Networking Concepts

• The presentation covers protocol headers and focuses on understanding main protocols.
• IPv4, TCP, UDP, ICMP, IPv6 and ICMPv6 headers will be reviewed.

Layer 2 | Data Link Layer | Ethernet

• Layer 2 is divided into two sub layers: Logical Link Control (LLC) and Media Access Control (MAC).
• Ethernet type for IPv4 is 0x800, for IPv6 is 0x86DD, and for ARP is 0x806
• Ethernet functions include framing and physical addressing
• Error control checks if a received frame is corrupted; in Ethernet, corrupted frames are discarded.
• Layer 2 Ethernet header contains Destination MAC address (6 bytes), Source MAC address (6 bytes), Ether type (2 bytes), Data (46 to 1500 bytes), and FCS (4 bytes).

Layer 3

• IPv4 uses 0x800 as the Ether type
• IP addresses are used to logically address hosts in Layer 3
• A netmask is used for identifying the network address of every IP address to contact.
• If the network address is similar to the receiving device's network address, the frame is sent to the destination using the NIC interface with the destination MAC address of the receiving device.
• If the network address is different, the frame goes to the gateway (router), which is responsible for delivering the packet to its destination

IPv4 Packet Header Format Important Fields

• Version indicates the IP version.
• IHL is the IP Header Length.
• DSCP is the Differentiated Services Code Point.
• ECN is the Explicit Congestion Notification.
• Identification specifies the Identification number
• Flags indicate fragmentation flags.
• Time to Live indicates how long the packet is good for
• Protocol signifies what protocol is being used
• Source IP Address describes the senders IP address
• Destination IP Address describes the receiver IP address
• Options are enabled if the IHL is greater than 5
• Total Length indicates the length of the IP packet
• Fragment Offset specifies where the fragment belongs
• Header Checksum allows for error correction

Layer 3 Protocol Values and Names

• 1 is Internet Control Message Protocol (ICMP)
• 2 is Internet Group Management Protocol (IGMP)
• 6 is Transmission Control Protocol (TCP)
• 17 is User Datagram Protocol (UDP)
• 50 is Encapsulating Security Payload (ESP)
• 51 is Authentication Header (AH)

IP

• TOS (Type of Services) has been deprecated after the publication of RFC2474.
• DSCP stands for Differentiated Services Code Point.
• ECN is Explicit Congestion Notification
• Identifier: A unique value per source/destination address and datagram protocol
• DF (Don't Fragment): This flag indicates no fragmentation of the packet should occur
• MF (More Fragments): This flag indicates there are more fragments
• TTL: Time to live

IP | Explicit Congestion Notification

• Commonly, TCP/IP networks signal congestion by dropping packets.
• With successful ECN negotiation, an ECN-aware router can mark the IP header instead of dropping the packet to signal impending congestion.
• The receiver echoes the congestion indication to the sender, which reduces its transmission rate as if it detected a dropped packet.

IP Options

• IP options allow specialized handling by routers for datagrams or packets.
• Traceroute, Router Alert, and Record Route are a few examples of IP options.

UDP

• UDP is a transport protocol for sending messages.
• UDP has a small header size.
• Speed is fast but unreliable
• UDP header contains:
  • Source Port (16 bits)
  • Destination Port (16 bits)
  • Message Length
  • Checksum
  • Data

TCP

• TCP is a connection-oriented and reliable transport protocol.
• The Acknowledgment field makes it a reliable transmission protocol.
• Port address: Addresses applications/services.
• Sequence Number: Used for reordering received datagrams.
• Header Length and Data Offset are specified.
• Code Bits (Flags): Provide control information
• Window: Sender's receive window specifies buffer space for incoming data which indicates how much data can be sent before requiring an acknowledgment in return.

TCP Flags

• URG: Urgent data (rarely used)
• ACK: Acknowledge received data
• PSH: Push/send data immediately
• RST: Aborts a connection in response to an error
• SYN: Initiates a connection
• FIN: Closes a connection
• New flags added at Reserved are (10 or 01=ECN-Capable, 11 =Congestion Encountered)
  • CWR: Congestion Window Reduced
  • ECE: Explicit Congestion Notification Echo

TCP | Three-Way Handshake

• SYN: The client sends a synchronization packet to the server.
• SYN-ACK: The server acknowledges the client's synchronization request, and sends its own.
• ACK: The client completes the connection with the server and acknowledges the servers packet.
• ESTABLISHED: the connection is active

TCP Acknowledgment and Retransmission

• The sender sends a packet.
• The receiver receives the packet and sends an acknowledgement packet back to the sender.
• If the sender does not receive an acknowledgement packet they will resend the initial packet.
• Packet Loss, ACK loss, and ACK delayed scenarios covered

TCP | Efficient Transmission Method

• Sliding windows are used to control flow

Error and Control Messages in the IP

• Communication among routers and hosts is sometimes necessary, to report errors, handle abnormal conditions, and to update routing information.
• The Internet Protocol defines the Internet Control Message Protocol (ICMP) for these types of messages

TCP vs UDP

• TCP establishes a connection before sending data, guarantees delivery of data packets, checks for and requests retransmission of errors, reorders data, and provides flow control, making it reliable and suitable for applications demanding high reliability.
• UDP is connectionless, immediately sends data, does not guarantee delivery, discards segments/datagrams with errors, does not reorder data, and lacks flow control, making it fast but unreliable and suitable for applications that prioritize speed over reliability and when data is not critical

ICMP

• Encapsulated as the datagram data area within an IP packet
• Includes an ICMP header and ICMP data, encapsulated by an IP header and frame header.

ICMP Fields

• Type: Identifies the message type.
• Code: Identifies the subtype.
• Checksum for error checking

ICMP | Type (RFC6918)

• Reporting
  • 3: Destination Unreachable
  • 4: Source Quench (Deprecated)
  • 6: Alternate Host Address (Deprecated)
  • 11: Time Exceeded
  • 12: Parameter Problem
• discovery
  • 0: Echo Reply
  • 5: Redirect
  • 8: Echo Request
  • 9: Router Advertisement
  • 10: Router Solicitation
  • 13: Timestamp
  • 14: Timestamp Reply

ICMP Ping Echo Request and Reply Messages

• Type: Identifies the message type.
• Code: Identifies the subtype.
• Identifier and Sequence Number: The sender can use these to identify which reply belongs to which process and request.
• TYPE (8 or 0)
• CODE (0)
• CHECKSUM
• SEQUENCE NUMBER
• OPTIONAL DATA

Destination Unreachable Messages

• Sent when a router can't route the packet
• TYPE (3)
• CODE (0-12)
• CHECKSUM
• UNUSED (MUST BE ZERO)
• INTERNET HEADER + FIRST 64 BITS OF DATAGRAM

ICMP | Congestion and Datagram Flow Control

• Hosts can overwhelm a router with packets, causing their queue to reach its limit.
• When a router's queue is full (buffer overflow), any new received packets are dropped, and the sender is notified using a Source Quench ICMP message.
• Hosts can send Source Quench ICMP messages to other hosts sending datagrams faster than they can process.
• TYPE (4)
• CODE (0)
• CHECKSUM
• UNUSED (MUST BE ZERO)
• INTERNET HEADER + FIRST 64 BITS OF DATAGRAM

ICMP | Source Quench Messages

• Congested routers send one for every datagram they drop.
• Hosts that receive can slow datagram transmissions.
• TYPE (4)
• CODE (0)
• CHECKSUM
• UNUSED (MUST BE ZERO)
• INTERNET HEADER + FIRST 64 BITS OF DATAGRAM

ICMP | Time Exceeded

• Indicates that a datagram is dropped.
  • Code 0: TTL reached 0
  • Code 1: Fragment reassembly time exceeded
• TYPE (11)
• CODE (0 or 1)
• CHECKSUM
• UNUSED (MUST BE ZERO)
• INTERNET HEADER + FIRST 64 BITS OF DATAGRAM

Security Issues

• ICMP can be exploited
  • Denial of service attack
  • Scan networks for available hosts

ICMP | Ping Packet Overflow Attack (Ping of Death)

• A denial-of-service attack sends an improperly large ICMP echo request packet (a "ping") to cause the destination system to fail.
• The IP specification allows IP datagrams up to 65,535 octets to occur
• If an IP system can't process long IP packets correctly, the ping packet can overflow the input buffer and cause a fatal system error
• Packet Header (20 Bytes)
• ICMP Header (8 Bytes)
• ICMP Data (65,510 Bytes)

ICMP | Smurf Attack (ICMP Flood)

• It is a form of a distributed denial-of-service attack.
• Source address is a spoofed IP address
• Destination address is a broadcast address.

IPv6

• Traffic Class/Priority: Used for traffic management
• Flow Label: Used to label a flow to request special handling by routers.
• Enables efficient IPv6 flow classification with main header fields in fixed positions.
• Next Header replaces protocol and header length fields in IPv4 header.
• 40 octets Basic Header

ICMPv6

• ICMPv6 Type descriptions include:
  • 1: Destination Unreachable
  • 128: Echo Request
  • 129: Echo Reply
  • 133: Router Solicitation
  • 134: Router Advertisement
  • 135: Neighbor Solicitation
  • 136: Neighbor Advertisement
• IPv6 header and next header = 58

ICMPv6 | Echo

• Type: Identifies the ICMPv6 message type (128 for Echo Request, 129 for Echo Reply).
• Code: Not used; set to 0.
• Checksum: 16-bit checksum field for the ICMP header.
• Identifier: An optional field to help in matching Echo Request and Echo Reply messages.
• Sequence Number: A number to help in matching Echo Request and Echo Reply messages.
• Optional Data: Additional data in the Echo Request is copied into the Echo Reply sent back to the source.

Questions cover ICMP messages, network attacks, IPv6, OSI model layers, and Ethernet protocols. Key concepts include packet dropping, Smurf attacks, traffic flow classification, and TCP protocol identification. The quiz tests understanding of data link layer functions and IP header fields.