In the OSI framework, the concept of encapsulation is the process of "packaging" information prior to transmitting it from one location to another. When transmitted across the network, it moves down from the application layer to the physical layer and then through the physical medium. As the data moves from the application layer down, the information is packaged and manipulated along the way until it becomes a collection of bits that race down the wire to the receiving station, where the process is reversed as the data moves back up the model.

Figure 2-3. Encapsulation.

Figure 2-4. Attack layer and the OSI reference model.

Although TCP/IP is the dominant networking model, the OSI reference model remains important. It has served as an invaluable tool or reference model that can be used to map the location of various services. Table 2-1 illustrates each layer of the OSI reference model and some of the various services found at each layer. The OSI reference model protocols at the application layer handle file transfer, virtual terminals, and network management, and fulfill networking requests of applications. A few of the protocols are shown in Table 2-1.

Physical/network equipment located at this layer of the TCP/IP model usually includes the following devices:

Although low-end consumer switches have limited functionality, more expensive switches that are found in large networks provide greater functionality. These higher-end switches typically provide the following:

All switches work in similar ways with vendors adding additional value-added features to make their product easier than, or different from, a competitor's. Even with this functionality, all devices connected to a switch are thought to be part of the same broadcast domain; that is, each port on a switch is a separate collision domain. A broadcast frame sent by any particular device on a switch is automatically forwarded to all other devices connected to the switch.

Protocols found at this layer include ARP, Reverse Address Resolution Protocol (RARP), Transport Layer Security (TLS), Layer 2 Tunneling Protocol (L2TP), LTTP, Point-to-Point Protocol (PPP), and Serial Line Interface Protocol (SLIP). One of the most important services is ARP.

ARP's role is to provide the ability to resolve IP addresses to an unknown MAC address. ARP works by using a two-step process to perform resolution. First, it uses a broadcast requesting a physical address from a target. Each device processes the request, and if the station with the address requested is reached, it responds with its physical or MAC address. Requests that are returned are cached on the local system for later reference if needed.

The ARP cache on a system can be viewed at any time by using the ARP—a command at the command line on a system. An example of this command is shown here:

You can use ARP to bypass the features in a switch. For example, an attacker can provide falsified ARP responses that are accepted as valid. The switch then "thinks" that the attacker is really the other system, and redirects traffic to that address.

Also included at this layer are legacy protocols known as Serial Line Interface Protocol (SLIP) and Point-to-Point Protocol (PPP). Although both provide the ability to transmit data over serial links, PPP is more robust than SLIP and has therefore displaced SLIP in many implementations. For the most part, SLIP is seen only in very specific environments and deployments, such as older networks.

Several security threats exist at this layer. Before security professionals can understand how to defend against them, they must first understand the attacks. Some common threats found at this layer include the following:

In order to protect against physical layer attacks some simple countermeasures can be employed:

The primary piece of equipment located at the internetwork layer is the router. Routers differ from switches found at the lower layers in that they direct traffic using logical addresses as opposed to the physical addresses used by switches. Furthermore, routers are meant to move traffic between different networks to form paths to direct traffic between multiple networks. Routers allow packets to flow from the source device's network to the destination device's network. Points to remember about routers include the following:

Figure 2-6. IP header.

Routers are also known as edge devices because of their placement at the point where multiple networks come together. Routers rely on items known as routing protocols to ensure that traffic gets to the correct location.

The aforementioned routing protocols determine the best path to send traffic at a point in time. The two best examples of routing protocols are Routing Information Protocol (RIP) and Open Shortest Path First (OSPF). Routers are optimized to perform the vital function of routing traffic between networks and ensuring that traffic reaches its intended destination. When receiving a packet, a router examines the header of the packet (see Figure 2-6) with specific emphasis on the address the packet is addressed to. Once this is located, the router can consult a routing table to determine where to send the information.

A router can be configured either statically or dynamically, depending on the requirements in a given situation. Static routing is a routing table that has been created by a network administrator who is knowledgeable about the layout of the network and enters this information manually into the routing table. Static routing is used mainly on small networks; it quickly loses its utility on larger networks because the manual updates would take increasing amounts of effort to keep up to date.

