Overview of TCP/IP Protocols and Networking Layers

Overview of TCP/IP
protocols
TCP/IP
• We will discuss an intro to the guts of Transmission
Control Protocol/Internet Protocol (TCP/IP)
• Details of packets
• Packet headers
• Protocols
• We will also discuss the relevance of certain
protocol features for Threat Intelligence
The Layers
• TCP/IP is built in layers
• Often referred to as TCP/IP stack
• We will discuss:
• The TCP/IP layers
• Their relationships to one another
Packets
• The smallest unit of data at the bottom of the
layering system
• Packets contain:
• Data intended to transmit between systems
• Control information to determine where the packet
should go
TCP/IP Model and the OSI Model
OSI Model: Theoretical (not implemented in its entirety today)
TCP/IP Model: Practical
https://www.tutorialspoint.com
Layer 1 (The Wire)
• This is the Physical layer
• Describes the actual medium on which the data
flows
Layer 2 (Ethernet)
• This is the Data Link layer
• Describes the Ethernet protocol
• Ethernet gets a packet from one host on a local area
network (LAN) to another host on a LAN
Layer 2 (Ethernet) – checksum
• Ethernet sends packets along with a checksum
• checksum allows the receiver to validate whether
the packet arrived as it was sent
• The checksum is done by computing the Cyclic
Redundancy Check (CRC)
• The receiver computes CRC and compares with the
checksum
• If they do not match, the packet is dropped
• Ethernet relies on upper-level protocols to handle
retransmission
Layer 3 (IP)
• This is the Network layer
• The layer where Internet Protocol (IP) resides
• IP understands how to communicate with:
• Hosts inside the immediate LAN
• Hosts that are not directly connected to you
• e.g., Hosts on other subnets, the Internet, via routers
Layer 3 (IP) – reliable connections
• IP was meant to be a foundation where other
protocols can rest
• Therefore, IP header does not specify which
application the packet should go
• Because not all protocols need reliable connections
or guaranteed packet order
• Thus, it is the responsibility of higher-level
protocols to provide additional features if needed
Layer 3 (ICMP)
• The Internet Control Message Protocol (ICMP) is an
error-reporting protocol
• Designed for hosts to communicate directly
• Since the data is used by OS and not users
• ICMP doesn’t support port numbers, reliable delivery,
packet order, etc.
• Every ICMP packet contains a type
• Type: The nature of the message
Layer 3 (ICMP) – ping
• Most popular type is ”Echo-Request” used by ping
• When a host receives “Echo-Request”, it replies
with “Echo-Reply”
• This helps determine if a system is up
• It also helps determine packet latency
Layer 4 (TCP, UDP)
• This is the Transport layer
• TCP provides a reliable transport for one session
• Session: A single connection from client to a server
• What do we mean by reliable transport?
• Handling the ordering of packets
• Handling the retransmission of packets
• If a packet arrives with a problem, TCP automatically requests it
from the sender
• TCP is bidirectional
• Same connection used for sending/receiving data
Layer 4 (TCP, UDP)
• UDP is also bidirectional
• However, UDP does not provide reliability
• Why use UDP?
• Good for two types of traffic
• Short request/response transactions
• Domain Name System (DNS)
• Data streaming (at least used to be)
• Less overhead
Layers 5-7 (HTTP, SSL, etc.)
• This the Application layer
• All applications that use TCP and UDP reside here
• HTTP, SSL, DHCP, FTP, SSH, TLS/SSL, etc.
Packet Headers
• Pieces of information that tell the protocols how to
handle the packet
• Contains addressing and other data required for
the packet to reach its intended destination
Ethernet
• Ethernet header contains three entries:
• The destination address
• The source address
• The packet’s protocol type (IP, etc.)
