Hands-On Ethical Hacking

and Network Defense, 3rd

Edition

Chapter 2
TCP/IP Concepts Review
 Objectives

After completing this chapter, you will be able to:

•Explain the TCP/IP protocol stack
•Explain the basic concepts of IP addressing
•Explain the binary, octal, and hexadecimal
numbering systems

Hands-On Ethical Hacking and Network Defense, 3rd 2

Edition
 Overview of TCP/IP
• Protocol
– Language used by computers to communicate
– Transmission Control Protocol/Internet Protocol
(TCP/IP)
• Most widely used
• TCP/IP stack
– Four distinct layers
• Network
• Internet
• Transport
• Application
Hands-On Ethical Hacking and Network Defense, 3rd 3
Edition
 Overview of TCP/IP

Hands-On Ethical Hacking and Network Defense, 3rd 4

Edition
 The Application Layer
• Front end to the lower-layer protocols
– This layer is what you can see and touch

Hands-On Ethical Hacking and Network Defense, 3rd 5

Edition
 The Transport Layer
• Encapsulates data into segments
– Use TCP or UDP to reach a destination host
• TCP is a connection-oriented protocol, which means
the sender doesn’t send any data to the destination
node until the destination acknowledges that it’s
listening to the sender
• TCP three-way handshake
– Computer A sends computer B a SYN packet
– Computer B replies with a SYN-ACK packet
– Computer A replies with an ACK packet

Hands-On Ethical Hacking and Network Defense, 3rd 6

Edition
 TCP Segment Headers
• Critical components of a TCP header:
– TCP flags
– Initial sequence number (ISN)
– Source and destination port numbers
• Abused by hackers
– You need to know hacking basics to protect a
network

Hands-On Ethical Hacking and Network Defense, 3rd 7

Edition
 TCP Segment Headers

Hands-On Ethical Hacking and Network Defense, 3rd 8

Edition
 TCP Flags
• Each flag occupies one bit of the TCP segment
– Can be set to 0 (off) or 1 (on)
• Six TCP segment flags
– SYN flag: synch flag
– ACK flag: acknowledgment flag
– PSH flag: push flag
– URG flag: urgent flag
– RST flag: reset flag
– FIN flag: finish flag

Hands-On Ethical Hacking and Network Defense, 3rd 9

Edition
 Initial Sequence Number
• ISN is a 32-bit number
– Tracks packets received by a node
– Allows reassembly of large packets that have been
broken up into smaller packets
– Sent on steps one and two of TCP three-way
handshake
• Sending node ISN is sent with SYN packet
• Receiving node ISN is sent back to sending node with
SYN-ACK packet

Hands-On Ethical Hacking and Network Defense, 3rd 10

Edition
 TCP Ports
• TCP packet
– Two 16-bit fields
• Contains source and destination port numbers
• Port
– Logical, not physical, TCP connection component
– Identifies running service
• Example: HTTP uses port 80
• Helps you stop or disable unneeded services
– More running services, more ports open for attack

Hands-On Ethical Hacking and Network Defense, 3rd 11

Edition
 TCP Ports
• Only the first 1023 ports are considered well-known
– List of well-known ports
• Internet Assigned Numbers Authority: www.iana.org
• Ports 20 and 21
– File Transfer Protocol (FTP)
– Was the standard for moving or copying large files
• Used today to a lesser extent due to popularity of
HTTP
– Requires a logon name and password
– More secure than Trivial File Transfer Protocol
(TFTP)
Hands-On Ethical Hacking and Network Defense, 3rd 12
Edition
 TCP Ports

Hands-On Ethical Hacking and Network Defense, 3rd 13

Edition
 TCP Ports
• Port 25
– Simple Mail Transfer Protocol (SMTP)
• E-mail servers listen on this port
• Port 53
– Domain Name Service (DNS)
• Used to connect users to Web sites using URLs
instead of IP addresses
• Port 69
– Trivial File Transfer Protocol
• Used for transferring router configurations

Hands-On Ethical Hacking and Network Defense, 3rd 14

Edition
 TCP Ports
• Port 80
– Hypertext Transfer Protocol (HTTP)
• Used when connecting to a Web server
• Port 443
– Secure Hypertext Transfer Protocol
• Reserved for secure connections to a Web server
• Port 110
– Post Office Protocol 3 (POP3)
• Used for retrieving e-mail

