Network Essentials: TCP/IP and Basic Terminology

Agenda

• Session 1 covers Network Essentials.
• Session 2 is about Cyber Security Essentials.
• Session 3 covers Distributed Systems.

Session 1 (Network Essentials)

• The session outlines basic terminologies and the TCP/IP protocol suite.
• It also covers computer networks, definition and basic terminologies.
• The TCP/IP Protocol Suite will be covered, including:
• Network Access Layer (Physical Layer /Datalink Layer)
• Internet layer
• Transport layer
• Application Layer

Session 1 (Computer Networks Definition)

• Computer Network serves as a collection of computers and other devices, connected to perform tasks.
• Connecting Medias shares resources, which can include file sharing, devices, software, voice/video calls, and shared internet access.

Session 1 (Network Elements)

• Network elements include both hardware and software components
• Hardware includes devices like computers, printers, phones, routers, and swtiches.
• Mediums are wired, wireless, satellites.
• Software includes messages and protocols.
• Messages can travel via mediums like Mails, WhatsApp.
• Protocols govern how messages flow across a network, such as http, https, FTP, and RDP.

Session 1 (Network Basic Terminologies)

• NIC stands for Network Interface Card, also known as network adapter or LAN adapter.
• NIC: A hardware component enabling a device to directly access the network.
• Internal NICs plug directly into the motherboard
• External NICs are Wireless and USB based.
• Physical addresses are unique addresses burned on the NIC card
• IP addresses are logical addresses to identify devices on any IP network layer.
• Protocols are communication rules that entities must agree on, such as http, https, FTP, and RDP.
• Hubs all different nodes to communicate in the same network but it often slows the network considerably
• Repeaters regenerate signals over the same network before the signal becomes weak/corrupted.
• An Access Point (AP) allows WiFi devices to connect to a wired network.
• A switch enables different nodes to communicate simultaneously without slowing each other.
• A router facilitates communication between different networks.

Session 1 (LAN VS WAN)

• Local Area Network (LAN): A group of computers connected within a small geographical area, like an office, that allows users to share files and services with high speed under administrative control (100-1000 M).
• Wide Area Network (WAN): A group of computers connected over a large geographical area like a country.
• WANs can contain multiple smaller networks (LANs or MANs), operate at very low speed, and are controlled by your ISP.
• An example of a WAN is the Internet.

Session 1 (Internet)

• The Internet is defined as a global mesh of interconnected networks.
• There is no single owner of the Internet.
• Infrastructure is maintained via organizations, ISPs, companies and governments.
• ISOC stands for Internet Society
• IETF stands for Internet Engineering Task Force
• ICANN stands for Internet Corporation for Assigned Names and Numbers

Session 1 (Peer to Peer Vs Client/Server)

• Peer-to-peer networks, nodes are all the same, easy to work with, and have no dedicated resources for specific services.
• Client/Server Networks have dedicated servers that provide services to other client nodes.

Session 1 (TCP/IP Protocol Suite)

• Protocols are necessary for efficient communication
• Protocols needed to enable data flow from one Network Interface Card (NIC) to another
• Protocols controls messages and their quantity in any network.
• OSI Reference Model: Defined by the ISO in 1983 to provide universal concepts for developing protocols
• The OSI model breaks down into layers

Session 1 (TCP/IP Protocol Suite)

• TCP/IP is Transmission Control Protocol/Internet Protocol
• TCP/IP: An open-standard, default protocol for operating systems.
• TCP/IP: Not tied to a specific vendor.
• TCP/IP enables direct access to the Internet and is the protocol for internet.
• Current Internet use is TCP/IP v4; next version is TCP/IP v6
• TCP/IP is also routable.

Session 1 (TCP/IP Protocol Architecture)

• The TCP/IP architecture suite of protocols includes various application, transport, and network protocols.
• Application examples: SMTP, FTP, DNS, SNMP, NFS, TFTP, RPC
• The transport layer uses TCP and UDP protocols.
• The network layer relies on the Internet Protocol (IP), alongside ICMP and GGMP
• The data link and physical layers use protocols defined by underlying networks

Session 1 (TCP/IP Protocol Architecture)

• The network access layer consists of physical and data link layers.
• Physical Layer: Defines the electrical and transmission medium, handling the movement of individual bits from node to node.
• Datalink Layer: Provides a logical interface between the end system and network including error notifications.
• Uses frames and MAC addresses for media access control, hop to hop addressing
• Also uses error detection mechanisms

Session 1 (TCP/IP Protocol Architecture)

• Physical Addresses (Mac addresss):
• It a physical address on the NIC card
• Unique world wide address
• written as 12 hexadecimal digits
• Each byte (2 hexadecimal digits) is separated by a colon
• Physical addresses can be Unicast, Multicast, Broadcast
• Use "Ipconfig /all" or "GetMac" to check physical address

