Network+ Week 5: Introduction to TCP/IP

Transcription

1 Network+ Week 5: Introduction to TCP/IP IP Terminology Bit A bit is one digit, either a 1 or a 0. Byte A byte is 7 or 8 bits, depending on whether parity is used. Assume 8. Also called an Octet. Network address This is the designation used in routing to send packets to a remote network for example, , , and Broadcast address The broadcast address is used by applications and hosts to send information to all hosts on a network. Examples include , which designates all networks and all hosts; , which specifies all subnets and hosts on network ; and , which broadcasts to all subnets and hosts on network The Hierarchical IP Addressing Scheme An traditional IP address consists of 32 bits of information, 32 ones and zeros. These bits are divided into four sections, referred to as octets or bytes, and four octets sum up to 32 bits (8 4=32). Three different notations: Binary, as in Dotted-decimal, as in Hexadecimal, as in AC.10.1E.38 The 32-bit IP address is known as a structured or hierarchical address, as opposed to a flat, or nonhierarchical address. The major advantage of this scheme is that it can handle a large number of addresses: 2 32 or 4,294,967,296. The reason flat-addressing is not used for IP addressing Is that if every address were unique and not grouped in any way, all routers on the Internet would need to store the address of each and every machine on the Internet. This would make efficient routing impossible. Addresses use a two- or three-level hierarchical addressing scheme that is structured by network and host or by network, subnet, and host, which is the hierarchical scheme. It s functionally very similar to telephone numbers with area codes, prefixes and local number.

2 Network Addressing The network address uniquely identifies each network. Every machine on the same network shares that network address as part of its IP address. The host address is assigned to, and uniquely identifies, each machine on a network. This part of the address must be unique because it identifies a particular machine. In the simplest scheme for determining address hierarchy, the binary value of the first few digits of an IP address are used to divide the network portion of the address from the host portion. Subdividing an IP address into a network and host address is determined by the class designation of your network. To ensure efficient routing, Internet designers defined a mandate for the leading-bits section of the address for each different network class. A router can tell that a Class A network address always starts with a 0, and that router might be able to speed a packet on its way after reading only the first bit of its address. IPv4 Most of the internet works via IP version 4, a 32-bit address scheme that consists of four octets of eight binary digits in each octet. Each octet or byte can have a decimal value from Each address has a network portion and a node portion, determined by the subnet mask. The Host portion of address can be further divided to create a sub-network address. Some host addresses reserved for special use. 0 and 255 are reserved and cannot be used by an individual computer. All host bits set to 0 identify the network (e.g ). All host bits set to 255 is known as a broadcast address. (e.g ). IPv4 communications can be

3 Unicast - A standard host-to-host data exchange Multicast A communication from one host to many specific recipients (not common) Broadcast A communication from one host to all hosts on the same network or subnetwork. IPv4 Address Classifications Class A addresses used for large networks. High-order bit is always 0, 7 bits are available to define 127 networks. The remaining 24 bits allow for 16,777,214 hosts on a single LAN. Class B addresses used for medium sized networks. The two high-order bits are 10 (that is a binary 1, 0). Remaining 14 bits used to define 16,384 networks. The remaining 16 bits allow for 65,534 hosts on a single LAN. Class C addresses are used for smaller networks. The three high-order bits are always 110 (binary). The remaining 21 bits are used to define 2,097,152 networks (LANs). The remaining 8 bits allow for 254 hosts on a LAN. Class D addresses are used for multicast addresses. The four high-order bits are The remaining 28 bits allow for 268 million addresses. Multicast addresses are used to send the same information to many hosts at once; they are generally not used for internet-wide applications; the Mbone video multicasting system was found to cause internet-wide slowdowns when it was used for public applications. Class E addresses are reserved for experimental use. The four high-order bits are There are no general-purpose uses for these addresses. Class Starting Address Ending Address Number of hosts per network Default Subnet Mask A B C = = = D Not applicable Not applicable E Not applicable Not applicable

4 Reserved IPv4 Address Classifications to Loopback address used for testing local TCP/IP setup * These addresses cannot (should not, at least) be passed by routers, and so they are safe to use on internal networks. What that means in practice is that everyone who wants an IP network uses one of these ranges for their internal network, while routers and other devices translate and track internet requests between real Internet accesses and the internal ones. These addresses break the rule that every address must be unique; there are probably millions of devices around the world that think they are * x.y is interesting because it is reserved as a class B network instead of a class C, even though it is above the border for typical class B networks. APIPA Automatic Private Internet Protocol Addressing This range is reserved for devices that are configured to have TCP/IP settings given to them, but did not receive a configuration. Seeing an address in this range probably means a computer is not talking to the network it is supposed to be talking to. APIPA exists so that devices on an unconfigured network connection might still be able to perform some basic network communication tasks, such as file sharing. Other Reserved IP Addresses Network Address of all 0s Means This network or segment Network Address of all 1s Means all networks Loopback address, used for testing Host Address of all 0s Means Any host on specific network Host Address of all 1s Means All hosts on specific network (broadcast) Used by some routers to designate the default route Broadcast to all networks

5 IP Subnetting An IP address can be modified by using hosts bits as additional network bits (referred to as borrowing host bits ). This has the effect of reducing the number of available hosts, but means that a network admin can split his IP addresses to define more than one network. The Subnet masks value defines the unique network, and also a unique host on that network. If a bit is on (1) in the mask, the equivalent bit in the address identifies the network. If a bit is off (0) in the mask, the equivalent bit in the address identifies the node. The 32-bit value is converted to dotted-decimal notation similar to IP address. Default Subnet Masks for standard IP classes: Class A: Class B: Class C: Routers use the subnet mask to extract the network portion of the address and send packets along the proper route. Once the packets reach the proper local network, a service called ARP (address resolution protocol) translates the full IP address into a MAC address for delivery to the proper NIC. IPv6 IP version 6 was originally designed due to the shortage of IPv4 addresses. It uses a 128-bit address scheme, which is 79 octillion times as many addresses as IPv4. It uses eight sets of four hexadecimal digits instead of binary or decimal digits. For example, 3FFE:0B00:0800:0002:0000:0000:0000:000C is a valid IPv6 address. Addresses can be abbreviated by dropping leading zeros (such as in 0B00). Addresses can also drop single groupings of zero octets between numbers provided it is an entire octet and you replace them with a double colon, so that my example address could also be written 3FFE:B00:800:0002::000C. The Zero compression rule can t be used to drop more than one grouping of zero octets (Only one set of double colons allowed). Some addresses reserved for special use. ::/0 is the default host address ::1/128 is reserved for local loopback. IPv6 includes provisions for IPv4 hosts. ::xxx.xxx.xxx.xxx is always valid and compatible for IPv6 networks connecting to IPv4 hosts.

6 An IPv6 Address is divided up differently from IPv4, as seen below. IPv6 uses a slightly different set of network communications vs. those available in IPv4. Unicast Packets addressed to a unicast address are delivered to a single interface. Link-local addresses These are like the private addresses in IPv4 in that they re not meant to be routed. Functionally similar to APIPA addresses. Site-local addresses These are addresses that are routed throughout an organization but are not available to the wider internet. These are very much like the reserved address ranges available on IPv4. Unique local addresses These addresses are also intended for non-routing purposes, but they are nearly globally unique. They allow communication throughout a site while being routable to multiple local networks but not the internet. Name Resolution Every internet connected computer has a Fully Qualified Domain Name (FQDN), which consists of a host name and a domain name. The process of converting an IP address to a FQDN is called Name Resolution. Name resolution is provided by a HOSTS file, DNS (and WINS in some cases). HOSTS file Text file that associates IP addresses with host names. Computers that are configured to use IP networking always have a hosts file and that file is consulted prior to DNS queries. Linux and other Unix related operating systems - /etc Windows 95/Windows 98/Windows Me - C:\windows\ Windows NT/2000/Windows XP c:\windows\system32\drivers\etc\

