Experiential Learning Workshop on Understanding Network Basics

Transcription

1 Experiential Learning Workshop on Understanding Network Basics June 27, 2018 Dr. Ram P Rustagi Professor, CSE Dept KSIT, Bangalore rprustagi@ksit.edu.in

2 Resources & Acknowledgements Resources Learning.html Articles in ACCS Journal Source code and examples for articles Slides for this talks Example web pages, and programs Acknowledgements: Computer Networks: A Top Down Approach - Kurose, Ross!2

3 Day 1: Basics of Networking Overview Introduction to basic networking Tools Handson 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!3

4 Day 2: Basics of Socket Programming Overview: sockets Simple client server programs Handson-1: Writing TCP and UDP server Errors in socket programming Network byte order, buffer mgmt, socket close Handson-2: Network byte order, socket close Multiple concurrent client communication Socket call return value and reliability Handson-3: Handling concurrent clients, listen TCP Streaming and UDP Message boundary Handson-4: TCP streaming & UDP msg boundary Summary!4

5 Day 3: Basics of Web Security Overview: HTTPS protocol Server certificate and server authentication Handson-1: Deploying a SSL certificate Mixed content and browser warnings Locks icons and HTTP Status Handson-2: Creating website with mixed content MITM attack and ARP spoofing MITM with browser and information stealing Handson-3: Implementing MITM with arpspoofing Understanding HSTS, CSP Handson-4: Implementing ARP Spoofing Summary!5

6 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!6

7 NETWORK Novel Experience of Theoretical, Working, Operational, and Realized Knowledge Acronym!7

8 The Web Today Total num of hostnames and active sites (June 2018) src: category/web-server-survey/ Number of sitenames and active sites Sitenames: 1.6+B, Active sites: 177+M Web server vendors June 2018: Apache: 25%, MS IIS : 32%, Nginx: 23% Web Clients: GUI browsers, text browsers Communication protocols HTTP, HTTPS Extension of HTTP: WebDAV, CarDAV, CalDAV!8

9 Setup Requirement Internet S1 Ha: /24 Hb: /24!9

10 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!10

11 Tools wireshark wsug_html_chunked/ Enables viewing of bytes sent/recd on network Capture and Display filters Graphical, built on tcpdump TCP session display Changing UI options tcpdump: command line capture tool -o output file -c packet count -i interface names!11

12 !12

13 !13

14 L2 L3 L4 L7!14

15 Wireshark: UI Options Color coding Time format Packet reordering (in display) Defining protocol Using display filter Following TCP Stream Capture packets with proper capture filter needed for analyzing packet layers!15

16 Wireshark capture filters Traffic between A and either B or C host A and \( B or C\) Traffic between A any host except B host A and not B Capture TCP SYN or FIN pkts tcp[tcpflags] & (tcp-syn tcp-fin)!= 0 Web traffic containing data i.e. avoid TCP acks tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2))!= 0)!16

17 Wireshark Display Filters Source IP filter ip.src == Destination IP filter ip.dst == ip.dst!= Protocol filter http icmp Port number tcp.port eq 80 TCP Seq tcp.stream eq 1!17

18 Wireshark - Misc Saving file Saving selected packets Reading from file Time display format Statistics Other options!18

19 tcpdump Command line interface ASCII content Capture full packet Capture filters Output file Ethernet frame display!19

20 tcpdump - Usage Examples To capture between two specified hosts and save $ sudo tcpdump -n -i eth0 -w file.pcap host <A> and host <B> To capture 100 packets received from server X $ tcpdump -n -i eth0 -c 100 src <X> To capture HTTP packets with data $ sudo tcpdump -n -i eth0 tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2))!= 0)'!20

21 Application Software Apache Web Server ( Configurations (/etc/apache2/apache2.config) /etc/apache2/sites-available/000-default.conf Directives Logging DocumentRoot Loadable Modules Virtual Host Firefox browser Options for configurations: about:config Nginx server, IIS server.!21

22 Tools wget: wget [options] <url> Options -d # to debug headers -O <file> # to save with different name -i <urlsfile> # list of urls in a file -c # to resume to broken download -b # run in background --limit-rate=500k --header=<headers> --http-user=user --http-password=.. -mk # mirroring with local link conversion!22

23 Tools - nc nc (netcat) Works as both layer client & server Supports both TCP and UDP Supports both IPv4 and IPv6 Common use Simple TCP/UDP based data transfer Shell script based HTTP clients and servers Network daemon testing SOCKS or HTTP ProxyCommand for ssh!23

