What is Header • Header information, or overhead data, is only used in the transmission process, it is stripped from the packet when it reaches its destination. • The header identifies the source and destination of the packet, while the actual data is referred to as the payload. • TCP header ==> minimum size of 20 bytes and maximum of 60 bytes. • IP header ==> minimum size of 20 bytes and maximum of 24 bytes. • UDP headers are limited to 8 bytes in size.
TCP Header Format Field Explanation Source port TCP port of sending host. Destination port TCP port of destination host. Sequence number The ID number of the current segment (the sequence number of the last byte in the segment). Ack number The sequence number of the next segment expected from the other host (that is, the sequence number of the last segment received +1).
Data length Length of the TCP segment.
Flags Type of content in the segment (ACK, SYN, FIN, and so on). Window The amount of data the host is willing to receive before sending another acknowledgement (used for flow control).
TCP Header Format Field Explanation Checksum Ensures validity of the segment. The checksum is calculated on the value of not only the TCP header and payload but also part of the IP header, notably the source and destination addresses. Consequently, the mechanism for calculating the checksum is different for IPv6 (128-bit addresses) than for IPv4 (32-bit addresses).
Urgent Pointer If urgent data is being sent, this specifies the end of that data in the segment.
Options Allows further connection parameters to be configured. The most important
of these is the Maximum Segment Size. This allows the host to specify how large the segments it receives should be, minimizing fragmentation as they are transported over data link frames.
• Port Number – Internet Assigned numbers Authority (IANA) maintains a list of port number assignment • It is 16 bit integers, range from 0 -65535 • Well-known ports from 0-1023 • Registered Ports from 1024-49151 • Dynamic or Private Ports from 49152-65535 – Combination of IP address and port number is called a Socket address
• Port Scanners – It is software design to find out TCP and UDP ports status • Netstat – This command allows to check the state of ports on the local host – Check service misconfiguration – Check suspicious IP address ranges
• NMAP Tool – The NMAP is used for scanning remote hosts and networks – It is open source software – It uses diverse methods for host discovery • Can operate stealthily and serve to defeat security mechanism – Firewalls and Intrusion Detection
Protocol Analyzers • Protocol Analyzers • Can decode a captured frame to reveal its contents in a readable format • Analyzing protocol data at the packet level will help to identify protocol or service misconfiguration • Perform traffic analysis to monitor statistics related to communications flows such as bandwidth consumed, link utilization and reliability
Demonstration • Using netstat commands to verify TCP connections • NMAP tools to find out port & protocol status • Using Wireshark tool for Protocol analysing
Computer Names Assigned to Computers A hostname is a computer name that is added to a domain name and top level domain to make a fully qualified domain name (FQDN) Hostname Domain Top level
AcctDirPC jetking com
Fully qualified domain name = AcctDirPC.jetking.com
Forward & Reverse Lookup Zones A forward lookup zone is the most common type of zone. DNS clients can use this zone to obtain such information as IP addresses that correspond to DNS domain names or services that is stored in the zone.
A reverse lookup is the opposite of a forward lookup: It
returns the fully qualified domain name of a host based on its IP address. It provides mapping from IP addresses back to DNS domain names
DNS Records DNS Records Start of authority record (SOA) - Specifies authoritative information about a DNS zone, including the primary name server, the email of the domain administrator, the domain serial number, and several timers relating to refreshing the zone
PTR - You can think of the PTR record as an opposite of
the A record. While the A record points a domain name to an IP address, the PTR record resolves the IP address to a domain/hostname.
Summary • Transmission Control Protocol (TCP) – Transport layer Protocol – Supports Segmentation – Connection-oriented Protocol – Manage Flow control • NMAP Tool – The NMAP is used for scanning remote hosts and networks – It is open source software – It uses diverse methods for host discovery • Can operate stealthily and serve to defeat security mechanism – Firewalls and Intrusion Detection
Summary • Resource records in forward lookup zones include: – A, MX, SRV, NS, SOA, and CNAME
• Resource records in reverse lookup zones include:
– PTR – Address Mapping records (A) - The record A resolve hostname (FQDN) to IP Address – Canonical Name records (CNAME) - The CNAME record specifies a domain name that has to be queried in order to resolve the original DNS query.
• List of Labs – Connect systems and check TCP flags – Use NMAP tools and perform host discovery, port scanning and OS fingerprinting – Configure DNS and records
