Scribe Notes -- October 31st, 2017

Scribe Notes -- October 31st, 2017 TCP/IP Protocol Suite Most popular protocol but was designed with fault tolerance in mind, not security. Consequences of this: People realized that errors in transmission do happen Designed to be robust to failures but not to intentional attacks 4 layer architecture There are not clear exclusion between layers and not every vendor follows all of them 1.) Application HTTP, user-level programs, RFC (Request for Comment) RFC has no real standards, more like internal, proprietary architecture These internet drafts are then commented on and agreed upon / disagreed on If there is enough positive review, these are structured into a RFC 2.) Transport 3.) Network 4.) Data Link n-systems usually implement all 4 layers routers do not introduce the entire stack (up to the Network layer) OSI and TCP/IP Protocol Stack 7 layer architecture e.g. layer in TCP/IP is mapped to Physical and Link layers in OSI Consider the slide graphic for full understanding IP protocol contains bugs in the spec and has no built-in security ARP = associated resolution protocol RARP = reverse ARP PPP = point-to-point Functions of the Layers From top to bottom, hierarchy is less to more high-level Data Link Service: Reliable transfer of frames over a link MAC on a LAN Functions: framing (how to group bits together), MAC, error checking Direct connection Note : these are part of the specification but not every layer provides the necessary functionality. There are minimum functions that ought to be provided Networking layer Service: move packets from source host to destination host Functions: routing, addressing Page 1 of 5

Transport layer Service: delivery of data between hosts Functions: connection establishment/termination, error control, flow control This layer is necessary because of the Internet, direct connection is not required Application layer Service: application specific (delivery of email, retrieval of HTML docs, reliable transfer of file) Functions: application specific If a layer does not perform error checking, the next-higher layer should Assignment of Protocols to Layers Consider the diagram on the slide for mapping and assignment ICMP, IGMP, and DHCP are responsible for managing networks and preventing D.O.S. attacks DHCP Connect without specific/manual assignment of IP addresses It is dynamic and resolves to local host names Vulnerabilities None of these protocols require authentication or authenticity Somebody can claim that this data is from a destination to a route If the receiver believes that this is true, authenticity of data is threatened Layered Communications An entity of particular layer can only communicate with 1.) a peer layer entity since a common protocol The lowest level is where bit transfer occurs Data is packaged to ensure we know where it comes from Routing security is provided at the IP layer Example Sends HTTP request to neon s URL or address via an IP address (acquired after DNS query) Translates to a TCP protocol (on argon ) by connecting to IP address at port 80 Tries to open connection on port 80 of neon via the IP address Sends a datagram which sends IP datagram to neon over the IP protocol Send the datagram to the ethernet to the IP address Calls up the ARP protocol and sends frame to ethernet interface and sends to it s IP layer which eventually connects to the receiving router s ethernet card These frames are sent up through the chain on neon Encapsulation As data is moving down the protocol stack, each protocol is adding layer-specific control information e.g. Application layer data (form data, JSON request, serialized data, etc.) Page 2 of 5

prepended by HTTP header (POST/GET/PATCH/PUT/DELETE request) prepended by TCP header (TCP segment) prepended by IP header (IP datagram) and sandwiched by the Ethernet header and footer (Ethernet frame) If data does not fit into a single Ethernet frame, items need to be broken-down into smaller packets Ethernet frames can vary in size between routers Reassembly is done at the final destination Ethernet Computer <-> Computer communication on same network Each device has unique MAC address (48-bit) CRC is important here If there is some error, check the CRC code Can detect some but not all errors Attackers can craft certain packets to create same CRC (checksums) It is a weak form of integrity checks IP: Internet Protocol Unreliable connectionless datagram delivery service Responsible for routing of data through intermediate networks and computers SSL implements better MAC, etc. than the IP layer Forged IP address attacks are common attack types Happens a lot by email spam attacks ICMP: Internet Control Message Protocol Ping flood attacks is a common attack against ICMP Used to report problems with delivery of IP Datagrams within an IP network Used by Ping, Traceroute commands TCP: Transmission Control Protocol Connection-oriented, reliable, byte stream service Protocol Set up connection Transfer data Close connection Socrative Questions How would track wifi vulnerability has the potential to inject malicious code? See instructor for details Could you elaborate on what you mean when IP has lots of bugs? When we are running a protocol, two types of bugs 1.) specification of protocol Page 3 of 5

e.g. spec. does not say that encryption/authentication is needed e.g. length of message is such but can be exploited (overflow) as DoS e.g. DNS allows variable sized messages (few to kilo bytes) Attackers have found ways to exploit and cause DNS server to give out large messages causing DoS 2.) implementation e.g. OpenSSL / TLS problem; buffer overflow issue Why is data transferred through an intermediary? Why not directly? We will rarely have a situation where two hosts are directly connected, therefore, intermediary hosts must be utilized Like the postal service, letter is passed from post office to post office to mail carrier before making it to the recipient Do some routers that have a web app for management or allow for media hosting implement the application layer? Yes: if a router needs to managed, there must be some sort of application layer protocol For routers that form backbone of internet, there are different interfaces than HTTP applications What is a datagram? From Wikipedia: A datagram is a basic transfer unit associated with a packet-switched network. Datagrams are typically structured in header and payload sections. Datagrams provide a connectionless communication service across a packet-switched network. The delivery, arrival time, and order of arrival of datagrams need not be guaranteed by the network. Are the midterms grades going to be curved? The test was difficult. Appropriate actions will be taken. When traveling up a layer does the new header get appended to or taken from the packet? Yes, the headers get stripped off as it moves upward upon receipt. The routers will remove the Ethernet header, footer and, via information from IP header, will connect to the host router and attach a new Ethernet header, footer Packets are fragmented and reassembled IS HTTP just a way to alias IP addresses so that IP layer can find the corresponding IP that goes with that HTTP request? No, they are separate protocols and do not implement aliases Does fragmentation add a significant amount of time to data transmission? Yes, it adds some overhead Whenever fragmentation, there must be separate headers for each packet so that the receiving systems know what is to be expected Do WiFi and Ethernet use the same packets and protocol to communicate? No, Ethernet uses a wired protocol and provides collision detection whereas WiFi is wireless and provides collision avoidance Page 4 of 5

The protocols are completely separately WiFi avoids collisions whereas Ethernet tries to recover You mentioned that if a layer needs some service that a layer below it does not provide then it will implement that service to its own layer. Does this hold true for security services? Good question. He will get to this question in a future lecture. Are there any major differences for using HTTPS instead of HTTP for this example? Yes, there is added information to let the recipient know that it carries information framed by SSL protocol End-to-end secure information. Confidentiality and integrity provided with HTTPS Page 5 of 5