Practical connection assignment 500 WORD ( due in 4 hours MANDATORY ) NO PLAGIARISIM ).
anve5h.5p10
ISOL532Spring2017Week32.pptxISOL 532 Telecommunications and Network Security
Week 3: TCP\IP Model; Routing Protocols; IP Addressing; Firewalls
Note From Library Resources
Are you an online student who needs help with research? Are you unsure what library resources are available to you and how to use them? Sign up for a library orientation session and get the help you need! Courses are open to undergraduate and graduate students. Sign up now!
Introduction to Library Resources
(all times EST) January 25 , 6 PM
January 25, 7PM
Get more information and register here: http://www.ucumberlands.edu/library/orientationreg.php
This free, online, not for credit 1 hour session is intended to orient all online students (undergraduate and graduate) in any degree to library resources and services. This session will answer the questions:
- How do I find a database?
- How do I identify a scholarly article?
- What do I do when an article is not available in this database in full-text?
- What library services are available to off-campus students?
There will be time following the session for questions and research assistance.
Carrie E. Byrd
Reference and Instruction Librarian
University of the Cumberlands
(606)539-4160
Graduate International Students English Help
Office of International Academic Services
These services are specifically designed and run to help international students improve their writing (essays, research, projects, etc.) and can also be used to improve reading, listening and speaking skills. Most importantly, our tutoring services are very easy to access because they are open to graduate students ONLINE.
Online tutoring help on Blackboard, on the home page under “Organizations”.
In a recent on-campus survey, our international students noted that our services helped them improve their grades, and would recommend our help to others.
Resources:
Sarah Hammond ([email protected])
Julie Deyrup - Director, International Academic Services ([email protected])
New iLearn Links
Welcome! We have a new resource for EMSISS students. We hope that this iLearn Organization will provide a place to share news, links, and opportunities with peers. You will find the “Information Security Systems Students” on your iLearn Homepage.
A few resources currently available:
Residency Course weekend dates.
Internship and Employment Opportunities - This is a forum for you to share opportunities for placements that you have learned or know about or share your skill sets that you are hoping to find a placement for CPT. This is NOT a resources for CPT processing assistance - be sure to contact [email protected] for those questions.
Social Media Link: Want to keep up with the School of Computer and Information Sciences? Follow us on Twitter @ UCCyberPatriots
A Scholarship Opportunity for females in Cyber.
This organization will be updated with resources often, keep checking back!
Common Terms
Octet – 8 bit number (binary)
IP address – logical location of a node on the network; similar to a street address in the physical world; consists of 4 octets
TCP/IP Network Model
When TCP/IP was defined in the early days of the Internet, the OSI Reference Model had not been defined, so a different layering model was used
It consists of 5 layers, and maps closely to the OSI Reference Model
Layer 1 – Physical
Layer 2 – Link
Layer 3 – Internetwork
Layer 4 – Transport
Layer 5 – Application
TCP/IP Reference Model
Page 99-100
© Copyright 2012 – 2013 (ISC)², Inc. All Rights Reserved.
For Personal Use of (ISC)2 Seminar Attendee Only.
Contents May Not Be Copied or Otherwise Distributed Under Any Circumstances
© Copyright 2012-2013 (ISC)², Inc. All Rights Reserved.
For Personal Use of (ISC)2 Seminar Attendee Only.
Contents May Not Be Copied or Otherwise Distributed Under Any Circumstances
Layer 1
Layer 1 – The Physical Layer
Copper Cable
Coax – bulky, heavy, but relatively immune to noise
Twisted pair – thinner, lighter, cheaper, and okay about noise (interference)
Fiber Optic Cable
Multi-mode – good for relatively short distances (a couple of km) and moderate speeds (< 10 Gbps)
Single-mode – good for short and long distances (100+ km) and virtually any speed
Radio, Microwaves, Satellite, others
None are inherently secure; even fiber optic can be tapped
Layer 2
Layer 2 – The Data Link Layer
Types of links
Ethernet
Token Ring
FDDI (ring)
ATM (protocol; supposed to have been the ethernet killer but is now used by some large service providers)
SLIP/PPP (protocols typically used by modems)
Frame Relay (typically used by telephone companies)
SONET (fiber-based; used by service providers for large internet connections)
L2: Ethernet
Ethernet
Ethernet has a very simple transmission control protocol
Listen to the network
If someone is talking, wait your turn
If no one is talking, send your data
If someone starts talking while you are talking, stop talking resend data (this is when a data collision occurs)
Ethernet Frames
Ethernet transmissions occur in “frames” of 64 to 1518 octets in length (Remember: layer 1 is Bits, layer 2 is Frames)
The frame contains a header, data, and a checksum
The header contains source and destination addresses and the frame type
Simple ethernet frame:
64 – 1518 octets
Header
Data
FCS
Dst Address
Src Address
Type
6 octets
6 octets
2
4 octets
14 octets
Breakdown of a Simple Ethernet Frame
Header (always 14 Octets)
Destination address – MAC address of target
Source address – MAC address of sender
Type
Payload – data
Trailer
Checksum – for error correction
L2 Hardware
Early Ethernet devices had fairly basic functions
Transceivers physically connect hosts to the Ethernet cable (basically an adapter that connected a computer to the cable)
Repeaters amplify and repeat frames from one cable to another (needed for distance)
Bridges selectively amplify and repeat frames from one cable to another (not used very much today as networking is not done at Layer 2)
Hubs provide a combination of convenience and flexibility
Hubs are\were a way to multiple devices to a network\create a network. Can be a repeater and broadcasts to every device rather than to a selected host; insecure (due to broadcast), slower since it broadcasts
Twisted pair Ethernet hubs made it practical to provide network connections in office spaces
Hub == Concentrator == Repeater!
