Computer Network Fundamentals Spring 2008 Week 4 Network Layer Andreas Terzis Outline Internet Protocol Service Model Addressing Original addressing scheme Subnetting CIDR Fragmentation ICMP Address Shortage

More information

Dongsoo S. Kim Electrical and Computer Engineering Indiana U. Purdue U. Indianapolis

Dongsoo S. Kim Electrical and Computer Engineering Indiana U. Purdue U. Indianapolis Session 8. TCP/IP Dongsoo S. Kim (dskim@iupui.edu) Electrical and Computer Engineering Indiana U. Purdue U. Indianapolis IP Packet 0 4 8 16 19 31 Version IHL Type of Service Total Length Identification

More information

LECTURE 8. Mobile IP

LECTURE 8. Mobile IP 1 LECTURE 8 Mobile IP What is Mobile IP? The Internet protocol as it exists does not support mobility Mobile IP tries to address this issue by creating an anchor for a mobile host that takes care of packet

More information

Configuring Advanced Firewall Settings

Configuring Advanced Firewall Settings Configuring Advanced Firewall Settings This section provides advanced firewall settings for configuring detection prevention, dynamic ports, source routed packets, connection selection, and access rule

More information

Network Layer. The Network Layer. Contents Connection-Oriented and Connectionless Service. Recall:

Network Layer. The Network Layer. Contents Connection-Oriented and Connectionless Service. Recall: Network Layer The Network Layer Recall: The network layer is responsible for the routing of packets The network layer is responsible for congestion control 1 2 Contents 4.1.1 Connection-Oriented and Connectionless

More information

K2289: Using advanced tcpdump filters

K2289: Using advanced tcpdump filters K2289: Using advanced tcpdump filters Non-Diagnostic Original Publication Date: May 17, 2007 Update Date: Sep 21, 2017 Topic Introduction Filtering for packets using specific TCP flags headers Filtering

More information

CMPE 80N: Introduction to Networking and the Internet

CMPE 80N: Introduction to Networking and the Internet CMPE 80N: Introduction to Networking and the Internet Katia Obraczka Computer Engineering UCSC Baskin Engineering Lecture 17 CMPE 80N Spring'10 1 Announcements Next class: Presentation of fun projects

More information

THE "TRIBE FLOOD NETWORK 2000" DISTRIBUTED DENIAL OF SERVICE ATTACK TOOL

THE TRIBE FLOOD NETWORK 2000 DISTRIBUTED DENIAL OF SERVICE ATTACK TOOL TFN2K - An Analysis Jason Barlow and Woody Thrower AXENT Security Team February 10, 2000 (Updated March 7, 2000) Revision: 1.3 Abstract This document is a technical analysis of the Tribe Flood Network

More information

History Page. Barracuda NextGen Firewall F

History Page. Barracuda NextGen Firewall F The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic

More information

Ch.9 Internet Protocol: Error And Control Messages (ICMP)

Ch.9 Internet Protocol: Error And Control Messages (ICMP) CSC521 Communication Protocols 網路通訊協定 Ch.9 Internet Protocol: Error And Control Messages (ICMP) 吳俊興國立高雄大學資訊工程學系 Internetworking With TCP/IP, Vol I: Sixth Edition, Douglas E. Comer Outline 1 Introduction

More information

Computer Networks Security: intro. CS Computer Systems Security

Computer Networks Security: intro. CS Computer Systems Security Computer Networks Security: intro CS 166 - Computer Systems Security A very easy network 3/14/16 Computer Networks: Intro 2 Two philosophers example Translator Language Translator Engineer Communication

More information

Denial of Service. Serguei A. Mokhov SOEN321 - Fall 2004

Denial of Service. Serguei A. Mokhov SOEN321 - Fall 2004 Denial of Service Serguei A. Mokhov SOEN321 - Fall 2004 Contents DOS overview Distributed DOS Defending against DDOS egress filtering References Goal of an Attacker Reduce of an availability of a system

More information

CSE/EE 461 The Network Layer. Application Presentation Session Transport Network Data Link Physical

CSE/EE 461 The Network Layer. Application Presentation Session Transport Network Data Link Physical CSE/EE 461 The Network Layer Application Presentation Session Transport Network Data Link Physical This Lecture Focus: What to do when one wire isn t big enough? Point to point link Broadcast link (Ethernet

More information

Internet Control Message Protocol

Internet Control Message Protocol Internet Control Message Protocol The Internet Control Message Protocol is used by routers and hosts to exchange control information, and to inquire about the state and configuration of routers and hosts.

