Computer Science Assignment 3

Assignment#3 MMIS 653 (Fall 2023)

Total points: 70

Due date: 10/13/2023 11:59PM

1, Define and contrast the following terms: subnet, prefix, and BGP route? (6 points)

2, Consider a datagram network using 16-bit host addresses. Suppose a router uses

longest prefix matching and has the following forwarding table:

-----------------------------------------------

Prefix Match Interface

-----------------------------------------------

1 0

11 1

111 2

Otherwise 3

-----------------------------------------------

For each of the following 5 host addresses, give the matched interface # using above

forwarding table. (10 points)

11100000 10111111

10110000 10111111

11010000 10111111

01110000 10111111

10000000 10111111

3, How big is the MAC address space? The IPv4 address space? The IPv6 address space?

Note: The size of an address space is the maximum number of different addresses it can

have. (3 points)

4, In CSMA/CD, after the 5th collision, what is the probability that a node chooses K=4?

The result K=4 corresponds to a delay of how many seconds on a 100 Mbps Ethernet? (5

points)

5, List the serious security flaws of Wired Equivalent Privacy (WEP) for 802.11 wireless

networks. How are those security flaws addressed by WiFi Protected Access (WPA)? (6

points)

6, Describe IPsec and how it can be used to create virtual private networks (VPNs). (6

points)

7, What is the difference between a permanent address and a care-of address? Who

assigns a care-of address? (4 points)

8, Identify and describe at least three common network vulnerabilities? (6 points)

9, What is an important difference between a symmetric key system and a public key

system? (5 points)

10, True or False, explain why? (4 points)

a, Ethernet and 802.11 uses the same frame structure.

b, The addresses in an Ethernet frame header are IP addresses.

11, Complete the Wireshark Lab: SSL. The answers to all the questions in the lab are

posted in Canvas. Follow all the steps in the lab and try to answer all the questions. Then

check your answers using the solution file provided. There is no need to submit your

answers to me for grading. You only need to submit a screenshot to show me that you

opened the trace file and did the lab. (6 points)

Note: The files for the Wireshark Lab and the solutions are provided separately.

• Wireshark_SSL_v8.0.pdf

• Wireshark_SSL_SOLUTION_v8.0.pdf

12, Conduct a survey on routing protocols, select one protocol and discuss how it works,

identify its advantages and disadvantages. The length of your review should be no more

than 2 pages in length. Please use APA (American Psychological Association) style for

in-text citations and references.(https://owl.english.purdue.edu/owl/resource/560/01/) The

rubric I use for grading your review is attached for your reference. (9 points)

criteria 3 2 1 0 Points

Identify the literature in the field of network routing

5 or more related references are identified

3-4 related references are identified

1-2 related references are identified

No reference is identified

Summarize the advantages and disadvantages of the chosen routing protocol

Be able to summarize 3 or more advantages and 3 or more disadvantages

Be able to summarize 1 or 2 advantages and 1 or 2 disadvantages

Be able to summarize some advantages or disadvantages but not both

Not able to summarize any advantages and disadvantages

Synthesize scholarly literature relating to network routing

Several detailed conclusions are reached from the literature

Some detailed conclusions are reached from the literature

A conclusion is reached from the literature

No conclusion is reached from the literature

Wireshark Lab: SSL v8.0 Supplement to Computer Networking: A Top-Down Approach, 8th ed., J.F. Kurose and K.W. Ross “Tell me and I forget. Show me and I remember. Involve me and I understand.” Chinese proverb

© 2005-2020, J.F Kurose and K.W. Ross, All Rights Reserved

In this lab, we’ll investigate the Secure Sockets Layer (SSL) protocol, focusing on the SSL records sent over a TCP connection. We’ll do so by analyzing a trace of the SSL records sent between your host and an e-commerce server. We’ll investigate the various SSL record types as well as the fields in the SSL messages. You may want to review Section 8.6 in the text1. We are currently developing a Wireshark Lab that will cover TLS – whose treatment in the 8th edition of our text replaces the coverage of SSL.

1 References to figures and sections for this SSL lab are for the 7th edition of our text, Computer Networks, A Top-down Approach, 7th ed., J.F. Kurose and K.W. Ross, Addison-Wesley/Pearson, 2016.