24 Tools - nc nc usage -l acting as server -u use UDP -i for interval based transmission (lines) -k for keeping server up after connection close Examples nc <servername> <server port> # client nc -l port # server To transfer files Server: nc -l <port> >file.dat Client: cat <file> nc <servername> <port>!24

25 Usage: nc Terminating connection after idle time nc -w 10 <server> <port> # timeout 10s Don t use with server option Providing remote shell access on server to a client Create a FIFO file rm -f /tmp/f; mkfifo /tmp/f run nc on server by executing the shell cat /tmp/f /bin/bash -i 2>&1 nc -l 2222 > /tmp/f!25

26 Tools - ping ping (Packet Inter Network Groper) Checking reachability ping hostname -i changing packet interval -c packet count -f flooding the network -q quite mode -s change packet size -W response timeout!26

27 Usage: ping $ ping -c 10 PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=47 time= ms 64 bytes from : icmp_seq=1 ttl=47 time= ms 64 bytes from : icmp_seq=2 ttl=47 time= ms 64 bytes from : icmp_seq=3 ttl=47 time= ms 64 bytes from : icmp_seq=4 ttl=47 time= ms 64 bytes from : icmp_seq=5 ttl=47 time= ms 64 bytes from : icmp_seq=6 ttl=47 time= ms 64 bytes from : icmp_seq=7 ttl=47 time= ms 64 bytes from : icmp_seq=8 ttl=47 time= ms 64 bytes from : icmp_seq=9 ttl=47 time= ms ping statistics packets transmitted, 10 packets received, 0.0% packet loss round-trip min/avg/max/stddev = / / / ms MacBook-Pro:EL-Understanding-Network-Delays ramrustagi$!27

28 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!28

29 Hands-On 1 nc : chat between two systems Using both UDP and TCP ping: understand delay and response. check google and yahoo reachability. check your favourite website reachability wget: Downline contents of a website for offline use. wireshark Access and check capture. chat (nc) and analyze capture traceroute a site and analyze capture!29

30 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!30

31 ISO/OSI reference model Internet stack missing following layers! presentation: allow applications to interpret meaning of data, e.g., encryption, compression, machine-specific conventions session: synchronization, checkpointing, recovery of data exchange Source: Kurose, Ross: Computer Networking, A Top Down Approach application presentation session transport network link physical!31

32 Internet protocol stack Application: supporting network applications- FTP, SMTP, HTTP Transport: process-process data transfer - TCP, UDP Network: routing of datagrams from source to destination IP, routing protocols Data Link: data transfer between neighboring network elements Ethernet, (WiFi), PPP Physical: bits on the wire application transport network link physical Source: Kurose, Ross: Computer Networking, A Top Down Approach!32

33 message segment datagram frame H l H n H n H t H t H t M M M M source application transport network link physical Encapsulation Source: Kurose, Ross: Computer Networking, A Top Down Approach link physical switch H l H n H n H t H t H t M M M M destination application transport network link physical H l H n H n H t H t M M network link physical H n H t M router!33

34 HTTP: Hyper Text Transfer Protocol Application layer protocol Defines how client requests web page from server A client/server model client: browser that requests, receives, (using HTTP protocol) and displays Web objects server: Web server sends (using HTTP protocol) objects in response to requests HTTP overview PC running Firefox browser iphone running Safari browser Source: Kurose, Ross: Computer Networking, A Top Down Approach HTTP request HTTP response HTTP request HTTP response server running Apache Web server!34

35 HTTP overview Underlying protocol: TCP HTTP is stateless protocol Server has no information about past requests from same clients. Stateful protocol Server is aware of past requests from clients. Server maintains the state of the client. If server crashes, the state may become inconsistent.!35

36 HTTP request message Two types of HTTP messages: request, response HTTP request message: ASCII (human-readable format) carriage return character request line (GET, POST, HEAD commands) header lines line-feed character GET /Workshop/PESU/hello.html HTTP/1.1\r\n Host: \r\n User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5)\r\n Accept: text/html,application/xhtml+xml\r\n Accept-Language: en-us,en;q=0.5\r\n Accept-Encoding: gzip,deflate\r\n Accept-Charset: ISO ,utf-8;q=0.7\r\n Keep-Alive: 115\r\n Connection: keep-alive\r\n If-Modified-Since: Tue, 26 Jul :47:12 GMT \r\n carriage return, line feed at start of line indicates end of header lines!36

37 HTTP response message status line (protocol status code status phrase) header lines HTTP/ OK\r\n Date: Sun, 26 Sep :09:20 GMT\r\n Server: Apache/ (CentOS)\r\n Last-Modified: Tue, 30 Oct :00:02 GMT\r\n ETag: "17dc6-a5c-bf716880"\r\n Accept-Ranges: bytes\r\n Content-Length: 2652\r\n Keep-Alive: timeout=10, max=100\r\n Connection: Keep-Alive\r\n Content-Type: text/html; charset=iso \r\n \r\n data data data data data... data, e.g., requested HTML file!37

38 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!38

39 HTTP request message: general format method sp URL sp version cr lf header field name value ~ ~ cr lf request line header lines header field name value cr lf cr lf entity body ~ ~ body!39

40 TCP segment structure URG: urgent data (generally not used) ACK: ACK # valid PSH: push data now (generally not used) RST, SYN, FIN: connection estab (setup, teardown commands) Internet checksum (as in UDP) head len 32 bits source port # dest port # sequence number acknowledgement number not used checksum U A P R S F application data (variable length) receive window Urg data pointer options (variable length) counting by bytes of data (not segments!) # bytes rcvr willing to accept Source: Kurose, Ross: Computer Networking, A Top Down Approach!40

41 Wireshark Capture Filters Connection setup tcp[tcpflags] & (tcp-syn)!= 0 Connection teardown only tcp[tcpflags] & (tcp-fin)!= 0 Connection reset only tcp[tcpflags] & (tcp-rst)!= 0 HTTP connections with some data 'port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2))!= 0)!41

42 TCP seq. numbers, ACKs Host A Host B User types C host ACKs receipt of echoed C Seq=42, ACK=79, data = C Seq=79, ACK=43, data = C Seq=43, ACK=80 host ACKs receipt of C, echoes back C simple telnet scenario Source: Kurose, Ross: Computer Networking, A Top Down Approach!42

43 TCP seq. numbers, ACKs v TCP Bi-Directional Data Xfer : Simple example v Server program: (i=6; while [ $i -gt 0 ]; do sleep 1; echo "From Server, the value is $i"; i=$(($i - 1)); done) nc -l 3333 v Client programs: (i=0; while [ $i -le 5 ]; do echo "Request $i"; sleep 1; i=$(($i + 1)); done) nc <m/c IP> 3333!43

44 Transport Layer Protocol Characteristics Connection less May arrive out of order In order delivery requires pkts to be numbered. No acknowledgement, Packets may be lost No prior handshake Connection oriented Setup, data transfer and teardown phase Provides reliability, ordered delivery Handles error control in a better way *!44

45 Transport Layer Reliability Support Reliability Needs error and flow control Compels slower service Unreliable protocol No extra overheads Reliability at data link layer Provides error and flow control Why do we need it at Transport layer when Link layer provides the same *!45

46 IP datagram format IP protocol version number header length (bytes) type of data max number remaining hops (decremented at each router) upper layer protocol to deliver payload to how much overhead? 20 bytes of TCP 20 bytes of IP = 40 bytes + app layer overhead ver head. len 16-bit identifier time to live type of service upper layer 32 bits flgs length 32 bit source IP address data (variable length, typically a TCP or UDP segment) fragment offset header checksum 32 bit destination IP address options (if any) total datagram length (bytes) for fragmentation/ reassembly e.g. timestamp, record route taken, specify list of routers to visit.!46

47 ARP: IP to MAC 32-bit IP address: Network-layer address for interface MAC (or Ethernet) address: 48 bit MAC address (burned in NIC) Sometimes software settable e.g.: 1A-2F-BB AD!47

48 Ethernet frame structure Encapsulates IP datagram (or other network layer protocol packet) in Ethernet frame Structure of Ethernet Frame preamble: 7 bytes with pattern followed by one byte with pattern used to synchronize receiver, sender clock rates type preamble dest. address source address data (payload) CRC!48

49 Ethernet frame structure addresses: 6 byte - src, dstn MAC addresses Adaptor receives pkt based on dstn MAC field Forwards to higher layer on matching unicast, multicast or broadcast address Discards otherwise type: higher layer protocol (e.g. IP) CRC: error detected: frame is dropped type preamble dest. address source address data (payload) CRC!49

50 Ethernet: unreliable, connectionless Connectionless: no handshaking between sending and receiving machines Unreliable: receiver doesnt send acks/nacks Ethernet s MAC protocol based on unslotted CSMA/CD with binary backoff!50

51 Self-learning, forwarding: example v frame destination, A, location unknown: Source: A Dest: A A A A flood C B vdestination A location known: selectively send on just one link MAC addr interface TTL A 1 60 A 4 60 switch table (initially empty) 6 A A B C A 4 A A 3!51

52 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!52

53 Handson 2: Analysis of TCP/IP Layers Use wireshark to analyze TCP/IP layers Application layer: Capture web page access, analyze HTTP headers Transport layer: Use nc to communicate between two hosts Analyse TCP headers IP Layer: Analyze IP headers in web packets & nc chat Ethernet layer Analyze src and dstn MAC and type for ping, nc Analyze src/dstn MAC when ping to google.!53

54 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!54

55 src: Chuck Semeria, NSD Marketing, 3Com Corp, 1996

56 Initial IP Addressing (Classful)

57 Dotted Decimal Notation

58 Subnets vip address: subnet part - high order bits host part - low order bits vwhat s a subnet? device interfaces with same subnet part of IP address can physically reach each other without intervening router subnet network consisting of 3 subnets Network Layer 4-40

59 Subnets v Subnet are Identified by subnet masks v A subnet mask defines one network v A router is needed to connect two networks v Masks for classful addresses Class A: or /8 Class B: or /16 Class C: or /24 v Classful addressing is obsolete now replaced with classless addressing (CIDR)

60 IP Subnetting

61 IP addressing: CIDR CIDR: Classless InterDomain Routing subnet portion of address of arbitrary length address format: a.b.c.d/x, where x is # bits in subnet portion of address subnet part /23 host part Network Layer 4-43

62 Subnets v Few terms to understand network portion and host portion network number apply subnet mask to IP address (bitwise AND) Broadcast address set all bits to 1 in host portion network mask set all bits to 0 in host portion first available address in the block value of host portion = 1 last available address in the block value of host portion = 2 n -2

63 Subnetting

64 Subnets how many? Network Layer 4-42

65 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!65

66 Route Aggregation / / / / / / / /

67 Exercise: Summary Route Summary Route?

68 Hierarchical addressing: route aggregation Src: Furouzan - Data Communication and Networking, SIE 4th ed

69 Subnet example Base Net: = /24 Subnet #0: = /27 Subnet #1: = /27 Subnet #2: = /27 Subnet #3: = /27 Subnet #4: = /27 Subnet #5: = /27 Subnet #6: = /27 Subnet #7: = /27

70 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!70

71 Hands-On 3 Internet Ha: / S1 3 Hb: /25 Hc: /26!71

72 Hands-On 3 Internet Ha: / S1 3 Hb: / /25 Hc: /26!72

73 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!73

74 Forwarding Table vneeds at least 4 entries in forwarding table Network Address Network Mask Next Hop Address Interface vforwarding table principles Each routers makes its decision independently Different routers may have different information Tells how to reach destination but not how to get back veffect of Forwarding Table principles Packets are forwarded on hop by hop basis Packets from A to B go via path X but return via path Y

75 Using Forwarding (Routing) Table vfor a given packet take the destination address repeat the following for each entry in routing table apply the netmask match the computed n/w number with routing table entry if matches forward the packet to next-hop on listed interface exit else continue to next entry when no match found (assuming /0 not defined) drop the packet

76 Longest Prefix Match ISPs-R-Us has a more specific route to Organization 1 Organization /23 Organization /23 Organization 7.. Fly-By-Night-ISP Send me anything with addresses beginning /20 Internet /23 Organization /23 ISPs-R-Us Send me anything with addresses beginning /16 or /23 Network Layer 4-54

77 Organization /23 Route Aggregation w/ Longest Prefix Match Exercise: Build Forwarding Table for R1, R2 and R3 Note: R3 will use longest prefix match Organization /23 Organization /23 Organization /23 m2... R1. m7 m0 m0 R2 m1 m1 Send me anything with addresses beginning /20 m0 m1 Send me anything with addresses beginning /16 or /23 Internet R3

78 Design the subnetting/routing N/w given: /24 - Each LAN has 10 hosts - serial link n/w needs two addresses - LAN of R3-R7-R6 needs 3 addresses

79 Day 1: Basics of Networking Overview Introduction to basic networking Tools Hands-on 1: using networking tools TCP/IP Stack 4 layer model Analysis of layers in IP, TCP/UDP and HTTP Handson-2: layers in ping, nc, http IP addressing, subnetting and routing Hierchical addressing Handson-3: Subnet mismatch and reachability Supernetting, longest prefix match Handson-4: Overlapping subnets, longest match Summary!79

80 Hands-On 4 lo i/f: /24 Internet Ha: / S1 3 lo i/f: /27 Hc: /24 Pkts to , and ? Hb: /24!80

81 H a: / /28 Hands-On 4 Internet Ha: /24 Hc: / S1 3 Pkts to , and , and ? Ha: /27 Hb: /24!81

82 Summary Network Tools: wireshark, nc, ping, ssh TCP/IP Stack Packet format: HTTP, TCP, IP, Ethernet IP Addressing IP routing Subnetting Hierarchical addressing!82

83 Thank You!83