Dynamic routing represents the more commonly used option in networks and routing tables. Dynamic routing uses a combination of factors to update it automatically and the same factors to determine at any time where to send the information in question. Dynamic routing protocols include: RIP, Border Gateway Protocol (BGP), Interior Gateway Routing Protocol (IGRP), and OSPF. Within the protocols marked as dynamic routing are two subcategories known as distance vector and link-state routing.

The basic methodology of a distance vector protocol is to make a decision on what is the best route by determining the shortest path. The shortest path is commonly calculated by what are known as hops. RIP is an example of a distance vector routing protocol. RIP has several issues from a security standpoint:

Link state calculates the best path to a target network by one or more metrics such as delay, speed, or bandwidth. Once this path has been determined, the router will inform other routers what it has discovered. Link state routing is considered more flexible and robust than distance vector routing protocols. OSPF is the most common link state routing protocol and is used as a replacement for RIP in most large-scale deployments.

OSPF was developed in the mid-1980s to overcome the problems associated with RIP. Although RIP works well when networks are small in size, it rapidly loses its advantages when the network scales up in size. OSPF has several built-in advantages over RIP that include the following:

The most important protocol in the TCP/IP suite is IP because of its central role in addresses and routing. It is a routable protocol that has the role of making a best effort at delivering information. IP organizes data into a packet, prepares it for delivery, and places a source and destination address on the packet. Additionally, IP is responsible for adding information known as the Time to Live (TTL) to a packet. The goal of a TTL is to keep packets from traversing the network forever. If the recipient cannot be found, rather than traveling the network forever, the packet can eventually be discarded.

Taking a closer look at the important IP address, there are some details that start to emerge that reveal how routing and other functions take place. One part of the IP address refers to the network, and the other refers to the host. In layman's terms, the network is equivalent to the street in a postal address, and the host is the house number on a given street. Combined, they allow you to communicate with any network and any host in the world that is connected to the Internet.

IP addresses are laid out in a dotted decimal notation format that divides the address up into four groups of numbers representing 8 bits apiece. IPv4 lays out addresses into a four-decimal number format that is separated by decimal points. Each of these decimal numbers is 1 byte long to allow numbers to range from 0-255. You can tell the class of an IP address by looking at the first octet. An example of IPv4 addressing is shown here:

Each of the classes is designed to divide up the number of networks and hosts with larger or smaller networks being possible depending on the class. A class A network offered the fewest networks with the greatest number of hosts with Class C offering the opposite. Class D and E are used for different purposes that this chapter will not discuss.

A number of addresses have been reserved for private use. These addresses are nonroutable, which means that manufactures of routers program them not to propagate network traffic from these address ranges onto the Internet. Traffic within these address ranges routes normally. Address ranges set aside as nonroutable, private addresses, including their respective subnet mask, are:

Many home routers use a default address of 192.168.0.1 or 192.168.1.1. This means that a home network is nonroutable "right out of the box," which is a very desirable security feature.

Also located at the internetwork layer is the Internet Control Message Protocol (ICMP), which was designed for network diagnostics and to report logical errors. TCP/IP environments must support ICMP because it is an essential service for network management. ICMP provides error reporting and diagnostics, and ICMP messages follow a basic format. The first byte of an ICMP header indicates the type of ICMP message. The byte following contains the code for each particular type of ICMP. Eight of the most common ICMP types are shown here:

The most common tool used by network administrators associated with ICMP is a ping, which is useful in determining whether a host is up. It is also useful for attackers because they can use it to enumerate a system (it can help the hacker determine whether a computer is online).

One threat that will be discussed more in depth later in this text is known as a sniffer (also commonly referred to as a protocol analyzer). Sniffers are hardware- or software-based devices that are used to view and/or record traffic that flows over the network.

Sniffers are useful and problematic at the same time because network traffic that might include sensitive data can be viewed through the use of a sniffer. It is not uncommon for corporate IT departments to specifically deny the use of sniffers except by those specifically authorized to use them. Sniffers pose a real risk in that a less-than-ethical individual might intercept a password or other sensitive information in cleartext and use it later for some unauthorized purpose.