7 (On Vista the file is write-protected and difficult to modify; you have to be using a program that you have chosen to Run as Administrator to change it.) Mac OS - System Folder:Preferences or System Folder Hosts files are static and must be updated manually. Must be stored on every computer on the network and updated on every computer when changes are made. Most organizations do not use hosts files because of the difficulty of updating them on many computers. Domain Name Services (DNS) DNS is an internet protocol and service that translates host names and domain names to IP addresses. It can also do reverse look-ups (IP addresses to host or domain names). DNS tables are composed of records. Each record has a host name, a record type, and an address. A computer using DNS (pretty much all of them, in other words) will first look in its own DNS cache, then query its configured DNS Server on the Internet. If that DNS server does not know the address of the name being queried, it will ask another DNS server, which can ask another and so on. Ultimately, there are 13 Root DNS Servers that are responsible for maintain the lists of all the DNS Servers on the Internet. Windows Internet Naming Service (WINS) WINS provides for mappings of NetBIOS (Windows) names to IP Addresses. Prior to the release of Windows 2000, NetBIOS names could be different from Internet Hostnames. WINS allows for dynamic updates of name-to-address mappings, which not every DNS server supports. Dynamic updates allow for the internet address associated with a name to change without deleting and recreating the name to address record. Microsoft considers WINS to be a legacy service, but it is sometimes necessary or useful, particularly if an organization still has older PCs. Microsoft DNS can communicate with WINS to obtain information so DNS tables don t have to be updated manually. WINS is not widely used or needed on modern networks. NETBIOS naming has its own lookup file, stored in the same directory as the HOSTS file, which is called LMHOSTS. Windows also comes with a sample file called LMHOSTS.SAM.

8 TCP/IP and the DoD Model The DoD model is basically a condensed version of the OSI model. It s composed of four, instead of seven, layers: Process/Application layer Host-to-Host layer Internet layer Network Access layer Process/Application layer Upper layer mush, as always. Host-to-Host layer - parallels the functions of the OSI s Transport layer, defining protocols for setting up the level of transmission service for applications. Its job is to create reliable end-to-end communication and ensure the error-free delivery of data. Handles packet sequencing and maintains data integrity. Internet layer - corresponds to the OSI s Network layer, designating the protocols relating to the logical transmission of packets over the entire network. Handles addressing and routing of hosts by IP Addresses. Network Access layer - monitors the data exchange between the host and the network. The equivalent of the Data Link and Physical layers of the OSI model. Oversees hardware addressing and defines protocols for the physical transmission of data.

9 The Process/Application Layer Protocols Telnet Port: 23 Mainly used for terminal emulation creating a virtual keyboard and display on a remote system that could be used like the dumb terminals that were (are) commonly attached to mainframes and minicomputers running UNIX or VMS. Telnet to ports other than 23 allows interactive connections to communicate with other TCP services. Telnet offers no security or encryption and is being replaced by Secure Shell (SSH) when security across the remote-configuration session is needed or desired. File Transfer Protocol (FTP) Port: 20 (data) and 21 (commands) File Transfer Protocol (FTP) is the protocol that actually lets users transfer files across an IP network. FTP is also a stand-alone program. Operating as a protocol, FTP is used by some network applications.

10 As a program, it s employed by users to perform file operations by hand. FTP also allows for access to both directories and files and can accomplish certain types of directory operations, such as relocating files into different directories or applying file security permissions. FTP commands are standardized regardless of the client and server. Accessing a host through FTP is only the first step, though. Users must then be subjected to an authentication login that s probably secured with passwords and usernames implemented by system administrators to restrict access. Some FTP sites allow for anonymous (restricted) access. Anonymous downloads might be pre-approved, but anonymous uploads will almost always be strictly controlled. Even when employed by users manually as a program, FTP s functions are limited to listing and manipulating directories, typing file contents, and copying files between hosts. FTP cannot execute programs. FTP transfers data as plain text. There is no attempt to secure or encrypt FTP communication. Secure File Transfer Protocol (SFTP) Secure File Transfer Protocol (SFTP) is FTP over SSH (Secure Shell). It applies encryption to FTP data transfers but requires an SSH connection beforehand. No port because it depends on the port of the SSH server (which is usually 22). Trivial File Transfer Protocol (TFTP) Port: 69 Trivial File Transfer Protocol (TFTP) is a subset of FTP that allows only for sending and receiving files. It does not support authentication or any other file operation (e.g. directory browsing). It is most often used to store or retrieve configuration files for network devices such as cable modems. Simple Mail Transfer Protocol (SMTP) Port: 25 or 465 for SMTP over SSL or 587 for Secure SMTP Simple Mail Transfer Protocol (SMTP) is the standard method for communication for all but the final step of delivery to a client program. SMTP is notoriously insecure, so there are a number of different extensions designed to secure it. Post Office Protocol (POP) Port: 110 or 995 for POP3 over SSL (POP3S) Post Office Protocol (POP) is a simple mail-delivery protocol that has very limited options for security or client configuration. Mail that is stored on the server is downloaded to an authenticated client. POP3 is normally configured to delete mail from the server once it has been delivered so that messages are ultimately only stored on clients.

11 Internet Message Access Protocol, Version 4 (IMAP4) Port: 143 or 585 for IMAP-SSL or 993 for IMAPS IMAP is a full featured mail delivery system. It is designed so that messages remain on the server; clients are able to download a simplified set of header information so that users can preview messages before choosing to download them. IMAP also supports folder structures on the server. Like SMTP and POP3, there are several ways to secure IMAP4. Gmail famously allows IMAP mail for all clients; most ISP and webmail providers also allow IMAP connections from mobile devices even if they do not allow them for desktop software. Transport Layer Security (TLS) Both Transport Layer Security (TLS) and its forerunner, Secure Sockets Layer (SSL), are cryptographic protocols used to enable secure online data-transfer activities. SSL and TLS are functionally the same thing Session Initiation Protocol (SIP) Port: 5060 TCP/UDP SIP is used to construct and deconstruct multimedia communication sessions for many things like voice and video calls, video conferencing, streaming multimedia distribution, instant messaging, presence information, and online games over the Internet. Line Printer Daemon (LPD) The Line Printer Daemon (LPD) protocol is designed for printer sharing. The LPD, along with the Line Printer (LPR) program, allows print jobs to be spooled and sent to the network s printers using TCP/IP. Most stand-alone network printers use some variation on LPD/LPR to operate. Simple Network Management Protocol (SNMP) Ports: 161, 162 Simple Network Management Protocol (SNMP) collects and manipulates valuable network information. It gathers data by polling the devices on the network from a management station at fixed or random intervals, requiring them to disclose certain information. In theory, SNMP notifies administrators of any sudden change from baseline settings. Devices that are configured to report via SNMP are called Agents and the settings they watch are called traps. Administrators need to use some kind of Network Management Software to monitor SNMP agents. SNMP is notoriously insecure prior to version 3 of the protocol, though version 3 does support authentication and encryption; and is still widely insecure because many administrators do not bother to change the default authentication settings on their devices.

12 Secure Shell (SSH) Port: 22 Secure Shell (SSH) protocol sets up a secure Telnet session over a standard TCP/IP connection. It is employed for doing things like logging into other systems, running programs on remote systems, and moving files from one system to another. Since SSH is essentially a version of Telnet that supports strong security, many other network protocols can be run on top of an SSH connection, making it a de facto VPN protocol, especially on UNIX systems. Hypertext Transfer Protocol (HTTP) Port: 80 or 443 (HTTPS or HTTP over SSL) HTTP is used to carry data from a web server to a web browser. HTTP traffic is normally carried as plain text, neither encrypted nor secured. HTTPS is a variation on standard HTTP that uses public-private key exchange with third party servers and mutual authentication to deliver encryption for data transfers. It is not widely used because it is considered very resource intensive. Network Time Protocol (NTP) Port: 123 UDP Network Time Protocol is a system for ensuring that as much as possible, clocks for internet-connected computers are synchronized. This isn t so important for client computers, but it s absolutely crucial for server systems. Network News Transfer Protocol (NNTP) Port: 119 Network News Transfer Protocol (NNTP) is the standard method for accessing USENET, the internetwide bulletin board system. Secure Copy Protocol (SCP) Secure FTP (SFTP) Port: Usually 22 These protocols are both examples of another TCP service being tunneled through an SSH connection. In either case, they allow a file operation to be performed over an encrypted connection and are therefore more secure than the baseline versions.

13 Light weight Directory Access Protocol (LDAP) Port: 389 or 636 (LDAP-S) This protocol standardizes how you access directory services That are commonly used to list groups of people (phone books or HR data) or important resources (shared folders or printers). Most computer system management software is made to tie in or extend LDAP, such as Microsoft s Active Directory and Novell s NDS. Domain Name Service (DNS) Port: 53 Domain Name Service (DNS) resolves hostnames specifically, Internet names, such as to their corresponding IP addresses. Dynamic Host Configuration Protocol (DHCP)/Bootstrap Protocol (BootP) Port: 67, 68 UDP DHCP assigns IP addresses to hosts with information provided by a server. It allows easier administration and works well in small to even very large network environments. DHCP differs from Bootstrap Protocol (BootP) in that BootP assigns an IP address to a host but the host s hardware address must be entered manually in a BootP table. Unlike DHCP, it is possible to use BootP to configure a network bootable operating system, something that s not uncommon for network devices and some UNIX systems. DHCP and BootP can provide a whole host of information in addition to an IP address, with the most common options being: IP address Subnet mask Domain name Default gateway (router) DNS The DHCP Negotiation Process 1. The DHCP client broadcasts a DHCPDiscover message looking for a DHCP server (Port 67). a. This broadcast is sent as both an IP broadcast to b. And as a media-wide broadcast, to MAC address FF:FF:FF:FF:FF:FF 2. The DHCP server that received the DHCP Discover message sends a unicast DHCPOffer message back to the host. 3. The client then broadcasts to the server a DHCPRequest message asking for the offered IP address and possibly other information.

14 4. The server finalizes the exchange with a unicast DHCPAcknowledgment message. On a network without a DHCP server, address information can be configured manually. Such information is considered static, which means that it does not change. It s a good practice to reserve some addresses on a network for static assignment, especially for servers. Windows provides what is called Automatic Private IP Addressing (APIPA). With APIPA, clients can automatically self-configure an IP address and subnet mask when a DHCP server isn t available. The IP address range for APIPA is through The client also configures itself with a default class B subnet mask of If a DHCP server is present and your host is using an APIPA address, this means the DHCP client on your host is not working, or the server is down or can t be reached because of a network issue. The Host-to-Host Layer Protocols The main purpose of the Host-to-Host layer is to shield the upper-layer applications from the complexities of the network. These protocols deal with streams of data from the upper layer without concern for their contents. Transmission Control Protocol (TCP) User Datagram Protocol (UDP)

15 Transmission Control Protocol (TCP) Transmission Control Protocol (TCP) takes large blocks of information from an application and breaks them into segments. It numbers and sequences each segment so that the destination s TCP process can put the segments back into the order the application intended. After segments are sent, TCP on the transmitting host waits for an acknowledgment from the receiving end s TCP process, retransmitting those segments that aren t acknowledged. TCP is connection-oriented; it starts a session with a three way handshake. The transmitting device first establishes a connection-oriented session with its peer system. TCP generates a great deal of overhead on a per-connection basis because of all the error-checking. A TCP segment includes the source port, destination port, sequence and acknowledgement number and a checksum value.

16 The TCP header is 20 bytes long, or up to 24 bytes with options. User Datagram Protocol (UDP) UDP is connectionless and unconcerned with reliable transmission of messages. UDP is best effort delivery, not guaranteed. UDP is useful when reliability is handled at the Application layer or when data is time-sensitive so that retransmission is impossible. UDP does not sequence the segments and doesn t care in which order the segments arrive at the destination. UDP does not create a virtual circuit or perform a three way handshake. A UDP segment is essentially a header containing a source and destination port, a checksum for data integrity, and a payload of data. It s far less complicated than a TCP segment.

17 TCP Sequenced Reliable Connection-oriented Virtual circuit High overhead Acknowledgments Windowing flow control UDP Unsequenced Unreliable Connectionless No virtual circuit Low overhead No acknowledgment No windowing or flow control Port Numbers TCP and UDP use port numbers to communicate with the mushy upper layers Originating-source port numbers are dynamically assigned by the source host and will usually have a value of 1024 up to Ports 1023 and below are defined in RFC 3232, which discusses what are called well-known port numbers. Virtual circuits that don t use an application with a well-known port number are assigned port numbers randomly from a specific range instead. These port numbers identify the source and destination application or process in the TCP segment. Port numbers for TCP and UDP Partial TCP UDP Port Numbers Well-Known Ports Port No. Protocol Service Name Aliases Comment 20 TCP ftp-data File Transfer 21 TCP ftp FTP Control

18 22 TCP ssh Secure Shell 23 TCP telnet Telnet 25 TCP Smtp mail Simple Mail Transfer 53 TCP domain Domain Name 53 UDP domain Domain Name Server 67 UDP bootps dhcps Bootstrap Protocol Server 68 UDP bootpc dhcpc Bootstrap Protocol Client 69 UDP tftp Trivial File Transfer 80 TCP http www, http World Wide Web 88 TCP kerberos krb5 Kerberos 88 UDP kerberos krb5 Kerberos 110 TCP pop3 postoffice Post Office Protocol - Version TCP nntp usenet Network News Transfer Protocol 123 UDP ntp Network Time Protocol 137 TCP netbios-ns nbname NETBIOS Name Service 137 UDP netbios-ns nbname NETBIOS Name Service 138 UDP netbios-dgm nbdatagram NETBIOS Datagram Service 139 TCP netbios-ssn nbsession NETBIOS Session Service 143 TCP imap imap4 Internet Message Access Protocol 161 UDP snmp snmp SNMP 162 UDP snmptrap snmp-trap SNMP TRAP 179 TCP bgp Border Gateway Protocol 194 TCP irc Internet Relay Chat Protocol 389 TCP ldap Lightweight Directory Access Protocol 443 TCP https MCom 443 UDP https MCom 445 TCP Microsoft CIFS 445 UDP Microsoft CIFS

19 The Internet Layer Protocols The internet layer in the DoD model: It deals with routing and it provides a cohesive addressing scheme to upper-level protocols. Internet Protocol (as in IP as in TCP/IP) provides a single addressing model that works regardless of the underlying network type. Protocols at the Internet Layer Internet Protocol (IP) Internet Control Message Protocol (ICMP) Address Resolution Protocol (ARP) Reverse Address Resolution Protocol (RARP) Proxy ARP Internet Protocol (IP) IP receives segments from the Host-to-Host layer and fragments them into packets. IP works by assigning an address to each connected node on a network. When a packet of data needs to be transferred, IP looks at the destination address of that packet and then to a set of rules called a routing table to decide how to forward that packet to another member of the network. When the packet gets to the proper network, lower-level protocols are able to locate the specific host and deliver data. IP packets look like this. Note that there is no indication on the IP level about the contents of the packet.

20 Internet Control Message Protocol (ICMP) ICMP is a management protocol and messaging service provider for IP. ICMP packets have the following functions: They can provide hosts with information about network problems. They are encapsulated within IP datagrams. The following are some common events and messages that ICMP relates to: Destination Unreachable - If a router can t send an IP datagram any further, it uses ICMP to send a message back to the sender, advising it of the situation. Buffer Full - If a router s memory buffer for receiving incoming datagrams is full, it will use ICMP to send out this message until the congestion abates. Hops - Each IP datagram is allotted a certain number of routers, called hops, to pass through. If it reaches its limit of hops before arriving at its destination, the last router to receive that datagram deletes it. The executioner router then uses ICMP to send an obituary message, informing the sending machine of the demise of its datagram. Important ICMP Commands Ping - Ping uses ICMP echo request and reply messages to check the physical and logical connectivity of machines on an internetwork. Traceroute - Traceroute uses IP packet Time-to-Live time-outs to discover the path a packet takes as it traverses an internetwork. Address Resolution Protocol (ARP) Address Resolution Protocol (ARP) finds the hardware address of a host from a known IP address. When IP has a datagram to send, it must inform a Network Access protocol (Ethernet or ), of the destination s hardware address on the local network. If IP doesn t find the destination host s hardware address in its cache of addresses (the ARP cache), it uses ARP to find this information. ARP then sends out a broadcast asking the machine with the specified IP address to reply with its hardware address. The address in question replies and actual data transfer can follow. This process is sometimes called ARPing.

21 Reverse Address Resolution Protocol (RARP) Reverse Address Resolution Protocol (RARP) discovers the identity of the IP address for diskless machines by sending out a packet that includes its MAC address and a request for the IP address assigned to that MAC address. A RARP server responds with with IP address and other relevant information. The difference between this process and DHCP is very subtle and mostly based on involvement of diskless workstations and a reserved, pre-assigned address.

22 Proxy Address Resolution Protocol (Proxy ARP) Proxy ARP is a service for handling network traffic in situations where that traffic might not have default route. This is important and useful for devices like VPN concentrators or in situations where a default gateway is unavailable.