Ethernet
• Source/Destination Addresses
• Ethernet addresses are also called Media Access Control
(MAC)
• 48-bit numbers that uniquely identify every Ethernet
card in the world
• Although MAC can be changed, it is not recommended
• All devices in a LAN need to have unique MAC addresses
• By default, this is guaranteed
• If destination is set to ff:ff:ff:ff:ff:ff, it is broadcast
Ethernet
• Protocol type
• A 16-bit-value
• Specifies what protocol this packet is to be delivered to
• 0800 in hexadecimal is used for IP packets
IP (IPv4)
• IP header contains
• IP version
• IPv4 or IPv6
• Header length
• Due to Options, need to
specify where data begins
• Specifies how many
options there are
• Multiply this number by 4
to get the length in bytes
• Typically, set to 5 (20
bytes), when no Options
• Type of Service (ToS)
• To place the packet in a
prioritized outgoing
queue, etc.
IP (IPv4)
• IP header contains
• Total length (in bytes)
• Length of complete
packet
• Including IP and TCP
headers (not Ethernet)
• Maximum length for IP
packet (65,535 bytes)
• The identification
number
• Unique number used by
a host to identify a
specific packet
IP (IPv4)
• IP header contains
• The flags
• Indicates whether the
packet is fragmented
• Maximum
Transmission Unit
(MTU) specifies the
largest length for a
packet to be
transferred between
two hosts
• If packet is larger than
MTU, the packet is
fragmented
IP (IPv4)
• IP header contains
• Fragment offset (in byte
format)
• Specifies which portion of
a packet it is
• Time-to-live (TTL) (number
from 0-255)
• How many hops a packet
can traverse before being
dropped
• Protocol field
• Specifies which upperlevel protocol the packet
is to be delivered (TCP,
UDP, ICMP)
IP (IPv4)
• IP header contains
• Checksum
• The sum of every byte in
IP header (including
options)
• The receiver performs the
same calculation and
compares
• If it doesn’t match, drops
the packet
• IP addresses
• 32-bit addresses
• Stored as 32-bit integers
not the human readable
“x.x.x.x” format
TCP
• Source and destination
port numbers
• 16-bit in length,
therefore 0-65535 port
numbers
• Typically, port numbers
are > 1023
• 1-1023 reserved for
system use by OS
• Flags
• Indicates whether the
packet
• Initiates a connection
• Contain data
• Terminate a connection
TCP
• Flags
• URG (Urgent) – Packet
should receive priority
processing
• ACK (Acknowledgement) –
Acknowledges successfully
received data
• PSH (Push) – Requests that
any received data be
processed immediately
• SYN (Synchronize) –
Requests a new connection
to start
• FIN (Finish) – Requests to
end the connection
• RST (Reset) – Immediately
terminates connection
TCP
• Sequence &
Acknowledgement
numbers
• Used to keep track of
the number of packets
sent
• Used to acknowledge a
packet when received
• Window size (in bytes)
• Buffer space availability
• Used for sliding window
technique of TCP
• Header length
• Like IP, specifies header
length
A Complete TCP Connection
• TCP supports the concept of a connection
• Each connection must go through a sequence to
get established
• When done, they must go through another
sequence to close the connection
Opening a Connection
• TCP undergoes a three-way handshake for every
connection that it opens
• This allows both sides to:
• Send each other their state information
• Acknowledge the receipt of the data
• The first packet is sent by the host (client) that wants
to open a connection with another host (server)
• Client sends a TCP packet over IP and sets the TCP flag
to SYN
• The client also sets the initial sequence number
• The client uses this number for all the data it will send
Opening a Connection
• The second packet is sent from the server to the
client
• This packet has two TCP flags set: SYN and ACK
• Purpose of ACK is to tell client that the request has been
received
• Client’s sequence number is placed in the
acknowledgement field
• Server also sends its sequence number that it will use
Opening a Connection
• The third packet is sent by the client
• It has only the ACK bit set in TCP flags
• Acknowledges the server that it received its SYN
(including server’s sequence number)
• Why all this hassle to start a connection?
• SYN packet is crucial to provide reliable and in-order
transport
• Without all three packets exchanged, neither side is
sure that the other side received the first SYN packet
Closing the Connection
• TCP can end connections in two ways:
• Ungracefully
• One side can tell the other “stop now!”