More information

Last time. Network layer. Introduction. Virtual circuit vs. datagram details. IP: the Internet Protocol. forwarding vs. routing

Last time. Network layer. Introduction. Virtual circuit vs. datagram details. IP: the Internet Protocol. forwarding vs. routing Last time Network layer Introduction forwarding vs. routing Virtual circuit vs. datagram details connection setup, teardown VC# switching forwarding tables, longest prefix matching IP: the Internet Protocol

More information

CSC 574 Computer and Network Security. TCP/IP Security

CSC 574 Computer and Network Security. TCP/IP Security CSC 574 Computer and Network Security TCP/IP Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) Network Stack, yet again Application Transport Network

More information

Lecture 8. Reminder: Homework 3, Programming Project 2 due on Thursday. Questions? Tuesday, September 20 CS 475 Networks - Lecture 8 1

Lecture 8. Reminder: Homework 3, Programming Project 2 due on Thursday. Questions? Tuesday, September 20 CS 475 Networks - Lecture 8 1 Lecture 8 Reminder: Homework 3, Programming Project 2 due on Thursday. Questions? Tuesday, September 20 CS 475 Networks - Lecture 8 1 Outline Chapter 3 - Internetworking 3.1 Switching and Bridging 3.2

More information

IPv6 Neighbor Discovery

IPv6 Neighbor Discovery The IPv6 neighbor discovery process uses Internet Control Message Protocol (ICMP) messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local

More information

Extended ACL Configuration Mode Commands

Extended ACL Configuration Mode Commands Extended ACL Configuration Mode Commands To create and modify extended access lists on a WAAS device for controlling access to interfaces or applications, use the ip access-list extended global configuration

More information

Administrivia CSC458 Lecture 4 Bridging LANs and IP. Last Time. This Time -- Switching (a.k.a. Bridging)

Administrivia CSC458 Lecture 4 Bridging LANs and IP. Last Time. This Time -- Switching (a.k.a. Bridging) Administrivia CSC458 Lecture 4 Bridging LANs and IP Homework: # 1 due today # 2 out today and due in two weeks Readings: Chapters 3 and 4 Project: # 2 due next week Tutorial today: Joe Lim on project 2

More information

OSI Network Layer. Network Fundamentals Chapter 5. Version Cisco Systems, Inc. All rights reserved. Cisco Public 1

OSI Network Layer. Network Fundamentals Chapter 5. Version Cisco Systems, Inc. All rights reserved. Cisco Public 1 OSI Network Layer Network Fundamentals Chapter 5 Version 4.0 1 Objectives Identify the role of the Network Layer, as it describes communication from one end device to another end device. Examine the most

More information

Introduction to routing in the Internet

Introduction to routing in the Internet Introduction to routing in the Internet Internet architecture IPv4, ICMP, ARP Addressing, routing principles (Chapters 2 3 in Huitema) Internet-1 Internet Architecture Principles End-to-end principle by

More information

Introduction to IPv6. IPv6 addresses

Introduction to IPv6. IPv6 addresses Introduction to IPv6 (Chapter 4 in Huitema) IPv6,Mobility-1 IPv6 addresses 128 bits long Written as eight 16-bit integers separated with colons E.g. 1080:0000:0000:0000:0000:0008:200C:417A = 1080::8:800:200C:417A

More information

Network and Security: Introduction

Network and Security: Introduction Network and Security: Introduction Seungwon Shin KAIST Some slides are from Dr. Srinivasan Seshan Some slides are from Dr. Nick Mckeown Network Overview Computer Network Definition A computer network or

More information

FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6

FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6 FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6 Intrusion Detection Level Analysis of Nmap and Queso by Toby Miller last updated Wednesday, August 30, 2000

More information

Chapter 4 Network Layer

Chapter 4 Network Layer Chapter 4 Network Layer Computer Networking A Top-Down Approach These slides are based on the slides made available by Kurose and Ross. All material copyright 1996-2012 J.F Kurose and K.W. Ross, All Rights

More information

Network Intrusion Detection Systems. Beyond packet filtering

Network Intrusion Detection Systems. Beyond packet filtering Network Intrusion Detection Systems Beyond packet filtering Goal of NIDS Detect attacks as they happen: Real-time monitoring of networks Provide information about attacks that have succeeded: Forensic

More information

Chapter 5: Trouble shooting of a network

Chapter 5: Trouble shooting of a network 5 Troubleshooting TCP/IP Fig 5 show trouble shooting a TCP/IP Chapter 5: Trouble shooting of a network Steps 1 First, determines whether your local host is properly configured. Step 2 Next, uses the ping

More information

CS61C Machine Structures Lecture 37 Networks. No Machine is an Island!