Hands-On Ethical Hacking and Network Defense, 3rd 15

Edition
 TCP Ports
• Port 119
– Network News Transfer Protocol
• Used to connect to a news server for use with
newsgroups
• Port 135
– Remote Procedure Call (RPC)
• Critical for operation of Microsoft Exchange Server
and Active Directory
• Port 139
– NetBIOS
• Used by Microsoft’s NetBIOS Session Service
Hands-On Ethical Hacking and Network Defense, 3rd 16
Edition
 TCP Ports
• Port 143
– Internet Message Access Protocol 4 (IMAP4)
• Used for retrieving e-mail

Hands-On Ethical Hacking and Network Defense, 3rd 17

Edition
 User Datagram Protocol (UDP)
• Fast but unreliable delivery protocol
– Operates on Transport layer
– Used for speed
• Does not need to verify receiver is listening or ready
• Depends on higher layers of TCP/IP stack to handle
problems
– Referred to as a connectionless protocol

Hands-On Ethical Hacking and Network Defense, 3rd 18

Edition
 The Internet Layer
• Routes packets to destination address
– Uses a logical address (i.e., IP address)
– IP addressing packet delivery is connectionless
• Internet Control Message Protocol (ICMP)
– Sends messages related to network operations
– Helps troubleshoot network connectivity problems
• ping command
– Tracks the route a packet traverses
• traceroute command

Hands-On Ethical Hacking and Network Defense, 3rd 19

Edition
 The Internet Layer

Hands-On Ethical Hacking and Network Defense, 3rd 20

Edition
 The Internet Layer

Hands-On Ethical Hacking and Network Defense, 3rd 21

Edition
 IP Addressing
• Consists of 4 bytes divided into two components
– Network address
– Host address
• Classes – based on the starting number of the first
byte:
– Class A
– Class B
– Class C

Hands-On Ethical Hacking and Network Defense, 3rd 22

Edition
 IP Addressing

Hands-On Ethical Hacking and Network Defense, 3rd 23

Edition
 IP Addressing
• An IP Address is composed of 4 bytes (an octet)
– A byte is equal to 8 bits (octet)
– Sometimes defined as four octets instead of 4 bytes
• Class A
– First byte is reserved for network address
– Last three bytes are available for host computers
– Supports more than 16 million host computers
– Limited number of Class A networks
• Reserved for large corporations and governments
– Format: network.node.node.node

Hands-On Ethical Hacking and Network Defense, 3rd 24

Edition
 IP Addressing
• Class B
– Divided evenly
• Two-octet network address
• Two-octet host address
– Supports more than 65,000 hosts
• Assigned to large corporations and Internet Service
Providers (ISPs)
– Format: network.network.node.node

Hands-On Ethical Hacking and Network Defense, 3rd 25

Edition
 IP Addressing
• Class C
– Three-octet network address and one-octet host
address
• More than two million Class C addresses
– Supports up to 254 host computers
• Usually available for small business and home use
– Format: network.network.network.node

Hands-On Ethical Hacking and Network Defense, 3rd 26

Edition
 IP Addressing
• Subnetting
– Allows a network administrator to divide large
networks into smaller segments (subnets)
– Subnetting concepts are important
• For performance and security purposes
• Subnet mask
– Each network must be assigned a subnet mask
• Helps distinguish network from host address bits

Hands-On Ethical Hacking and Network Defense, 3rd 27

Edition
 IP Addressing
• Subnet mask example:
– The IP address 128.214.018.016 in binary is:
10000000.11010110.00010010.00010000
– If the subnet mask is 255.255.255.0, it’s expressed
in binary as:
11111111.11111111.11111111.00000000
– The subnet part of the IP address is:
10000000.11010110.00010010
– The host part of the IP address is:
00010000

Hands-On Ethical Hacking and Network Defense, 3rd 28

Edition
 CIDR Notation
• Almost all of the world’s IPv4 addresses are in use
– Long-term solution is IPv6 addressing
• Short-term fix was CIDR (Classless Inter-Domain
Routing)
– Allowed more efficient IP-assignment space
• Example:
– 192.168.1.0/24
– The number following the “/” is the prefix

