Understanding Protocols

Grasping the Basics of Networking Protocols

Gregory M. Kapfhammer

October 14, 2024

Wait, how does understanding network protocols connect to computer security?

Know a network protocol and its weakness to discern possible exploits, model the attack surface, and control attack opportunities

Using `dig` for DNS Resolution

; <<>> DiG 9.18.28 <<>> www.securitysynapse.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49950
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 0b85acf369d8eae70100000067179b5124bf1ddbdb95f41e (good)
;; QUESTION SECTION:
;www.securitysynapse.org.       IN      A

;; ANSWER SECTION:
www.securitysynapse.org. 14400  IN      CNAME   securitysynapse.netlify.app.
securitysynapse.netlify.app. 20 IN      A       44.217.161.11
securitysynapse.netlify.app. 20 IN      A       54.161.234.33

;; Query time: 103 msec
;; SERVER: 192.168.5.20#53(192.168.5.20) (UDP)
;; WHEN: Tue Oct 22 08:32:17 EDT 2024
;; MSG SIZE  rcvd: 153

Let’s investigate each networking protocol layer starting with `Network` and ultimately moving to `Application`!

Wireless Output from `ifconfig`

wlp1s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.130.101  netmask 255.255.192.0  broadcast 10.0.191.255
        inet6 fe80::2b19:5ed6:ef18:51ed  prefixlen 64  scopeid 0x20<link>
        ether a8:3b:76:ba:ac:e9  txqueuelen 1000  (Ethernet)
        RX packets 5598  bytes 343800 (335.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 39  bytes 3733 (3.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Key Questions

What is the name of this wireless interface?
What is the IP address of this wireless interface?
What is the MAC address of this wireless interface?
How much data has this interface sent and received?

Ethernet Output from `ifconfig`

enp103s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.1.173  netmask 255.255.255.0  broadcast 10.10.1.255
        inet6 fe80::2469:6a20:94e2:494a  prefixlen 64  scopeid 0x20<link>
        ether 64:4b:f0:12:6f:d6  txqueuelen 1000  (Ethernet)
        RX packets 65541  bytes 42671869 (40.6 MiB)
        RX errors 0  dropped 33  overruns 0  frame 0
        TX packets 35552  bytes 14487279 (13.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0x60300000-6037ffff

Key Questions

What is the name of this wired interface?
What is the IP address of this wired interface?
What is the MAC address of this wired interface?
How much data has this interface sent and received?

Internet Protocol (IP)

IP Addressing: Unique identifiers for devices on a network
Routing: Path data packets take to reach destination
IPv4 and IPv6: Two different versions of IP
Packet Structure: Consists of a routing header and payload

Key Questions

What is the primary difference between IPv4 and IPv6?
How does IP routing determine the best path for data packets?
What information is contained in the header of an IP packet?

Internet Control Message Protocol

Error Reporting: Error messages and operational details
Types of Messages: Echo Request/Reply (ping), Destination Unreachable, Time Exceeded all aid in network diagnostics
Integral to IP: Gives IP insights about network issues

Key Questions

What is the primary purpose of ICMP?
How does ICMP help in network diagnostics?
Why do some sites block ICMP traffic?

Using ICMP with `ping`

❯ ping www.google.com
PING www.google.com (142.250.80.100) 56(84) bytes of data.
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=1 ttl=58 time=14.6 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=2 ttl=58 time=14.8 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=3 ttl=58 time=19.5 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=4 ttl=58 time=17.6 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=5 ttl=58 time=16.7 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=6 ttl=58 time=14.6 ms
64 bytes from lga34s36-in-f4.1e100.net (142.250.80.100): icmp_seq=7 ttl=58 time=16.0 ms

--- www.google.com ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6011ms
rtt min/avg/max/mdev = 14.641/16.258/19.470/1.680 ms

What is the meaning of ttl and time?
What does ping report about packet transmission?
Will all servers response to ping requests?

Network Address Translation (NAT)

IP Address Conservation: Share a single public IP address
Types: Static NAT, Dynamic NAT, Port Address Translation
Benefits: Hides internal IP addresses from external networks
Use Cases: Home routers, enterprise networks, and VPNs

Key Questions

How does NAT contribute to IP address conservation?
What are the different types of NAT and their use cases?
How does NAT enhance network security?

Transmission Control Protocol (TCP)

Reliable Communication
- Three-way handshake
- Data integrity checks
- Flow control
Packet Management
- Breaks data into packets
- Ensures packet delivery

Connection-Oriented
- Higher latency
- Ensures reliability
Security Implications
- Intercept or manipulate
- DoS or MitM attacks
- Evolving TCP stacks

What are the benefits and drawbacks of TCP for networking?

Application Layer Protocols

Application-specific protocols build on the previous layers
Supports communication for applications and services
Common examples include HTTP, FTP, SMTP, and DNS

DHCP
- Dynamic Host Configuration Protocol
- Assigns IP addresses
- Automates network configuration

SSL/TLS
- Secure Sockets Layer / Transport Layer Security
- Encrypts data in transit
- Ensures secure communication

Common Ports for Services

Protocol	Port	Description
SSH	22	Secure Shell
HTTP	80	Hypertext Transfer Protocol
HTTPS	443	Hypertext Transfer Protocol Secure
FTP	21	File Transfer Protocol
SMTP	25	Simple Mail Transfer Protocol
DNS	53	Domain Name System
POP3	110	Post Office Protocol 3
IMAP	143	Internet Message Access Protocol
Telnet	23	Unencrypted text communications
NTP	123	Network Time Protocol

Using `nmap` for Port Scanning

Starting Nmap 7.94 ( https://nmap.org ) at 2024-10-23 21:17 EDT
Nmap scan report for 192.168.0.132

Host is up (0.017s latency).
Not shown: 92 filtered tcp ports (no-response), 7 filtered tcp ports (admin-prohibited)

PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: DC:A6:32:C7:04:28 (Raspberry Pi Trading)

Nmap done: 1 IP address (1 host up) scanned in 2.20 seconds

Scans the host at the IP address 192.168.0.132
Detects open ports and services on the host
Detects the MAC address of the specified server
Shows that ssh is currently open on port 22

Wrapping Up on Network Protocols

Key Concepts

Studied Protocols

TCP/IP
UDP
IPSec and SSL/TLS

Key Concepts

Protocol layers
Client-server communication
Secure data transmission

Best Practices

Implementation

Understand protocol roles
Ensure secure configurations
Regularly update protocols

Exploration

Compare with other protocols
Study protocol interactions
Consider next generation

Understanding Protocols Grasping the Basics of Networking Protocols Gregory M. Kapfhammer October 14, 2024

Understanding Protocols
Network Communication Overview
What is a computer networking protocol?
Wait, how does understanding network protocols connect to computer security?
Using dig for DNS Resolution
Networking Overview
Let’s investigate each networking protocol layer starting with Network and ultimately moving to Application!
Address Resolution Protocol (ARP)
Wireless Networking
Ethernet
Wireless Output from ifconfig
Ethernet Output from ifconfig
Internet Protocol (IP)
Internet Control Message Protocol
Using ICMP with ping
Network Address Translation (NAT)
IP Security (IPSec)
Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)
Application Layer Protocols
Common Ports for Services
Using nmap for Port Scanning
Wrapping Up on Network Protocols