CS61C Machine Structures Lecture 37 Networks. No Machine is an Island! CS61C Machine Structures Lecture 37 Networks April 24, 2006 John Wawrzynek Page 1 No Machine is an Island! Computer Processor (active) Control ( brain ) Datapath ( brawn ) Memory (passive) (where programs,

More information

IPv6- IPv4 Threat Comparison v1.0. Darrin Miller Sean Convery

IPv6- IPv4 Threat Comparison v1.0. Darrin Miller Sean Convery IPv6- IPv4 Threat Comparison v1.0 Darrin Miller dmiller@cisco.com Sean Convery sean@cisco.com Motivations Discussions around IPv6 security have centered on IPsec Though IPsec is mandatory in IPv6, the

More information

ECS-087: Mobile Computing

ECS-087: Mobile Computing ECS-087: Mobile Computing Mobile IP Most of the slides borrowed from Prof. Sridhar Iyer Diwakar Yagyasen.1 Effect of Mobility on Protocol Stack Application: new applications and adaptations Transport:

More information

A Review on ICMPv6 Vulnerabilities and its Mitigation Techniques: Classification and Art

A Review on ICMPv6 Vulnerabilities and its Mitigation Techniques: Classification and Art 2015 IEEE 2015 International Conference on Computer, Communication, and Control Technology (I4CT 2015), April 21-23 in Imperial Kuching Hotel, Kuching, Sarawak, Malaysia A Review on ICMPv6 Vulnerabilities

More information

CS 458 Internet Engineering Spring First Exam

CS 458 Internet Engineering Spring First Exam CS 458 Internet Engineering Spring 2005 First Exam Instructions (read carefully): There are 6 problems for a total of 60 points. This is a closed book and closed notes in-class exam. If any problem is

More information

Introduction to IPv6 - II

Introduction to IPv6 - II Introduction to IPv6 - II Building your IPv6 network Alvaro Vives 27 June 2017 Workshop on Open Source Solutions for the IoT Contents IPv6 Protocols and Autoconfiguration - ICMPv6 - Path MTU Discovery

More information

Chapter 3 Internetworking

Chapter 3 Internetworking Chapter 3 Internetworking Basic Internetworking (IP) (cont d) Datagram forwarding in IP Every datagram contains the IP address of the destination host If directly connected to destination network, then

More information

Internet Security: Firewall

Internet Security: Firewall Internet Security: Firewall What is a Firewall firewall = wall to protect against fire propagation More like a moat around a medieval castle restricts entry to carefully controlled points restricts exits

More information

CSC 401 Data and Computer Communications Networks

CSC 401 Data and Computer Communications Networks CSC 401 Data and Computer Communications Networks Network Layer IPv4, Format and Addressing,, IPv6 Prof. Lina Battestilli Fall 2017 Chapter 4 Outline Network Layer: Data Plane 4.1 Overview of Network layer

More information

Auxiliary Protocols. Internet Layer. Address Resolution Protocol. Delivery of IP Packets

Auxiliary Protocols. Internet Layer. Address Resolution Protocol. Delivery of IP Packets Internet Layer Auxiliary Protocols aw division into three tasks: Data transfer over a global network oute decision at the sub-nodes Control of the network or transmission status outing Protocols outing

More information

Guide to Networking Essentials, 6 th Edition. Chapter 5: Network Protocols

Guide to Networking Essentials, 6 th Edition. Chapter 5: Network Protocols Guide to Networking Essentials, 6 th Edition Chapter 5: Network Protocols Objectives Describe the purpose of a network protocol, the layers in the TCP/IP architecture, and the protocols in each TCP/IP

More information

Internet Protocol (IP)

Internet Protocol (IP) CPSC 360 - Network Programming Internet Protocol (IP) Michele Weigle Department of Computer Science Clemson University mweigle@cs.clemson.edu March 14, 2005 http://www.cs.clemson.edu/~mweigle/courses/cpsc360

More information

Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015

Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015 Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:

More information

Problem Set 7 Due: Start of Class, November 2

Problem Set 7 Due: Start of Class, November 2 CS242 Computer Networks Handout # 14 Randy Shull October 26, 2017 Wellesley College Problem Set 7 Due: Start of Class, November 2 Reading: Kurose & Ross, Sections 3.6, 3.7, 3.8 Wireshark Lab [26] In these

More information

ECE4110 Internetwork Programming. Introduction and Overview

ECE4110 Internetwork Programming. Introduction and Overview ECE4110 Internetwork Programming Introduction and Overview 1 EXAMPLE GENERAL NETWORK ALGORITHM Listen to wire Are signals detected Detect a preamble Yes Read Destination Address No data carrying or noise?