Session 1 (TCP/IP Protocol Architecture)

• Internet/Network Protocol Layer (IP Layer):
• Provides connectivity and path selection between two hosts
• Routing of data provides mechanism to transmit data over linked networks
• Consist of logical addressing IPV4, IPV6

Session 1 (TCP/IP Protocol Architecture)

• Internet Protocol - IP V4 identifies devices on an IP network layer
• Sometimes it the logical address
• Computer, device, peripheral is at a unique address at the same network
• V4: 32 bit divided into 4 octets each octet 8 bit
• 1 octet = 8 bit each numbered from 0 to 255 separated with dots
• the full address space of IPv4 232, or 4,294,967,296
• Class A Public IP ranges from 1.0.0.0 to 9.255.255.255 and 11.0.0.0 to 126.255.255.255 Private IP ranges from 10.0.0.0 to 10.255.255.255
• Class B Public IP ranges from 128.0.0.0 to 172.15.255.255 and 172.32.0.0 to 191.255.255.255 Private IP ranges from 172.16.0.0 to 172.31.255.255
• Class C Public IP ranges from to 192.0.0.0 to 192.167.255.255 and 192.169.0.0 to 223.255.255.255 Private IP ranges from 192.168.0.0 to 192.168.255 255
• Nat is used to translate private IP address to public IP addresses.

Session 1 (TCP/IP Protocol Architecture)

• IP Address Assignment: IP addresses are assigned manually/automatically (DHCP).
• To find your private IP address use: Ipconfig, Ipconfig /all, Ipconfig /release, Ipconfig /renew
• You can test connectivity between hosts using ICMP(Ping)
• Ping IP
• Ping URL
• Ping IP -l -n -t

Session 1 (TCP/IP Protocol Architecture)

• Internet Protocol - IP V6
• a 128-bit address, provides approximately 340 billion billion billion billion addresses
• Representation of eight groups, separated by colons, of four hexadecimal digits
• Full form can be simplified

Session 1 (TCP/IP Protocol Architecture)

• Internet Of Things (IOT):
• Aims connect all devices to the existing Internet infrastructure, sense and collect data, then send it to the internet
• Coffee makers, A.C, washing machine, ceiling fans and lights can be connected
• IOT Practical Applications: Smart Homes -Smart Cities-Energy -Environment monitoring- healthcare and Management

Session 1 (TCP/IP Protocol Architecture)

• The transport layer employs two main protocols:
• TCP: Transmission Control Protocol, which is connection oriented, reliable, is full duplex, and has error control/data recovery.
• UDP: User Datagram Protocol, which is connectionless, unreliable, is full duplex and provides Voice/Video streaming services.

Session 1 (TCP/IP Protocol Architecture)

• Transport Layer addressing (port numbers) controlled by ICANN
• Well Known Ports permanent numbers (0-1023) Assigned/controlled by ICANN
• Registered port numbers (1,024-49,151). Not controlled by ICANN,can be registered at ICANN
• Dynamic port numbers. neither controlled or registered (49152-65535)

Session 1 (TCP/IP Protocol Architecture)

• Application Layer
• Communication between processes or applications
• Internet Services (Client/Web Server)
• World wide web: HTTP
• Naming Service: DNS
• File Transfer: FTP
• Telnet Service
• Electronic Mail service: IMAP, POP3, SMTP

Session 1 (TCP/IP Protocol Architecture)

• A URL (Universal Resource Locator) includes the protocol, host, port, and path.
• HTTP (Hyper Text Transfer Protocol) Supports the delivery of web pages to the client

Session 1 (TCP/IP Protocol Architecture)

• DNS (Domain Name Servers) translate human-readable names into IP addresses
• To get website, check the cash, then hosts file, then ask DNS
• Top Level Domains (TLDs)
  • .com: Commercial organization
  • .edu: Educational institution
  • .gov: Government organization
  • .mil: Military group
  • .net: Major network support center
  • .org: Organization other than those above
  • country code: A country

Session 1 (TCP/IP Protocol Architecture)

• FTP (File Transfer Protocol) relies on a transmission protocol that ensures reliable data transfer between hosts.
• To use, first establish a FTP client either via Browser, through MS Windows, or programs

Session 1 (TCP/IP Protocol Architecture)

• Telnet/SSH or RDP protocols: Telnet/SSH is a user command and an underlying TCP/IP protocol for accessing remote computers.
• Telnet/SSH, an administrator can access someone else's computer remotely
• Remote Desktop Protocol (RDP) is proprietary to Microsoft and allows connections to other computers
• SSH(Secure Shell) runs on port 22 ,It is Very Secure Protocol , Difficult to decrypt on All popular Operating System
• Telnet runs on port 23 , It is Not Secure Protocol , Joint abbreviation on Linux, Windows

Session 1 (TCP/IP Protocol Architecture)

• Mail Servers and Clients Mail Clients are web based (Hotmail, Gmail) /Non web based : Microsoft Outlook.
• Mail Protocols:
  • SMTP (send mail transfer Protocol)
    • send messages back and forth to other Mail Servers or Email Clients
  • POP3 "Post Office Protocol version 3"
    • the Email Client contacts the Mail Server to collect email messages, then Download the messages on the hard drive
    • Offline capable
    • Keep the user's quota on the server
  • IMAP4 “Internet Message Access Protocol version 4":
    • Retrieve only message header

Session 1 Practices

• Find your MAC address using "Ipconfig /all" or "Get mac".
• Find your real IP address using https://www.whatismyip.com/.
• Find your private IP address using: Ipconfig, Ipconfig /all, Ipconfig /release, Ipconfig /renew, ARP -a
• Find current session and ports on your device using Netstat -n and Netstat -a
• Find The IP of the domain Yahoo.com using Nslookup Yahoo.com

Session 2 (Cyber Security Essentials)

• This Session will cover Information Security Goals, Risks and Threats, Security Defenses and Encryption
• Information Security Goals
  • Confidentiality
  • Integrity
  • Availability

Session 2 (Security Goals)

• Cyber Security: Protects systems, networks, programs, devices, and data from cyber attacks
• Security is a shared responsibility from each user when connecting to the network
• Security Goals such as Confidentiality, Integrity and Availability must be technically defined
• Confidentiality ensure that information is not revealed to unauthorized persons
• Ensure consistency of data
• Availability ensuring access to legitimate users

Session 2 (Risks & Threats)

• Focus of security is the risk of something happening
• Risk = Threat x Vulnerabilities
• The degree of weakness in every network and device is a vulnerability
• Threats represent a person, thing, event or idea which poses danger to asset confidentiality, integrity, availability or legitimate use
• There is NO simple Solution to eliminate risk
• Security 99.9% isn't found due to new attacks such as new technologies /applications, New Vulnerabilities coupled with the difficulties in defending

Session 2 (Attackers Methods)

• Attack: attempt to destroy, expose, alter, disable, steal or breaking into the information or breaking the systems or making unauthorized use of an asset
• Passive Attack: Difficult to detect (malicious).
  • An attacker captures packets from the network attempting to decrypt them.
• Active Attack: Active traffic is generally easier to detect
  • An attacker tries to modify data on a system or to access it

Session 2 (Attackers Methods)

• Social engineering is the ability to influence the behavior of a group of people
• PHISHING ATTACK: Fake web page looks like popular website Gmail, facebook, twitter asking for username, passwords and credit cards

Session 2 (Attackers Methods)

• HIJACK ATTACK: -- A hacker takes over a session between you and another individual, leading to communication of accidentals information
• Insider Attack:
• involves a disgruntled employee attacking the network.
• PASSWORD ATTACK:
• • An attacker tries to crack the passwords in network, database
  • Dictionary attack
  • Brute-force attack -- Hybrid attack

Session 2 (Malicious Software (Malware)types))

• Backdoor/trapdoor: A secret entry point into a program often used by developers.
• Viruses: Malicious software attached to a program to execute an unwanted function.
• It propagates itself and carries a payload, makes copies of itself
• Trojan Horse: Program with hidden side-effects, superficially attractive, and it open ports/passes malicious files.
• It allows attacker to indirectly gain access they do not have directly
• It is also used to propagate a virus/worm or install a backdoor

Session 2 (Malicious Software)

• Worms are replicate but not infecting program typically spread network and lead to zombie pc's
• The major issue is lack of security of permanently connected systems
• Zombie is a Program which secretly takes over another networked computer.
• Also launch distributed denial of service (DDoS) attacks
• Ransomware locks a computer or device or encrypts data on an infected endpoint with an encryption key
• The data is unusable until they attacker is paid (Bitcoin)

Session 2 (Malicious Software)

• DoS (Denial of Service) Attack: Used for crashing the whole system of permission.
• Kind of attacks are easy to launch and it is hard to protect such that these attacks Consume network resources or Memory, processor etc.
• DDoS Attack: Distributed denial of service attack uses multiple machines to prevents attacks.
• TCP SYN flood.
• Spam is a serious network threat that overloads email systems and allows take control of home computers
• Spyware: this gathers personal information from your computer without your permission or knowledge is sent to the Internet. passwords-account nos
• Tracking Cookies record information about an Internet user who visit websites

Session 2 (Attacks Mitigation)

• Firewalls are the most effective security tools, resides between networks, and prevents traffic access.
• Static Packet Filtering (stateless firewall): Prevents or allows based on IP / MAC addresses.
• Dynamic Packet Filtering (state full firewall): Incoming packets must be to requests from internal hosts.
• SPI recognizes and filters out attacks, such as DoS.

Session 2 (Attack Mitigation)

• Proxy Server: Intercepts user requests/processes them on behalf to hide a client's IP
• VPN: Tunnels traffic between 2 networks, using :Remote Access VPN, Site to Site VPN

Session 2 (Attack Mitigation

• Intrusion Detection Prevention Systems (NIDS and NIPS): NIDS watch the Network Traffic and if detects bad traffic flow and sends send alarms/logs NIPS stops bad traffic and looks for the perfect match Next generation Firewall (NGFW) is a "deep-packet inspection firewall," including application-level inspection and brings outside intelligence.

Session 2 (Encryption)

• Encryption- converting the original plaintext information into a ciphertext that a key is used for a cyphertext
• in symmetric encryption algorithm, the same key is used for decryption, but it requires a secure way for the two sides to have the same key

Session2 Practices

• Use your local firewall to block a port to stop DOS attacks from a zombie device

Session 3 (Distributed Systems)

• A group of computers working in tandem appearing as a single computer to the user.
• Sub points consist of basic terminologies, examples, and types
• The major focus will be cloud computing

Session 3 (Distributed System)

• Centralized System: All components stored on a single computer, this can be: Simpler or Easier to understand, Can be faster for a single user Distributed System: State divided over multiple computer
• More robust(can tolerate failures)/More scalable (often supports many users)/More complex

Session 3 (Distributed System)

• The advantages of working with distributed systems; one interface, high performance/reliability, dependency on cloud scaling.
• One interface towards the end-user.
• Distributed system is growing; it is in every could and computing database system.

Session 3 (Distributed System)

• Distributed systems must have : Network and Messages – A System that connects all components(Hardware, or Software)
• Messages passed between machines contain forms of data like databases, objects, and files.
• These messages must pass via reliable communication

Session 3 (Types of Distributed

• Four architecture types:

1. Client-server:

• a server as a shared resource like a printer, database, or a web server
• Multiple clients use the shared resource.

2. Three-tier:
   • clients do not need to be particularly intelligent
   • can rely on a middle tier to do the processing and decision making. The middle tier forwards to the applicable servers

Session 3 (Types of Distributed

• 4 Architecture cont.

3- Multi-tier (n-tier):

• Web services first created the various n-tier architectures such as google.com, contains the business logic that interacts via the various tiers 4- Peer-to-peer :
• There is no centralized logic to manage the work, all decisions are split to involved machines, blockchain works this way

Session 3 (Distributed System Examples)

• Domain Name System (DNS) allows distributed lookup of hostname to IP addresses
• Facebook & Google are big with distributed systems
• Massive scale – Fast enough – Very reliable
• Email servers (SMTP), Cloud Computing and Virtualization are all the various examples of distributed systems

Session 3 (Virtualization)

• Uses a tech to operate completely isolated.
• With full benefits.
• Consolidation, Redundancy, Legacy hardware, Migration, Centralized management
• Is a technology that run multiple same or different operating systems which is completely isolated from each other
• Ex: run both windows and Linux on the same machine
• Virtualization is different than Dual Boot; Duall boot runs only one OS at the same time

Session 3 (Cloud computing)

• A pool of resources rapidly provisioned in an automated, on-demand manner
• Economies of scale
• Elastic
• Affordable

Session 3 (Cloud computing service

• Cloud computing service models :
• The on-premises models have the full stack managed by the customer from networking to applications.
• IaaS (Infrastructure as a service) models let's the provider's operating system and virtualization managed, while Networking and Storage services are customer managed.
• PaaS (Platform as a service) model builds on that as managed by provider .
• SaaS(Software as a Service) Networking all managed by Provider

Session 3 (Cloud computing service

• Software as a service (SaaS): Customers get to apply to get an application running on a cloud infrastructure as managed within control.
• Platform as a service (PaaS): Customers can connect and develop supported applications with has to have a responsible and secure data, and applications.
• Infrastructure as a Service (Iaas) Customers can control processing and networking resources while the customer maintains the security of those systems.

Session 3 (Cloud computing

• Public, community, private, and Hybrid cloud are the four cloud types in action.
  • A public cloud is third party owned.
  • A community cloud is built for organizations.
  • A private cloud is owned by just one organization.
  • A hybrid cloud uses mixed models of data application deployment.

Session 3 Practices

• Utilize Vmware workstation to simulate 2 different OS on your Machine