1. Capturing packets in an SSL session The first step is to capture the packets in an SSL session. To do this, you should go to your favorite e-commerce site and begin the process of purchasing an item (but terminating before making the actual purpose!). After capturing the packets with Wireshark, you should set the filter so that it displays only the Ethernet frames that contain SSL records sent from and received by your host. (An SSL record is the same thing as an SSL message.) You should obtain something like screenshot on the previous page. If you have difficulty creating a trace, you should download the zip file http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip and extract the ssl-ethereal- trace-1 packet trace. 2. A look at the captured trace Your Wireshark GUI should be displaying only the Ethernet frames that have SSL records. It is important to keep in mind that an Ethernet frame may contain one or more SSL records. (This is very different from HTTP, for which each frame contains either one complete HTTP message or a portion of a HTTP message.) Also, an SSL record may not

completely fit into an Ethernet frame, in which case multiple frames will be needed to carry the record. Whenever possible, when answering a question below, you should hand in a printout of the packet(s) within the trace that you used to answer the question asked. Annotate the printout2 to explain your answer. To print a packet, use File->Print, choose Selected packet only, choose Packet summary line, and select the minimum amount of packet detail that you need to answer the question

1. For each of the first 8 Ethernet frames, specify the source of the frame (client or server), determine the number of SSL records that are included in the frame, and list the SSL record types that are included in the frame. Draw a timing diagram between client and server, with one arrow for each SSL record.

2. Each of the SSL records begins with the same three fields (with possibly different values). One of these fields is “content type” and has length of one byte. List all three fields and their lengths.

ClientHello Record:

3. Expand the ClientHello record. (If your trace contains multiple ClientHello records, expand the frame that contains the first one.) What is the value of the content type?

4. Does the ClientHello record contain a nonce (also known as a “challenge”)? If so, what is the value of the challenge in hexadecimal notation?

5. Does the ClientHello record advertise the cyber suites it supports? If so, in the first listed suite, what are the public-key algorithm, the symmetric-key algorithm, and the hash algorithm?

ServerHello Record:

6. Locate the ServerHello SSL record. Does this record specify a chosen cipher suite? What are the algorithms in the chosen cipher suite?

7. Does this record include a nonce? If so, how long is it? What is the purpose of the client and server nonces in SSL?

8. Does this record include a session ID? What is the purpose of the session ID? 9. Does this record contain a certificate, or is the certificate included in a separate

record. Does the certificate fit into a single Ethernet frame? Client Key Exchange Record:

2 What do we mean by “annotate”? If you hand in a paper copy, please highlight where in the printout you’ve found the answer and add some text (preferably with a colored pen) noting what you found in what you ‘ve highlight. If you hand in an electronic copy, it would be great if you could also highlight and annotate.

10. Locate the client key exchange record. Does this record contain a pre-master secret? What is this secret used for? Is the secret encrypted? If so, how? How long is the encrypted secret?

Change Cipher Spec Record (sent by client) and Encrypted Handshake Record:

11. What is the purpose of the Change Cipher Spec record? How many bytes is the record in your trace?

12. In the encrypted handshake record, what is being encrypted? How? 13. Does the server also send a change cipher record and an encrypted handshake

record to the client? How are those records different from those sent by the client? Application Data

14. How is the application data being encrypted? Do the records containing application data include a MAC? Does Wireshark distinguish between the encrypted application data and the MAC?

15. Comment on and explain anything else that you found interesting in the trace.

Wireshark Lab: SSL v8.0

SOLUTIONS

Supplement to Computer Networking: A Top-Down Approach,

8th ed., J.F. Kurose and K.W. Ross

“Tell me and I forget. Show me and I remember. Involve me and I

understand.” Chinese proverb

© 2005-2020, J.F Kurose and K.W. Ross, All Rights Reserved

A Look at the Captured Trace:

Captured SSL Packets

1. Details of the first 8 captured Ethernet frames (SSL) are listed in the following table:

Frame #

in Ethereal

Frame

# Source Destination

# of SSL

Records List of SSL Records

215 1 192.168.1.104 72.246.122.125 1 Client Hello

217 2 72.246.122.125 192.168.1.104 3

Server Hello

Certificate

Server Hello Done

218 3 192.168.1.104 72.246.122.125 3

Client Key Exchange

Change Cipher spec

Encrypted Handshake msg

219 4 72.246.122.125 192.168.1.104 2 Change Cipher spec

Encrypted Handshake msg

221 5 192.168.1.104 72.246.122.125 1 Application Data

224 6 72.246.122.125 192.168.1.104 1 Application Data

225 7 72.246.122.125 192.168.1.104 1 Application Data

227 8 72.246.122.125 192.168.1.104 1 Application Data

Details of the first 8 Ethernet Frames for SSL

Timing Diagram of the SSL Session

2. Each SSL record begins with the same three fields (content type, version, and length). The

values for each SSL record type are listed as follow:

Frame # SSL Record Types Content Type Version Length

1 Client Hello Handshake (22) TLS 1.0 (0x0301) 103

2 Server Hello Handshake (22) TLS 1.0 (0x0301) 74

Certificate Handshake (22) TLS 1.0 (0x0301) 989

Server Hello Done Handshake (22) TLS 1.0 (0x0301) 4

3 Client Key Exchange Handshake (22) TLS 1.0 (0x0301) 134

Change Cipher spec ChangeCipherSpec(20) TLS 1.0 (0x0301) 1

Encrypted Handshake msg Handshake (22) TLS 1.0 (0x0301) 48

4 Change Cipher spec ChangeCipherSpec(20) TLS 1.0 (0x0301) 1

Encrypted Handshake msg Handshake (22) TLS 1.0 (0x0301) 48

5 Application Data Application Data (23) TLS 1.0 (0x0301) 1552

6 Application Data Application Data (23) TLS 1.0 (0x0301) 912

7 Application Data Application Data (23) TLS 1.0 (0x0301) 32

8 Application Data Application Data (23) TLS 1.0 (0x0301) 32

Client Hello Record

Expanded Client Hello Record

3. The value of the content type is Handshake (22) because this is handshake message type (as

shown above).

4. Yes, the Client Hello record contains a challenge and its value in HEX is

0xC074B51864D5EE04F9B547DFF3664597

5. Yes, Client Hello record advertises the cipher suite it supports, as shown below.

Client Hello Record’s Cipher specs

The first listed TLS (SSLv3) cipher spec (highlighted above) is: DHE and RSA (public-key

algorithms) with 256-bit CBC AES (symmetric-key) with SHA (hash algorithm).

Server Hello Record

Expanded Server Hello Record

6. Yes, this record specifies a cipher suite. The chosen suite is

TLS_RSA_WITH_AES_256_CBC_SHA (0x0035). In other words, RSA (public-key)

256-bit CBC AES (symmetric) and SHA (hash algorithm) are chosen.

7. Yes, this record includes a nonce, as known as Random.bytes, and it is 28 bytes long (as

highlighted above). The purpose of the client and server nonces in SSL is to prevent

attacker from replaying or reordering records.

8. Yes, this record includes a Session ID which is 32-bytes long. Its purpose is to allow

session resumption, which can significantly reduce the number of time-consuming server

handshake to crease a new session ID. In the Client Hello record, a nonzero session ID

means that the client to resume its previously established session; and a zero session ID

means that the client wishes to establish a new session with the server.

9. Yes, this record contains a certificate. The certificate is 982 bytes long, thus it can fit into

a single Ethernet frame.

Expanded Server Hello Record (2)

Client Key Exchange Record

Expanded Client Key Exchange Record

10. Yes, this record contains a pre-master secret (highlighted above). This encrypted

pre-master secret is decrypted at the server side and is used to produce a master secret.

Then this master secret is used to produces “key block”, which is then sliced and diced into

client MAC key, server MAC key, client encryption key, server encryption key, client IV

and serve IV. The secret is encrypted using server’s public key. The encrypted secret is

130-byte long.

Change Cipher Spec and Encrypted Handshake Records

Expanded Change Cipher Spec and Encrypted Handshake Records

11. The purpose of Change Cipher Spec is to indicate change in encryption and authentication

algorithms and to update the cipher suite to be used on this connection. This record is only

1 byte long in my trace.

12. The sender of this Encrypted Handshake Records and all handshake messages up to but not

including this message are encrypted in record. This information is concatenated and

hashed using two hash algorithms, MD5 and SHA. The content of this record is the

concatenation of these two hash values. The Encrypted Handshake Record is used to

verify that key exchange and authentication processes were successful.

13. Yes, the server also sends its own Change Cipher Spec and Encrypted Handshake records.

The only difference is the sender of this record; the sender is now the server while the

sender was the client in previous message.

Application Data Records

Expanded Application Data Record

14. The application data is encrypted using the specified algorithms in the chosen cipher suite;

in my case, RSA (public-key), 256-bit CBC AES (symmetric), and SHA (hash algorithm).

Yes, the records containing application data include a MAC; however, Ethereal does not

distinguish between the encrypted application data and the MAC.