More information

NISCC Technical Note 06/02: Response to Distributed Denial of Service (DDoS) Attacks

NISCC Technical Note 06/02: Response to Distributed Denial of Service (DDoS) Attacks NISCC Technical Note 06/02: Response to Distributed Denial of Service (DDoS) Attacks Background This NISCC technical note is intended to provide information to enable organisations in the UK s Critical

More information

A Software Tool for Network Intrusion Detection

A Software Tool for Network Intrusion Detection A Software Tool for Network Intrusion Detection 4th Biennial Conference Presented by: Christiaan van der Walt Date:October 2012 Presentation Outline Need for intrusion detection systems Overview of attacks

More information

Networking: Network layer

Networking: Network layer control Networking: Network layer Comp Sci 3600 Security Outline control 1 2 control 3 4 5 Network layer control Outline control 1 2 control 3 4 5 Network layer purpose: control Role of the network layer

More information

Module 28 Mobile IP: Discovery, Registration and Tunneling

Module 28 Mobile IP: Discovery, Registration and Tunneling Module 28 Mobile IP: Discovery, and Tunneling Learning Objectives Introduction to different phases of Mobile IP Understanding how a mobile node search the agents using Discovery process Understand how

More information

IPv6 Neighbor Discovery

IPv6 Neighbor Discovery IPv6 Neighbor Discovery Last Updated: September 19, 2012 The IPv6 neighbor discovery process uses Internet Control Message Protocol (ICMP) messages and solicited-node multicast addresses to determine the

More information

HP 5120 SI Switch Series

HP 5120 SI Switch Series HP 5120 SI Switch Series Network Management and Monitoring Configuration Guide Part number: 5998-1813 Software version: Release 1505 Document version: 6W102-20121111 Legal and notice information Copyright

More information

Introduction! Overview! Signal-driven I/O for Sockets! Two different UDP servers!

Introduction! Overview! Signal-driven I/O for Sockets! Two different UDP servers! Overview Last Lecture Advanced UDP sockets and threads Source: Chapters 22&26 of Stevens book This Lecture Signal-driven I/O, Raw sockets Source: Chapters 25&28&29 of Stevens book Next Lecture WSN and

More information

Chapter 4 Network Layer: The Data Plane. Part A. Computer Networking: A Top Down Approach

Chapter 4 Network Layer: The Data Plane. Part A. Computer Networking: A Top Down Approach Chapter 4 Network Layer: The Data Plane Part A All material copyright 996-06 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th Edition, Global Edition Jim Kurose,

More information

Internetwork Protocols

Internetwork Protocols Internetwork Protocols Background to IP IP, and related protocols Internetworking Terms (1) Communications Network Facility that provides data transfer service An internet Collection of communications

More information

Lab 6.7.1: Ping and Traceroute

Lab 6.7.1: Ping and Traceroute Topology Diagram Addressing Table Device Interface IP Address Subnet Mask Default Gateway R1-ISP R2-Central Eagle Server S0/0/0 10.10.10.6 255.255.255.252 N/A Fa0/0 192.168.254.253 255.255.255.0 N/A S0/0/0

More information

Shortest Path First Example

Shortest Path First Example IP Exercises (Solutions in Class) 1 Shortest Path First Example Example: Received Set of Link State Update Packets (from Fig. 5-13, Computer Networks) Identity Sequence # Age List of Neighbors A 2021 60

More information

CSCE 463/612 Networks and Distributed Processing Spring 2017

CSCE 463/612 Networks and Distributed Processing Spring 2017 CSCE 46/6 Networks and Distributed Processing Spring 07 Network Layer III Dmitri Loguinov Texas A&M University April, 07 Original slides copyright 996-004 J.F Kurose and K.W. Ross Homework #4 Grading Default

More information

CSC 4900 Computer Networks: Network Layer

CSC 4900 Computer Networks: Network Layer CSC 4900 Computer Networks: Network Layer Professor Henry Carter Fall 2017 Chapter 4: Network Layer 4. 1 Introduction 4.2 What s inside a router 4.3 IP: Internet Protocol Datagram format 4.4 Generalized

More information

Module 19 : Threats in Network What makes a Network Vulnerable?

