Добавил:

Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.

Вуз:

Балтийский федеральный университет им. И.Канта

Предмет:

[НЕСОРТИРОВАННОЕ]

Файл:

Internet.Security

.pdf

Скачиваний:

Добавлен:

10.02.2015

Размер:

3.75 Mб

Скачать

☆

<<< < Предыдущая 1 2 3 4 5 67 / 437 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 > Следующая >>>

40 INTERNET SECURITY

a TCP segment or UDP user datagram ﬁrst and then encapsulated along with its base header, extension headers and security parameter index (SPI) as shown in Figure 2.9(a). The tunnel-mode method encrypts the entire IP datagram together with its base header and extension headers and then encapsulates it in a new IP packet as shown in Figure 2.9(b).

The authentication extension validates the sender of the message and protects the data from hackers. The authentication extension ﬁeld has a dual purpose: sender identiﬁcation and data integrity. The sender veriﬁcation is needed because the receiver can be sure that a message is from the genuine sender and not from an imposter. The data integrity is needed to check that the data is not altered in transition by some hackers. The format of authentication extension header consists of the security parameter index ﬁeld and the authentication data ﬁeld. The former deﬁnes the algorithm used for authentication, and the latter contains the actual data generated by the algorithm.

The destination extension passes information from the source to the destination exclusively. This header contains optional information to be examined by the destination mode.

It is worth comparing the options in IPv4 with the extension headers in IPv6.
		Y
1.	The record route option in IPv4 is not usedLin IPv6.
2.	The timestamp option in IPv4 is not implemented in IPv6.
3.	F
	The source router option in IPv4 is called the source route extension header in IPv6.
4.	The fragmentation ﬁelds in the base header section of IPv4 have moved to the frag-
	M
	mentation extension header in IPv6.
5.	The encrypted security payload extension header is new in IPv6.
	A
•	E
	Hop limit : This eight-bit hop limit ﬁeld decrements by 1 each node that forwards

the packet. The packetTis discarded if the hop limit is decremented to zero. This ﬁeld serves the same purpose as the TTL ﬁeld in IPv4. IPv6 interprets the value as giving a strict bound on the maximum number of hops a datagram can make before being discarded.

•Source address: The source address ﬁeld is a 128-bit originator address that identiﬁes the initial sender of the packet.

•Destination address: The destination address ﬁeld speciﬁes a 128-bit recipient address that usually identiﬁes the ﬁnal destination of the datagram. However, if source routing is used, this ﬁeld contains the address of the next router.

To summarise, each IPv6 datagram begins with a 40-octet base header that includes ﬁelds for the source and destination addresses, the maximum hop limit, the trafﬁc class (priority), the ﬂow label and the type of the next header. Thus, an IPv6 datagram should contain at least 40 octets in addition to the data.

2.1.5.3Comparison between IPv4 and IPv6 Headers

Despite many conceptual similarities, IPv6 changes most of the protocol scopes. Most important, IPv6 completely revises the datagram format by replacing IPv4’s variablelength options ﬁeld with a series of ﬁxed-format headers. A comparison between IPv4 and IPv6 headers will be examined in the following section.

Team-Fly®

TCP/IP SUITE AND INTERNET STACK PROTOCOLS

•The header length ﬁeld is eliminated in IPv6 because the length of the header is ﬁxed in IPv6.

•The service type ﬁeld is eliminated in IPv6. The priority and ﬂow label ﬁelds together take over the function of the service type ﬁeld in IPv4.

•The total length ﬁeld is eliminated in IPv6 and replaced by the payload length ﬁeld.

•The identiﬁcation, ﬂag and offset ﬁelds in IPv4 are eliminated from the base header in IPv6. They are included in the fragmentation extension header.

•The TTL ﬁeld in IPv4 is called the hop limit in IPv6.

•The protocol ﬁeld is replaced by the next header ﬁeld.

•The header checksum ﬁeld in IPv4 is eliminated because the checksum is provided by upper level protocols. It is thereby not needed at this level.

•The option ﬁelds in IPv4 are implemented as extension headers in IPv6.

The length of the base header is ﬁxed at 40 bytes. However, to give more functionality to the IP datagram, the base header can be followed by up to six extension headers.

2.1.6 Internet Control Message Protocol (ICMP)

The ICMP is an extension to the Internet Protocol which is used to communicate between a gateway and a source host, to manage errors and generate control messages.

The Internet Protocol (IP) is not designed to be absolutely reliable. The purpose of control messages (ICMP) is to provide feedback about problems in the communication environment, not to make IP reliable.

There are still no guarantees that a datagram will be delivered or a control message will be returned. Some datagrams may still be undelivered without any report of their loss. The higher-level protocols that use TCP/IP must implement their own reliability procedures if reliable communication is required.

IP is an unreliable protocol that has no mechanisms for error checking or error control. ICMP was designed to compensate for this IP deﬁciency. However, ICMP does not correct errors, simply reports them. ICMP uses the source IP address to send the error message to the source of the datagram. ICMP messages consist of error-reporting messages and query messages. The error-reporting messages report problems that a router or a destination host may encounter when it processes an IP packet. In addition to error reporting, ICMP can diagnose some network problems through the query messages. The query messages (in pairs) give a host or a network manager speciﬁc information from a router or another host.

2.1.7 Internet Group Management Protocol (IGMP)

The Internet Group Management Protocol (IGMP) is used to facilitate the simultaneous transmission of a message to a group of recipients. IGMP helps multicast routers to maintain a list of multicast addresses of groups. ‘Multicasting’ means sending of the same message to more than one receiver simultaneously. When the router receives a message with a destination address that matches one on the list, it forwards the message, converting the IP multicast address to a physical multicast address. To participate in IP on a local network, the host must inform local multicast routers. The local routers contact other multicast routers, passing on the membership information and establishing route.

42	INTERNET SECURITY

IGMP has only two types of messages: report and query. The report message is sent from the host to the router. The query message is sent from the router to the host. A router sends in an IGMP query to determine if a host wishes to continue membership in a group. The query message is multicast using the multicast address 244.0.0.1. The report message is multicast using a destination address equal to the multicast address being reported. IP addresses that start with 1110(2) are multicast addresses. Multicast addresses are class D addresses.

The IGMP message is encapsulated in an IP datagram with the protocol value of two. When the message is encapsulated in the IP datagram, the value of TTL must be one. This is required because the domain of IGMP is the LAN.

The multicast backbone (MBONE) is a set of routers on the Internet that supports multicasting. MBONE is based on the multicasting capability of IP. Today MBONE uses the services of UDP at the transport layer.

2.2 Transport Layer Protocols

Two protocols exist for the transport layer: TCP and UDP. Both TCP and UDP lie between the application layer and the network layer. As a network layer protocol, IP is responsible for host-to-host communication at the computer level, whereas TCP or UDP is responsible for process-to-process communication at the transport layer.

2.2.1 Transmission Control Protocol (TCP)

This section describes the services provided by TCP for the application layer. TCP provides a connection-oriented byte stream service, which means two end points (normally a client and a server) communicating with each other on a TCP connection. TCP is responsible for ﬂow/error controls and delivering the error-free datagram to the receiving application program.

TCP needs two identiﬁers, IP address and port number, for a client/server to make a connection offering a full-duplex service. To use the services of TCP, the client socket address and server socket address are needed for the client/server application programs.

The sending TCP accepts a datagram from the sending application program, creates segments (or packets) extracted from the datagram, and sends them across the network. The receiving TCP receives packets, extracts data from them, orders them if they arrived out of order, and delivers them as a byte stream (datagram) to the receiving application program.

TCP header

TCP data is encapsulated in an IP datagram as shown in Figure 2.10. The TCP packet (or segment) consists of a 20 – 60-byte header, followed by data from the application program. The header is 20 bytes if there is no option and up to 60 bytes if it contains some options. Figure 2.11 illustrates the TCP packet format, whose header is explained in the following.

•Source and destination port numbers (16 bits each): Each TCP segment contains a 16-bit ﬁeld each that deﬁnes the source and destination port number to identify the

TCP/IP SUITE AND INTERNET STACK PROTOCOLS

IP datagram

TCP segment

TCP

header

data

20 bytes

Figure 2.10 Encapsulation of TCP data in an IP datagram.

Bits

Source port number (16 bits)

Destination port number (16 bits)

Sequence number (32 bits)

Acknowledgement number (32 bits)

Header

Reserved

Code bits

Window size (16 bits)

length

(6 bits)

(4 bits)

Checksum (16 bits)

Urgent pointer(16 bits)

TCP option (24 bits)

Padding (8 bits)

Data

Figure 2.11 TCP packet format.

sending and receiving application. These two port numbers, along with the source and destination IP addresses in the IP header, uniquely identify each connection. The combination of an IP address and a port number is sometimes called a socket. The socket pair, consisting of the client IP address and port number and the server IP address and port number, speciﬁes two end points that uniquely identify each TCP connection in the Internet.

•Sequence number (32 bits): This 32-bit sequence ﬁeld deﬁnes the sequence number assigned to the ﬁrst byte of data stream contained in this segment. To ensure connectivity, each byte to be transmitted is numbered. This sequence number identiﬁes the byte in the data stream from the sending TCP to the receiving TCP. Considering the stream of bytes following in one direction between two applications, TCP will number each byte with a sequence number. During connection establishment, each party uses a random number generator to create an initial sequence number (ISN) that is usually

44	INTERNET SECURITY

different in each direction. The 32-bit sequence number is an unsigned number that wraps back around to 0 after reaching 232 − 1.

•Acknowledgement number (32 bits): This 32-bit ﬁeld deﬁnes the byte number that the sender of the segment is expecting to receive from the receiver. Since TCP provides a full-duplex service to the application layer, data can ﬂow in each direction, independent of the other direction. The sequence number refers to the stream ﬂowing in the same direction as the segment, while the acknowledgement number refers to the stream ﬂowing in the opposite direction from the segment. Therefore, the acknowledgement number is the sequence number plus 1 of the last successfully received byte of data. This ﬁeld is only valid if the ACK ﬂag is on.

•Header length (4 bits): This ﬁeld indicates the number of four-byte words in the TCP

header. Since the header length is between 20 to 60 bytes, an integer value of this ﬁeld can be between 5 and 15, because 5 × 4 = 20 bytes and 15 × 4 = 60 bytes.

•Reserved (6 bits): This is a six-bit ﬁeld reserved for future use.

•Code bits (6 bits): There are six ﬂag bits (or control bits) in the TCP header. One or more can be turned on at the same time. Below is a brief description of each ﬂag to determine the purpose and contents of the segment.

URG	The urgent point ﬁeld is valid.
ACK	The acknowledgement number is valid.
PSH	This segment requests a push.
RST	Reset the connection.
SYN	Synchronise sequence number to
	initiate a connection.
FIN	The sender is ﬁnished sending data.

• Window size (16 bits): This 16-bit ﬁeld deﬁnes the size of window in bytes. Since the window size of this ﬁeld is 16 bits, the maximum size of the window is 216 − 1 = 65 535 bytes. TCP’s ﬂow control is provided by each end, advertising a window size. This is the number of bytes, starting with the one speciﬁed by the acknowledgement number ﬁeld, that the receiver is willing to accept.

•Checksum (16 bits): This 16-bit ﬁeld contains the checksum. The checksum covers the TCP segment, TCP header and TCP data. This is a mandatory ﬁeld that must be calculated and stored by the sender, and then veriﬁed by the receiver.

•Urgent pointer (16 bits): This 16-bit ﬁeld is valid only if the URG ﬂag is set. The urgent point is used when the segment contains urgent data. It deﬁnes the number that must be added to the sequence number to obtain the number of the last urgent byte in the data section of the segment.

•Options (24 bits): The options ﬁeld (if any) varies in length, depending on which options have been included. The size of the TCP header varies depending on the

options selected. The TCP header can have up to 40 bytes of optional information. The options are used to convey additional information to the destination or to align

TCP/IP SUITE AND INTERNET STACK PROTOCOLS

other options. The options are classiﬁed into two categories: one-byte options contain end of option and no operation; multiple-byte operations contain maximum segment size, window scale factor and timestamp.

TCP is a connection-oriented byte stream transport layer protocol in the TCP/IP suite. TCP provides a full duplex connection between two applications, allowing them to exchange large volumes of data efﬁciently. Since TCP provides ﬂow control, it allows systems of widely varying speeds to communicate. To accomplish ﬂow control, TCP uses a sliding window protocol so that it can make efﬁcient use of the network. Error detection is handled by the checksum, acknowledgement and timeout. TCP is used by many popular applications such as HTTP (World Wide Web), TELNET, Rlogin, FTP and SMTP for e-mail.

2.2.2User Datagram Protocol (UDP)

UDP lies between the application layer and IP layer. Like TCP, UDP serves as the intermediary between the application programs and network operations. UDP uses port numbers to accomplish a process-to-process communication. The UDP provides a ﬂow-and-control mechanism at the transport level. In fact, it performs very limited error checking. UDP can only receive a data unit from the process, and deliver it to the receiver unreliably. The data unit must be small enough to ﬁt in a UDP packet. If a process wants to send a small message and does not care much about reliability, it will use UDP. UDP is a connectionless protocol. It is often used for broadcast-type protocols, such as audio or video trafﬁc. It is quicker and uses less bandwidth because a UDP connection is not continuously maintained. This protocol does not guarantee delivery of information, nor does it repeat a corrupted transfer, as does TCP.

UDP header

UDP receives the data and adds the UDP header. UDP then passes the user datagram to the IP with the socket addresses. IP adds its own header. The IP datagram is then passed to the data link layer. The data link layer receives the IP datagram, adds its own header and a trailer (possibly), and passes it to the physical layer. The physical layer encodes bits into electrical or optical signals and sends it to the remote machine. Figure 2.12 shows the encapsulation of a UDP datagram as an IP datagram. The IP datagram contains its total length in bytes, so the length of the UDP datagram is this total length minus the length of the IP header.

The UDP header is shown by the ﬁelds illustrated in Figure 2.13.

•Source port numbers (16 bits): This 16-bit port number identiﬁes the sending process running on the source host. Since the source port number is 16 bits long, it can range

from 0 to 65 656 bytes. If the source host is the client, the client program is assigned a random port number called the ephemeral port number requested by the process and chosen by the UDP software running on the source host. If the source host is the server, the port number is a universal port number.

46 INTERNET SECURITY

IP datagram

UDP datagram

UDP

UDP data

header

20 bytes

8 bytes

Figure 2.12

UDP encapsulation.

Source port number (16 bits)

Destination port number (16 bits)

Header

UDP length (16 bits)

Checksum (16 bits)

(8 bytes)

Data (if any)

Figure 2.13 UDP header.

•Destination port numbers (16 bits): This is the 16-bit port number used by the process running on the destination host. If the destination host is the server, the port number is a universal port number, while if the destination host is the client, the port number is an ephemeral port number.

•Length (16 bits): This is a 16-bit ﬁeld that contains a count of bytes in the UDP datagram, including the UDP header and the user data. This 16-bit ﬁeld can deﬁne a total length of 0 to 65 535 bytes. However, the minimum value for length is eight, which indicates an UDP datagram with only header and no data. Therefore, the length of data can be between 0 to 65 507 bytes, subtracting the total length 65 535 bytes from 20 bytes for an IP header and 8 bytes for an UDP header. The length ﬁeld in a UDP user datagram is redundant. The IP datagram contains its total length in bytes, so the length of the UDP datagram is this total length minus the length of the IP header.

•Checksum (16 bits): The UDP checksum is used to detect errors over the entire user datagram covering the UDP header and the UDP data. UDP checksum calculations include a pseudoheader, the UDP header and the data coming from the application layer. The value of the protocol ﬁeld for UDP is 17. If this value changes during transmission, the checksum calculation at the receiver will detect it and UDP drops the packet.

The checksum computation at the sender is as follows:

1. Add the pseudoheader to the UDP datagram.

TCP/IP SUITE AND INTERNET STACK PROTOCOLS

2.Fill the checksum ﬁeld with zero.

3.Divide the total bits into 16-bit words.

4.If the total number of bytes is not even, add padding of all 0s.

5.Complement the 16-bit result and insert it in the checksum ﬁeld.

6.Drop the pseudoheader and any added padding.

7.Deliver the UDP datagram to the IP software for encapsulation.

The checksum computation at the receiver is as follows:

1.Add the pseudoheader to the UDP datagram.

2.Add padding if needed.

3.Divide the total bits into 16-bit words.

4.Add all 16-bit sections using arithmetic.

5.Complement the result.

6.If the result is all 0s, drop the pseudoheader and any added padding and accept the user datagram. Otherwise, discard the user datagram.

Multiplexing and demultiplexing

In a host running a TCP/IP suite, there is only one UDP but there may be several processes that may want to use the services of UDP. To handle this situation, UDP needs multiplexing and demultiplexing.

•Multiplexing: At the sender side, it may have several processes that need user datagrams. But there is only one UDP. This is a many-to-one relationship and requires multiplexing. UDP accepts messages from different processes, differentiated by their assigned port numbers. After adding the header, UDP passes the user datagram to IP.

•Demultiplexing: At the receiver side, there is only one UDP. However, it may happen to be many processes that can receive user datagrams. This is a one-to-many relationship and requires demultiplexing. UDP receives user datagrams from IP. After error checking and dropping of header, UDP delivers each message to the appropriate process based on the port numbers.

UDP is suitable for a process that requires simple request-response communication with little concern for ﬂow and error control. It is not suitable for a process that needs to send bulk data, like FTP. However, UDP can be used for a process with internal ﬂow and error control mechanisms such as the Trivial File Transfer Protocol (TFTP) process. UDP is also used for management processes such as SNMP.

2.3 World Wide Web

The World Wide Web (WWW) is a repository of information spread all over the world and linked together. The WWW is a distributed client-server service, in which a client using a browser can access a service using a server. The Web consists of Web pages that are accessible over the Internet.

48	INTERNET SECURITY

The Web allows users to view documents that contain text and graphics. The Web grew to be the largest source of Internet trafﬁc since 1994 and continues to dominate, with a much higher growth rate than the rest of the internet. By 1995, Web trafﬁc overtook FTP to become the leader. By 2001, Web trafﬁc completely overshadowed other applications.

2.3.1Hypertext Transfer Protocol (HTTP)

The protocol used to transfer a Web page between a browser and a Web server is known as Hypertext Transfer Protocol (HTTP). HTTP operates at the application level. HTTP is a protocol used mainly to access data on the World Wide Web. HTTP functions like a combination of FTP and SMTP. It is similar to FTP because it transfers ﬁles, while HTTP is like SMTP because the data transferred between the client and the server looks like SMTP messages. However, HTTP differs from SMTP in the way that SMTP messages are stored and forwarded; HTTP messages are delivered immediately.

As a simple example, a browser sends an HTTP GET command to request a Web page from a server. A browser contacts a Web server directly to obtain a page. The browser begins with a URL, extracts the hostname section, uses DNS to map the name into an equivalent IP address, and uses the IP address to form a TCP connection to the server. Once the TCP connection is in place, the browser and Web server use HTTP to communicate. Thus, if the browser sends a request to retrieve a speciﬁc page, the server responds by sending a copy of the page.

A browser requests a Web page, and the server transfers a copy to the browser. HTTP also allows transfer from a browser to a server. HTTP allows browsers and servers to negotiate details such as the character set to be used during transfers. To improve response time, a browser caches a copy of each Web page it retrieves. HTTP allows a machine along the path between a browser and a server to act as a proxy server that caches Web pages and answers a browser’s request from its cache. Proxy servers are an important part of the Web architecture because they reduce the load on servers.

In summary, a browser and server use HTTP to communicate. HTTP is an applicationlevel protocol with explicit support for negotiation, proxy servers, caching and persistent connections.

2.3.2Hypertext Markup Language (HTML)

The browser architecture is composed of the controller and the interpreters to display a Web document on the screen. The controller can be one of the protocols such as HTTP, FTP, Gopher or TELNET. The interpreter can be HTML or Java, depending on the type of document.

The Hypertext Markup Language (HTML) is a language used to create Web pages. A markup language such as HTML is embedded in the ﬁle itself, and formatting instructions are stored with the text. Thus, any browser can read the instructions and format the text according to the workstation being used. Suppose a user creates formatted text on a Macintosh computer and stores it in a Web page, so another user who is on an IBM computer is not able to receive the Web page because the two computers are using different formatting procedures. Consider a case where different word processors use different techniques or procedures to format text. To overcome these difﬁculties, HTML

TCP/IP SUITE AND INTERNET STACK PROTOCOLS

uses only ASCII characters for both main text and formatting instructions. Therefore, every computer can receive the whole document as an ASCII document.

Web page

A Web page consists of two parts: the head and body. The head is the ﬁrst part of a Web page. The head contains the ﬁle of the page and other parameters that the browser will use. The body contains the actual content of a page. The body includes the text and tags (marks). The text is the information contained in a page, whereas the tags deﬁne the appearance of the document.