L2 Hardware
Switches provide for improved performance
Recall that bridges selectively forward frames from one network segment to another, while repeaters (hubs) always forward frames from one network segment to another
Switches are simply multi-port bridges implemented in hardware
More secure and faster than hubs (selective transmissions)
Wireless Access Points
Finally, Wireless Access Points removed the need for cables between the network and the system (but still needed to the access point)
An access point is sort of a hub/switch hybrid
Individual systems have to share available bandwidth (radio waves; individual system to access point like a hub)
Frames are selectively transmitted between network segments (wired/wireless; Access point to the network like a switch)
Wireless systems may or may not be able to “hear” each other’s transmissions
L3
Layer 3 – The Network Layer
Layer 3 is where we connect layer 2 networks together
The layer 2 networks can be the same or different technologies
They can be the same or different speeds
Uses packets (collections of frames)
Many of the concepts are the same as layer 2, only different (ex: addressing; Frames vs Packets)
IP is the protocol used at this layer
L3
IPv4 is the most successful layer 3 protocol ever developed
Billions of systems
Every time zone
Every continent (yes, even Antarctica!)
The basic protocol is unchanged since its inception in the early 80’s
IP Packets
IP Packets
Header
Addresses
Protocol
Control information
Payload (data)
Header
Payload
TTL
Source Address
Destination Address
Identification
VER
Options
Total Length
Header Checksum
TOS
Protocol
IHL
Padding
Offset
Flags
32 bits
IPv4 Addresses
.
.
.
172
24
57
18
All devices have a unique 4 octet logical address called the IP address
10101100
00011000
00111001
00010010
IP Network Masks
All systems on a single layer 2 network must have IP addresses with the same prefix
This prefix is the network portion of the IP address – the remainder is the host portion
IP addresses are arbitrarily split into a network portion and a host portion – local network administrators decide where the split between the network and host portions is rather than the protocol
IP Network Masks
Network Masks
Network masks specify where the split between network and host portions is
A mask is a 32-bit quantity, just like an IP address, and can be represented the same way as a dotted “quad”
.
.
.
255
11111111
255
11111111
255
11111111
0
00000000
IP Network Masks
10101100 00011000 00111001 00010010
11111111 11111111 11111111 00000000
10101100 00011000 00111001 00000000
172.24.57.18
255.255.255.0
172.24.57.0
10101100 00011000 00111001 00010010
11111111 11111111 11111111 11110000
10101100 00011000 00111001 00010000
172.24.57.18
255.255.255.240
172.24.57.16
IP Network Masks
Network Masks (cont.)
Knowing the network mask is important to understanding the structure of any IP address.
But writing “172.24.57.18 with mask 255.255.255.0” is cumbersome.
We could shorten it to “172.24.57.18/255.255.255.0”, but even that is longer than we need.
IP Network Masks
Slash notation (aka CIDR Notation)
11111111 11111111 11111111 00000000
255.255.255.0
11111111 11111111 11111111 11110000
255.255.255.240
24 bits
28 bits
172.24.57.18/255.255.255.0
172.24.57.18/255.255.255.240
172.24.57.18/24
172.24.57.18/28
IP Addresses Subnetting
2 methods
Classful (1981): Ip addresses are broken into groups of addresses called classes
Classless Inter-Domain Routing (CIDR) (1983) – similar to classful but much more scalable
Classful IP Addressing
IP addresses were broken up into classes of networks
Classful IP Addresses
The Internet Assigned Numbers Authority (IANA) established certain blocks of IPV4 addresses for the use of private (LAN) and public (Internet) addresses.
American Registry for Internet Numbers (ARIN) is the Regional Internet Registry (RIR) for Canada, the United States, and many Caribbean and North Atlantic islands.
The private IP addresses will fall within these specific ranges: (Note: Important!!!!)
Classless IP Addresses
Uses the exact same address scheme as classful
Provides for the ability to roll up the address of a network or group of networks for routing purposes.