Hands-On Ethical Hacking and Network Defense, 3rd 29

Edition
 CIDR Notation

Hands-On Ethical Hacking and Network Defense, 3rd 30

Edition
 CIDR Notation

Hands-On Ethical Hacking and Network Defense, 3rd 31

Edition
 Planning IP Address Assignments
• Each network segment must have a unique
network address
– Network portion and host portion of an address
cannot contain all 0s or all 1s
• Accessing entities and services on other networks
– Each computer needs IP address of gateway
– TCP/IP Internet layer uses subnet mask to
determine destination computer’s network address
• If addresses are different, relays packet to gateway
• Gateway forwards packet to its next destination
• Packet eventually reaches destination
Hands-On Ethical Hacking and Network Defense, 3rd 32
Edition
 IPv6 Addressing
• Internet Protocol version 6 (IPv6)
– IPv4 wasn’t designed with security in mind
• Many current network vulnerabilities
– Developed to increase IP address space and provide
additional security
• Uses 16 bytes, or a 128-bit address
• 2128 available addresses
– All newer OSs are configured to enable IPv6
• Many router filtering devices, firewalls, and intrusion
detection systems are not
– Hackers bypass security systems

Hands-On Ethical Hacking and Network Defense, 3rd 33

Edition
 Overview of Numbering Systems
• As a security professional, knowledge of
numbering systems will come into play
– Binary
– Octal
– Hexadecimal

Hands-On Ethical Hacking and Network Defense, 3rd 34

Edition
 Reviewing the Binary Numbering
System
• Uses number 2 as its base
– Binary digits (bits) represented by 0 or 1
• Byte
– Group of 8 bits
• Can represent 28 (256) different numbers
• File permissions are represented with bits
– 1 represents having permission
• 111 (rwx): all permissions apply
– 0 removes permission
• 101 (r-x): user can read and execute but not write

Hands-On Ethical Hacking and Network Defense, 3rd 35

Edition
 Reviewing the Binary Numbering
System
• Example of binary:
– Learn and memorize the columns for binary
128 64 32 16 8 4 2 1
27 26 25 24 23 22 21 20
– To determine the value of binary number 01000001
128 64 32 16 8 4 2 1
27 26 25 24 23 22 21 20
0 1 0 0 0 0 0 1
Add the columns containing 1s to convert to a decimal number
64 + 1 = 65

Hands-On Ethical Hacking and Network Defense, 3rd 36

Edition
 Reviewing the Octal Numbering
System
• Uses 8 as its base
– Supports values from 0 to 7
• Octal digits can be represented with only three bits
• UNIX permissions
– Owner permissions (rwx)
– Group permissions (rwx)
– Other permissions (rwx)
• Setting permission (rwxrwxrwx) means they all have
read, write, and execute permissions

Hands-On Ethical Hacking and Network Defense, 3rd 37

Edition
 Reviewing the Hexadecimal
Numbering System
• Uses 16 as its base
– Supports numbers from 0 to 15
• Hex number consists of two characters
– Each character represents a nibble
– Value contains alphabetic letters
• A representing 10 and F representing 15
– Sometimes expressed with “0x” in front
• Hex number in binary or decimal
– Convert each nibble to binary
– Convert binary value to decimal

Hands-On Ethical Hacking and Network Defense, 3rd 38

Edition
 Summary
• TCP/IP
– Most widely used Internet communication protocol
– TCP/IP stack consists of four layers
• Network, Internet, Transport, and Application
• Application layer
– Front end
• Transport layer
– Encapsulation
– Uses UDP or TCP headers
• TCP is a connection-oriented protocol

Hands-On Ethical Hacking and Network Defense, 3rd 41

Edition
 Summary
• Critical components of TCP segment headers
– TCP flags
– Initial sequence number (ISN)
– Source and destination ports
• TCP ports
– Identify running services
• Internet layer
– Packet routing
• IP addressing
– Four bytes and three classes (A, B, and C)
Hands-On Ethical Hacking and Network Defense, 3rd 42
Edition
 Summary
• IPv6 addresses
– 16 bytes
– Written in hexadecimal notation
• Binary numbering system
– Uses 2 as its base
• Octal numbering system
– Uses 8 as its base
• Hexadecimal numbering system
– Uses 16 as its base

Hands-On Ethical Hacking and Network Defense, 3rd 43

Edition