• Ungraceful shutdowns are accomplished with RST flag
• RST packets are not acknowledged
• Gracefully
• The side to end the connection sends a packet with FIN flag set
• The side that sends a FIN packet cannot send anything other
than acknowledgements at this point
• The other side can still send data
• Once the other side is done with sending data, it sends a FIN
packet as well
• Like SYN packet, the FIN packet is acknowledged
UDP
• In comparison to TCP header, UDP headers are
much simpler
End of Lecture 4
ARP Protocol
• The Address Resolution Protocol (ARP) maps IP
addresses to Ethernet addresses
• Steps:
• Client looks in its ARP cache for the destination IP-MAC
entry
• If MAC for the IP found
• Sends directly
• If MAC for the IP not found,
• Sends broadcast message
• Destination replies
• Client updates ARP cache and sends the packet
Why ARP and not Broadcast?
• Eliminates overhead
• Broadcast messages require hosts to take a moment
process them
• Eliminates network congestion
• Switches rely on Ethernet addresses to quickly forward
packets to the right place
HTTP
• ASCII-based, stateless protocol
• A request/response protocol
• Generally, uses TCP/80
• 8080 is Apache Tomcat's default port
• HTTP/1.1 is the most common version
HTTP – Forensics relevance
• Important protocol to understand user actions
• What kind of web content was displayed?
• Which files were downloaded?
• The entire session that took place can be regenerated
• Helps review if malware injected or an attack took place
• Helps review malicious activity
HTTP
• Each webpage, image, etc. transfer is a result of
one HTTP request and response pair
• Visiting a webpage could cause several of these
pairs to be exchanged between client and server
Request Message
• In the request message, the following information
is required:
• Request method (e.g., GET, POST)
• Request string (e.g., index.html)
• Protocol version (e.g., HTTP/1.1)
• Host (e.g., google.com)
• Everything else is optional
Optional Fields
• Optional fields in protocols can be used for
purposes that it wasn’t intended for in the first
place
• Data extraction (retrieve sensitive, private data)
• Data injection (send malicious data, malware into the
network)
• Packets received should be inspected carefully for
the inclusion of such misuse
• e.g., Using firewall, IDS, IPS, etc.
Request Message
• Methods:
• GET: To request a resource from the webserver
• POST: To upload files to the webserver (also form
submission)
• OPTIONS: To query the server for requirements or
capabilities
• HEAD: Like GET but only returns the header
Request Message
• Methods: (cont’d.)
• PUT: To request the server to create a resource at the
specified location to contain the data to be sent
• DELETE: To remove a resource at the specified location
• TRACE: Performs a message loop-back test along the
path to the target resource. Acts as a useful debugging
mechanism. Disabled by many for security concerns.
• CONNECT: To request to create a secure tunnel (e.g.,
SSL/TLS encryption)
NOTE: The rate of packets
received for each method
can also be an indication of
anomaly.
Request Message
• Header fields:
• Host: Hostname
• User-Agent
• Mozilla does not necessarily mean Firefox, it is a compatibility
statement
• User-agent lookup sites can be used to identify the host
machine
• Accept: Accepted content type
• Connection: (keep-alive, close)
• Referer: Previous page from which the request is made
• Cookie: Two types;
• Session: Cookie removed when client terminates
• Persistent: Cookie resides and has expiration time
NOTE: Host usually at the top. If not, can be an
indication of an anomaly.
NOTE: If User-Agent ambiguous, you
might want to check it.
NOTE: Cookies can help build user profile.
Response Message
• In the response message, the following information
is required:
• Protocol Version
• Response Code
• Response Phrase
• Everything else is optional
Response Message
• Header fields:
• Protocol Version
• Response Code: To provide feedback to the client. In
families of 100s;
• 100s: Info
• 200s: OK
• 300s: Redirection
• 400s: Client error
• 500s: Server error
• Response Phrase: Contains arbitrary text
NOTE: Response phase can be
misused. e.g., “OK “ instead of “OK”.
Response Message
• Header fields: (cont’d.)
• Content-Length: In bytes
• Content-Type
• Date: Can be used by proxies for caching
• Server: Like User-Agent for client
• Cache-Control:
• How should the client handle caching?
• What should be the expiration on the cache?