More in depth: http:// www.ciscopress.com/articles/article.asp?p=348253&seqNum=6
L3 Hardware
Routers are the primary Layer 3 device (think of them as traffic cops)
Routers perform two distinct functions:
Switch packets between networks
Maintain network topology information
L3 Hardware
“Layer-3 switches” is a newer term
It may just be another term for “router” (i.e. a marketing term)
May be a “hybrid” L2/L3 device
Grew “up” from L2
Grew “down” from L3
L3 Routing
Basic IP Routing (Switching) Algorithm
Look at the destination IP address
If it is one of my addresses, deliver it to the local system
Else if it is on one of my attached networks, deliver it directly using link-specific mechanisms
Else find the longest match (address/mask) in a local table and send the packet to the next hop address from that entry
Else inform the sender of failure
L3 Routing
Routing Tables
Mandatory Information
Destination IP Address
Netmask
Next Hop Router Address
Optional Information
Layer 2 information (address)
Interface index
Flags
IP Routing
Routing Table Maintenance
Static Configuration
Works well for small tables with little need for change
Dynamic Routing Protocols
Allows routers (and sometimes hosts) to inform each other about current network topology
Work well for large tables or highly dynamic networks, but are often overkill for hosts
IP Routing Protocols
Routing Protocols
Many variations
Some designed for use within a site network (Interior Gateway Protocols)
Routing Information Protocol (RIP)
Older; updates every 30 seconds
15 router limit
Calculates path by using hop counts
Open Shortest Path First (OSPF)
Gathers data from routers on network and creates topology map
Uses shortest path first (SPF) algorithm; no hop count limit
Needs more processing power
No 30 second update, so it creates less traffic
IP Routing Protocols
Some designed for use between sites (Exterior Gateway Protocols)
Exterior Gateway Protocol (EGP)
First TCP\IP exterior routing protocol
Uses a hierarchical (Tree) topology (Distance\path vectors not a concern)
Maintains its own database of what networks it can reach and shares that with the routers it can reach
Border Gateway Protocol (BGP)
Uses path vector protocol over TCP\IP
Designed to replace EGP and decentralize the Internet
Uses Routing Information Bases (RIBs) to store information about networks and the routes to them
Only sends updates when needed instead of the whole RIB
Able to handle many different autonomous networks while EGP is fairly limited
Backwards compatible so it can use information provided by EGP
All have the same goal – a consistent view of the network topology
L4 UDP
UDP – The User Datagram Protocol
Connectionless
Datagram based
Unreliable
“Quick & Dirty”
Common uses:
Domain Name System (DNS)
Simple Network Management Protocol (SNMP)
Older Network File System (NFS)
L4 TCP
TCP – The Transmission Control Protocol
Connection-oriented
Slower than UDP
Stream based
Reliable
In order
Once and only once
“Heavy weight”
3-way handshake
Common uses:
Remote login (Telnet, RSH/Rlogin, SSH)
File Transfer (FTP, SCP, HTTP)
Newer NFS
TCP Three-Way Handshake
Layer 5
Telnet – Remote Login
File Transfer Protocol (FTP) – File Transfer
Simple Mail Transfer Protocol (SMTP) – Email
RSH/Rlogin – Remote Login
HyperText Transfer Protocol (HTTP) – World Wide Web
SSH/SCP – Secure Remote Login/File Transfer
1000’s of others – anything that interfaces with software is Layer 5
Firewalls
Regardless of type, all firewalls use rules (also called filters) to restrict or allow traffic
Two main Philosophies governing the use of rules:
Default deny
Default allow
Default deny is the most secure
Rule\Filter Philosophies
Default Deny
Assumes all traffic is malicious\unwanted\unauthorized
As allowable traffic is determined, it is allowed by exception (also known as Deny by default\allow by exception)
Narrows avenues of possible attack
Rules\Filter Philosophies
Default Allow
Assumes all traffic is allowed and wanted
As malicious or unwanted traffic is identified it is blocked by a rule (also known as Allow by default, deny by exception)
Requires much more administration
Firewall Rules
Firewalls will arrive pre-configured with rules
Never trust a third party to know what is best for your environment
An organization must determine, as part of the Security Policy, what rules need to be defined
Firewall Rules
If Firewall rules are not defined by the Security Policy, perform the following (found on page 215 of the textbook):
Inventory all essential business process and communication that will cross the checkpoint
Determine the protocols, ports and IP addresses of valid traffic for both internal and external hosts
Write out the rules on paper or using a firewall rule designed/simulator
Test the rules in a laboratory environment
Obtain written approval for the rule sets from a change approval board
Document the rules into a security policy procedure amendment to the security policy management team for inclusion in the official document
This is the basic process whenever a new security process is introduced – it must be written, tested and approved. Always, always test!
For Next Week
Finish reading\re-reading Chapters 2 and 7
I will be making Labs 4 and 5 available
Don’t forget the Introduction for those of you who haven’t done it yet.
