The Five-Layer TCP/IP Model: Description/Attacks/Defense

From Computing and Software Wiki

The five-layer TCP/IP model: description/attacks/defense

Application layer description: The application layer is used by most programs for network communication. Data is passed from the program in an application-specific format, then encapsulated into a transport layer protocol.

Since the IP stack has no layers between the application and transport layers, the application layer must include any protocols that act like the OSI's presentation and session layer protocols. This is usually done through libraries.

Data sent over the network is passed into the application layer where it is encapsulated into the application layer protocol. From there, the data is passed down into the lower layer protocol of the transport layer.

The two most common end-to-end protocols are TCP and UDP. Common servers have specific ports assigned to them (HTTP has port 80; Telnet has port 23; etc.) while clients use ephemeral ports. Some protocols, such as File Transfer Protocol and Telnet may set up a session using a well-known port, but then redirect the actual user session to ephemeral ports.

Routers and switches do not utilize this layer but bandwidth throttling applications do, as with the Resource Reservation Protocol (RSVP).

the final interface of a software, ex: the login page of a website, that checks user names against IPs and lets the user in the system

attack: sql injection. write a sql script that gives back the whole table of all IDs and Passwords

defense:

2. forget about ip address at the application layer presentation layer is nothing, since it is presentation but for application

attack: sql injections (sql injection is the MOST used attack) that checks user names against IPs

defense: defense to sql injection is snort signatures that recognize them

Transport layer: description: The transport layer's responsibilities include end-to-end message transfer capabilities independent of the underlying network, along with error control, fragmentation and flow control. End to end message transmission or connecting applications at the transport layer can be categorized as either:

  1. connection-oriented e.g. TCP
  2. connectionless e.g UDP

The transport layer can be thought of literally as a transport mechanism e.g. a vehicle whose responsibility is to make sure that its contents (passengers/goods) reach its destination safely and soundly, unless a higher or lower layer is responsible for safe delivery.

The transport layer provides this service of connecting applications together through the use of ports. Since IP provides only a best effort delivery, the transport layer is the first layer of the TCP/IP stack to offer reliability. Note that IP can run over a reliable data link protocol such as the High-Level Data Link Control (HDLC). Protocols above transport, such as RPC, also can provide reliability.

attack: pirate gets all the ports that a server uses

defense: make a table of how frequently each specific IP asks for ports and

Network layer description: Network layer solves the problem of getting packets across a single network. Examples of such protocols are X.25, and the ARPANET's Host/IMP Protocol.

With the advent of the concept of internetworking, additional functionality was added to this layer, namely getting data from the source network to the destination network. This generally involves routing the packet across a network of networks, known as an internetwork or (lower-case) internet.[7]

In the Internet protocol suite, IP performs the basic task of getting packets of data from source to destination. IP can carry data for a number of different upper layer protocols; these protocols are each identified by a unique protocol number: ICMP and IGMP are protocols 1 and 2, respectively.

Some of the protocols carried by IP, such as ICMP (used to transmit diagnostic information about IP transmission) and IGMP (used to manage IP Multicast data) are layered on top of IP but perform internetwork layer functions, illustrating an incompatibility between the Internet and the IP stack and OSI model. All routing protocols, such as OSPF, and RIP are also part of the network layer. What makes them part of the network layer is that their payload is totally concerned with management of the network layer. The particular encapsulation of that payload is irrelevant for layering purposes.

attack: spoofing IPs:

1. fire wall

2. internal

denial of service:

1. IP routing defined

2.not defined: declare fake IPs, send Zillions, ttl

defense:

Data link layer description: The Physical layer is responsible for encoding and transmission of data over network communications media. It operates with data in the form of bits that are sent from the Physical layer of the sending (source) device and received at the Physical layer of the destination device.

Ethernet, Token Ring, SCSI, hubs, repeaters, cables and connectors are standard network devices that function at the Physical layer. The Physical layer is also considered the domain of many hardware-related network design issues, such as LAN and WAN topology and wireless technology.

attack: it is the easiest, & can only be done on local network

1. APR poisoning

2.Switch's routing table looks like this:

      mcaddress              ip
   ..blah...blah..        ..192.168....
   ....blah blah..        ....192.168.1..
  

the pirate will fill the routing table with mc IDs saying you are all of them. (is is called spoofing)

defense:

1. read only routing table: preferred method

2.

- Physical: mcaddress

attack: some one can physically take away your network card or unplug your internet cable.

defense: Don't let people touch your computer :) it gets more complicated with wireless technologies