In order to realize the full potential of a sniffer, certain conditions have to be in place; most important is the ability for a network card to be put into promiscuous mode. In other words, the card can view all traffic moving past it rather than just the traffic destined for it. There are programs to accomplish this for Linux and Windows users. Linux users can download libpcap at http://sourceforge.net/projects/libpcap/. Windows users need to install the winpcap library, available at http://www.winpcap.org. Just remember that promiscuous mode allows a sniffer to capture any packet it can see, not just packets addressed to the device. Next, you have to install a sniffer.

The most widely used sniffer is known as Wireshark. Wireshark has gained popularity because it is free, easy to use, and it works as well as or better than most commercial sniffing tools. Wireshark, just like other sniffers, comprises three displays or windows. To get an idea of what the display looks like, look at Figure 2-7.

Figure 2-7. Wireshark.

At the top of the figure, you can see a number of packets that have been captured. In the middle of the figure, you can see the one packet that has been highlighted for review. At the bottom of the figure, you can see the contents of the individual frame. If you want to learn more about sniffers, Wireshark is a good place to start. It can be downloaded from www.wireshark.org.

Moving up the TCP/IP stack, the following controls are useful at the internetwork layer.

This primary job of the host-to-host transport layer is to facilitate end-to-end communication. This layer is often referred to as the transport layer. The following sections describe the two protocols at this layer:

TCP provides reliable data delivery services and is a connection-oriented protocol. TCP provides reliable data delivery, flow control, sequencing, and a means to handle startups and shutdowns. TCP also uses a three-step handshake to start a session. During the data-transmission process, TCP guarantees delivery of data by using sequence and acknowledgment numbers. At the completion of the data-transmission process, TCP performs a four-step shutdown that gracefully concludes the session. The startup sequence is shown in Figure 2-8.

TCP has a fixed packet structure (see Figure 2-9). Port scanners can tweak TCP flags and send them in packets that should not normally exist in an attempt to elicit a response from a targeted server.

Like TCP, UDP belongs to the host-to-host layer. Unlike TCP, UDP is a connectionless transport service. UDP does not have startup, shutdown, or any handshaking processes like those performed by TCP. Because there is no handshake with UDP, it is harder to scan and enumerate. Although this makes it less reliable, it does offer the benefit of speed. UDP is optimized for applications that require fast delivery and are not sensitive to packet loss. UDP is used by services such as Domain Name Service (DNS).

Figure 2-8. TCP startup and shutdown.

Figure 2-9. TCP frame structure.

Some of the most common host-to-host layer attacks are shown here:

Although the host-to-host layer is where you find TCP and UDP, you need to remember that these protocols are not designed for security. Their goal is reliable or fast delivery. Listed here are some host-to-host security protocols:

There are many application layer services present at this layer; however, not all are of importance to the security professional. Focus on the services that have the greatest potential for abuse and misuse and therefore represent the greatest threat. Services are assigned a port number. There are 65,535 ports; they are divided into well-known ports (0-1023), registered ports (1024-49151), and dynamic ports (49152-65535). Although there are hundreds of ports and corresponding applications in practice, fewer than 100 are in common use and of these only a handful will be encountered on a regular basis. The most common of these are shown in Table 2-2. These are some of the ports that a hacker would first look for on a victim's computer systems.

You should practice the deny-all principle and enable just those ports that are needed instead of memorizing each port and deciding whether to block it or not. Simply put, you should block everything and allow only what is needed. If a port is not being used, and deny-all is the practice, it will already be closed.

Going back to the earlier issue of TCP/IP being designed when more trust was given to networks, all applications are not created equally. Although some, such as Secure Shell (SSH), are designed to be secure alternatives to Telnet, you might encounter the less secure options in practice. The following list discusses the operation and security issues of some of the common applications:

Although numerous application layer threats exist, listing all of them is unnecessary. Some of the more common are briefly listed here to serve as an introduction to in-depth discussions in later chapters:

Figure 2-10. TCP/IP model and each layer's controls.

Following are some examples of application layer controls. An overview of the controls discussed for each layer of the TCP/IP model can be seen in Figure 2-10.

Some application layer software controls include the following: