2101 Ch13-17 Final Part 3

ICMP Protocol

• ICMP (Internet Control Message Protocol) is used for error and informational messages in the TCP/IP suite.
• ICMP messages are not required for IP reliability.
• ICMP is used for both IPv4 and IPv6. ICMPv4 is for IPv4, and ICMPv6 for IPv6.
• ICMP messages include:
  • Host reachability (e.g., Ping)
  • Destination/Service Unreachable (e.g., code 0 - Net unreachable, 1 - Host unreachable)
  • Time Exceeded (related to packet TTL/Hop Limit expiration)

Ping Command

• Ping uses ICMP echo request/reply messages to test host connectivity.
• Pinging the loopback address (127.0.0.1 for IPv4, ::1 for IPv6) checks IP stack functionality.
• Pinging the default gateway checks local network connectivity.
• Pinging a remote host verifies internetwork communication.
• Timeout values may indicate security restrictions or network issues.

Traceroute Command

• Traceroute (tracert) generates a list of hops in a path.
• Traceroute utilizes the TTL/Hop Limit field in IP headers along with ICMP Time Exceeded messages.
• Round-trip time (RTT) for each hop is reported. Asterisks (*) indicate lost packets.
• Traceroute helps diagnose problems in the network path.

Transport Layer Protocols

• Transport layer protocols (TCP and UDP) facilitate host-to-host data transport.
• TCP is like a registered letter—reliable, connection-oriented, and sequenced.
• UDP is like a stamped letter—faster, less reliable, connectionless.
• Each data stream between two applications is tracked separately by the transport layer.
• Data is segmented/reassembled into segments/datagrams depending on the protocol.
• Header information (e.g., source/destination port numbers, sequence numbers, acknowledgment numbers) enable tracking.
• Port numbers identify applications on each host.
• Multiplexing allows multiple conversations to share network resources.

TCP

• Connection-oriented, reliable protocol
• Establishes a session before data transmission.
• Tracks data segments, acknowledges receipt, and resends lost segments.
• Sequences data for correct reassembly.
• Supports flow control (window size) to prevent overloading receivers.
• Uses a three-way handshake to establish a connection
• Uses a four-way handshake to terminate a connection.
• Provides a guaranteed and ordered delivery
• Includes features like selective acknowledgment (SACK)
• Overhead of 20 bytes for each segment

UDP

• Connectionless, best-effort protocol.
• No session establishment or acknowledgments.
• Data packets are not sequenced and resend lost segments.
• Primarily used for applications that can tolerate some data loss (e.g., streaming)
• Lower overhead than TCP.
• Overhead of 8 bytes per datagram

Application Layer

• The upper three layers of the OSI model (application, presentation, and session) are part of the TCP/IP application layer.
• Protocols define formats and control for common internet communication.
• Application protocols must be compatible for successful communication.
• Many protocols exist (e.g., HTTP, FTP, TFTP, IMAP, DNS).

DNS

• Translates domain names (e.g., cisco.com) to IP addresses.
• Hierarchical system with different zones for server responsibilities.
• Utilizes resource records (e.g., A, NS, AAAA) that store name and address mappings.
• DNS clients store previously resolved names in memory.
• The nslookup command is used for manual name resolution queries

DHCP

• Automatically assigns IP addresses, subnet masks, gateways, and other network parameters.
• DHCP servers dynamically assign addresses from a pool.
• Leases for allocated addresses are temporary.
• Used for dynamically changing user populations and larger networks.

FTP

• Protocol for transferring files.
• Uses TCP ports 20 (data) and 21 (control).
• Clients can upload/download files from the server.

SMB

• File-sharing protocol for Microsoft networks.
• Establishes long-term connections to access shared resources.
• Supports shared directories, files, printers, and ports.

Network Security

• Protecting networks from unauthorized access and threats is crucial.
• Threats involve information theft, data loss/manipulation, identity theft, and disruption of service.
• Vulnerabilities include technological, configuration, and policy weaknesses.
• Physical security (e.g., securing computer rooms, monitoring access) is important.
• Malware includes viruses, worms, and Trojan horses.
• Reconnaissance attacks include ping sweeps & port scans to identify vulnerable resources.
• Access attacks exploit vulnerabilities in authentication and other services.
• Denial-of-service attacks overload resources to prevent legitimate use.

Test your knowledge on the Internet Control Message Protocol (ICMP), including its functions, ICMP messages, and the usage of commands like Ping and Traceroute. This quiz covers key aspects of network connectivity testing and error reporting. Understand both IPv4 and IPv6 applications of ICMP as you answer these questions.