Module 19 : Threats in Network What makes a Network Vulnerable? Module 19 : Threats in Network What makes a Network Vulnerable? Sharing Unknown path Many points of attack What makes a network vulnerable? Unknown perimeter Anonymity Complexity of system Categories of

More information

Computer Science 3CN3 and Software Engineering 4C03 Final Exam Answer Key

Computer Science 3CN3 and Software Engineering 4C03 Final Exam Answer Key Computer Science 3CN3 and Software Engineering 4C03 Final Exam Answer Key DAY CLASS Dr. William M. Farmer DURATION OF EXAMINATION: 2 Hours MCMASTER UNIVERSITY FINAL EXAMINATION April 2008 THIS EXAMINATION

More information

Implementing IP in IP Tunnel

Implementing IP in IP Tunnel This chapter module provides conceptual and configuration information for IP in IP tunnels on Cisco ASR 9000 Series Router. Note For a complete description of the IP in IP tunnel commands listed in this

More information

MPLS LSP Ping, Traceroute, and AToM VCCV

MPLS LSP Ping, Traceroute, and AToM VCCV As Multiprotocol Label Switching (MPLS) deployments increase and the traffic types they carry increase, the ability of service providers to monitor label switched paths (LSPs) and quickly isolate MPLS

More information

HP A5500 EI & A5500 SI Switch Series Network Management and Monitoring. Configuration Guide. Abstract

HP A5500 EI & A5500 SI Switch Series Network Management and Monitoring. Configuration Guide. Abstract HP A5500 EI & A5500 SI Switch Series Network Management and Monitoring Configuration Guide Abstract This document describes the software features for the HP A Series products and guides you through the

More information

Three interface Router without NAT Cisco IOS Firewall Configuration

Three interface Router without NAT Cisco IOS Firewall Configuration Three interface Router without NAT Cisco IOS Firewall Configuration Document ID: 13893 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations

More information

Internet Engineering Task Force (IETF) Request for Comments: CERNET Center/Tsinghua University. Category: Standards Track

Internet Engineering Task Force (IETF) Request for Comments: CERNET Center/Tsinghua University. Category: Standards Track Internet Engineering Task Force (IETF) Request for Comments: 7915 Obsoletes: 6145 Category: Standards Track ISSN: 2070-1721 C. Bao X. Li CERNET Center/Tsinghua University F. Baker Cisco Systems T. Anderson

More information

Lecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005

Lecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005 Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks

More information

IPv4 Lecture 10a. COMPSCI 726 Network Defence and Countermeasures. Muhammad Rizwan Asghar. August 14, 2017

IPv4 Lecture 10a. COMPSCI 726 Network Defence and Countermeasures. Muhammad Rizwan Asghar. August 14, 2017 IPv4 Lecture 10a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 14, 2017 Source of some slides: Princeton University Also thanks to J.F Kurose and K.W. Ross IPv4 Internet

More information

Network layer Network Layer 4-1

Network layer Network Layer 4-1 Network layer 1 Network layer transport segment from sending to receiving host on sending side puts segments into datagrams on rcving side, delivers segments to transport layer network layer protocols

More information

COMP211 Chapter 4 Network Layer: The Data Plane

COMP211 Chapter 4 Network Layer: The Data Plane COMP211 Chapter 4 Network Layer: The Data Plane All material copyright 1996-2016 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th edition Jim Kurose, Keith Ross

More information

Chapter 4: network layer

Chapter 4: network layer Chapter 4: network layer chapter goals: understand principles behind network layer services: network layer service models forwarding versus routing how a router works routing (path selection) broadcast,

More information

Outline. Routing. Introduction to Wide Area Routing. Classification of Routing Algorithms. Introduction. Broadcasting and Multicasting

Outline. Routing. Introduction to Wide Area Routing. Classification of Routing Algorithms. Introduction. Broadcasting and Multicasting Outline Routing Fundamentals of Computer Networks Guevara Noubir Introduction Broadcasting and Multicasting Shortest Path Unicast Routing Link Weights and Stability F2003, CSG150 Fundamentals of Computer

More information

CIT 480: Securing Computer Systems

CIT 480: Securing Computer Systems CIT 480: Securing Computer Systems Scanning CIT 480: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting CIT 480: Securing Computer

More information

Unit 2.

Unit 2. Unit 2 Unit 2 Topics Covered: 1. PROCESS-TO-PROCESS DELIVERY 1. Client-Server 2. Addressing 2. IANA Ranges 3. Socket Addresses 4. Multiplexing and Demultiplexing 5. Connectionless Versus Connection-Oriented

More information

Review of Internet Architecture and Protocols

Review of Internet Architecture and Protocols Review of Internet Architecture and Protocols Professor Guevara Noubir Northeastern University noubir@ccs.neu.edu Lecture Reference Textbook: (source of some diagrams) Computer Networks: A Systems Approach,

More information

Fixed Internetworking Protocols and Networks. IP mobility. Rune Hylsberg Jacobsen Aarhus School of Engineering

Fixed Internetworking Protocols and Networks. IP mobility. Rune Hylsberg Jacobsen Aarhus School of Engineering Fixed Internetworking Protocols and Networks IP mobility Rune Hylsberg Jacobsen Aarhus School of Engineering rhj@iha.dk 1 2011 ITIFN Mobile computing Vision Seamless, ubiquitous network access for mobile

More information

Network Layer/IP Protocols

Network Layer/IP Protocols Network Layer/IP Protocols 1 Outline IP Datagram (IPv4) NAT Connection less and connection oriented service 2 IPv4 packet header 3 IPv4 Datagram Header Format version of the IP protocol (4 BIts) IP header

More information

TCP: Transmission Control Protocol RFC 793,1122,1223. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC

TCP: Transmission Control Protocol RFC 793,1122,1223. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC TCP: Transmission Control Protocol RFC 793,1122,1223 Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC Nov. 2017 TCP/IP Protocol Stack Application Layer FTP, Telnet, HTTP, Transport Layer TCP,

More information

COMP/ELEC 429/556 Introduction to Computer Networks

COMP/ELEC 429/556 Introduction to Computer Networks COMP/ELEC 429/556 Introduction to Computer Networks Let s Build a Scalable Global Network - IP Some slides used with permissions from Edward W. Knightly, T. S. Eugene Ng, Ion Stoica, Hui Zhang T. S. Eugene

More information

Signature Engines. Understanding Signature Engines CHAPTER

Signature Engines. Understanding Signature Engines CHAPTER CHAPTER B This appendix describes the IPS signature engines. It contains the following sections: Understanding, page B-1 Master Engine, page B-3 Regular Expression Syntax, page B-9 AIC Engine, page B-10

More information

II. Principles of Computer Communications Network and Transport Layer

II. Principles of Computer Communications Network and Transport Layer II. Principles of Computer Communications Network and Transport Layer A. Internet Protocol (IP) IPv4 Header An IP datagram consists of a header part and a text part. The header has a 20-byte fixed part

More information

On Distributed Communications, Rand Report RM-3420-PR, Paul Baran, August

On Distributed Communications, Rand Report RM-3420-PR, Paul Baran, August The requirements for a future all-digital-data distributed network which provides common user service for a wide range of users having different requirements is considered. The use of a standard format

More information

Mobile IP. Mobile Computing. Mobility versus Portability

Mobile IP. Mobile Computing. Mobility versus Portability Mobile IP Mobile Computing Introduction Amount of mobile/nomadic computing expected to increase dramatically in near future. By looking at the great acceptance of mobile telephony, one can foresee a similar

More information

Chapter 4 Network Layer

Chapter 4 Network Layer Chapter 4 Network Layer CPSC 335 Data Communication Systems Readings: 4.4.3, 4.4.4, 4.5, 4.5.1 David Nguyen Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March

More information

Scanning. Course Learning Outcomes for Unit III. Reading Assignment. Unit Lesson UNIT III STUDY GUIDE

Scanning. Course Learning Outcomes for Unit III. Reading Assignment. Unit Lesson UNIT III STUDY GUIDE UNIT III STUDY GUIDE Course Learning Outcomes for Unit III Upon completion of this unit, students should be able to: 1. Recall the terms port scanning, network scanning, and vulnerability scanning. 2.

More information

Internet Protocol and Transmission Control Protocol

Internet Protocol and Transmission Control Protocol Internet Protocol and Transmission Control Protocol CMSC 414 November 13, 2017 Internet Protcol Recall: 4-bit version 4-bit hdr len 8-bit type of service 16-bit total length (bytes) 8-bit TTL 16-bit identification

More information