• Redirection: Contains the link to direct the user to
• 301 permanent
• 302 temporary
• Data: Optional (may be empty when redirecting)
DNS
• A stateless protocol
• A query/response protocol
• Usually UDP/53
• One of the most common protocols in use
• Translates human-readable hostnames to IP
equivalents (vice-versa)
• Also helps distribute load (load balancing) for CDNs
DNS Record Types
Record Type Description
A (host) Resolves a domain name to an IPv4 address
AAAA (host) Resolves a domain name to an IPv6 address
PTR (pointer) Resolves an IP address to a domain name
CNAME (alias) Resolves one domain name to another domain name, which
allows multiple domain names to be resolved to the same IP
address
MX Used for mail exchange servers (email servers)
SRV Specifies a host and a port for specific services, e.g. VoIP
NS Indicates the authoritative DNS server for a domain (The
server that contains the actual DNS records)
NOTE: The rate of these records can give helpful insight.
DNS
• DNS works on distributed,
hierarchical system of servers
• If not already in cache, request
first goes to a recursive resolver
• A server managed by ISP or
• A server managed by the
enterprise itself
• Resolver generally forwards the
request to a root server
• This server knows about top-level
domains (.com, .net, .org, etc.)
https://www.appneta.com/
DNS
• Next, the request is sent to
the top-level domain (TLD)
server
• This server recognizes the
secondary domain (e.g., the
“google” in
“www.google.com”)
• Then the request is sent to
that domain’s authoritative
name server
• This server holds the IP
address
https://www.appneta.com/
Fast-Flux
• A technique employed by malicious bots to hide
their origin by rapidly changing DNS entries
• Blocking the IP of the infected DNS server doesn’t
help
• Because it keeps changing
• The IP of the C2 server is the one that needs to be
blocked
• Several features are known to be helpful in
detecting fast-flux
• e.g., Low TTLs, existence of many records per DNS
response, etc.
Fast-Flux
• Protocol used to transmit files between computers
• A query/response protocol
• FTP is decreasing in its popularity
• A lot of file transfer now is handled using HTTP
• Multiple stream protocol
• Command channel (TCP/21)
• Data channel (TCP/20)
• Originally unencrypted (back when Internet was
trusted)
• New extensions add encryption
FTP
SMB
• A network communication protocol
• Provides shared access to files, printers, etc.
between nodes in the same network
• Stands for Server Message Block
• A complex protocol
• Typically uses a single TCP connection
SMB
• Originally designed by IBM
• Microsoft took the protocol and added additional
features to it
• Microsoft released SMB 2.0 with Windows Vista
• It reduced the chattiness of the protocol
• Chattiness: How much data transmitted over the network
• SMB 3.0 was released with Windows 8/2008 R2
• It added additional functionalities and improvements
SMB
• Microsoft attempted in the late 90’s to rename
SMB to CIFS
• CIFS (Common Internet File System)
• CIFS added some additional features
• However, the name did not catch on
• Future versions used the name SMB
• You may hear both terms used interchangeably
• They both refer to the Windows File Sharing
SMB
• Current OSes support SMB 2.0 and SMB 3.x
• Typically uses TCP Port 445
• Older versions did not encrypt data
• SMB1 has security issues and discouraged to use
• HMAC SHA-256 in SMB2 changed to AES-CMAC in
SMB3
SMB – Forensics relevance
• SMB helps:
• Understand malicious activity taken place in the network
• Determine what resource(s) was accessed, viewed
• Determine what resource(s) was copied
SMTP
• Helps send, receive, and/or relay outgoing mail
between email senders and receivers
• Email travels through multiple servers to make it to
destination
• Stands for Simple Mail Transfer Protocol
• Originally unencrypted
• New extensions add encryption
• SMTP - port 25 (default port for outgoing mail) or 2525
(less commonly used) or 587 (used by mail clients to
submit email, often encrypted w/ SSL/TLS) or 465
(deprecated by STARTTLS on port 587)
SMTP
• Optional fields in SMTP header can be misused
• Originally, e-mails were intended to transfer text in
ASCII
• Multipurpose Internet Mail Extensions (MIME)
• Supports text in character sets other than ASCII
• Files, attachments can be represented in base64
• Therefore, MIME allows attachments in e-mail
• Abnormalities in optional fields and MIME content
neeed to be checked to detect misuse