Networking Chapter 2 Tip Students Become Familiar With All These Ports User Datagram Protocol Udp

Hands-On Ethical Hacking and Network Defense, Third Edition 2-1

Chapter 02

TCP/IP Concepts Review

At a Glance

Instructor’s Manual Table of Contents

• Overview

• Objectives

• Teaching Tips

Hands-On Ethical Hacking and Network Defense, Third Edition 2-2

Lecture Notes

Overview

This chapter describes major concepts and aspects of the TCP/IP protocol, including each of

the four layers of the protocol stack: Application, Transport, Internet, and Network. Students

Chapter Objectives

After reading this chapter and completing the exercises, the student will be able to:

• Explain the TCP/IP protocol stack

• Explain the basic concepts of IP addressing

• Explain the binary, octal, and hexadecimal numbering systems

Teaching Tips

Overview of TCP/IP

2. Introduce the Transmission Control Protocol/Internet Protocol (TCP/IP) as the most

widely used computer communication protocol.

3. Give a brief explanation about the TCP/IP stack and its four layers. Do not give too

much detail since you will explain each layer (except the Network layer) later. Use

Figure 2-1 to illustrate the four layers of the TCP/IP protocol stack:

a. Application

Teaching

Tip

Compare the TCP/IP stack with the OSI Model stack, which is composed of

seven layers: Physical, Data Link, Network, Session, Transport, Presentation,

and Application. For more information about the OSI Model, check out

http://www.webopedia.com/quick_ref/OSI_Layers.asp.

Hands-On Ethical Hacking and Network Defense, Third Edition 2-3

The Application Layer

2. Use Table 2-1 to illustrate the different programs that run at the Application layer.

The Transport Layer

2. Explain that TCP is a connection-oriented protocol, which means the sender does not

3. Illustrate the TCP three-way handshake process:

a. Host A sends a TCP packet with the SYN flag set (that is, a SYN packet) to

TCP Segment Headers

1. As a security professional, it is important for you to clearly understand the critical

components of a TCP header. Hackers usually try to exploit these components to

discover vulnerabilities and perform attacks. Critical components include:

TCP Flags

1. Explain that flags occupy one bit of the segment and can be set to either 0 (off) or 1

(on).

2. Explain the six flags used by the TCP segment header:

a. SYN: synch flag

b. ACK: acknowledgment flag

Hands-On Ethical Hacking and Network Defense, Third Edition 2-4

Initial Sequence Number (ISN)

2. Describe how two hosts exchange their ISNs during Steps one and two of the TCP

three-way handshake.

Teaching

Tip

Kevin Mitnick, the legendary hacker, is now a security consultant to corporations

worldwide and a cofounder of Defensive Thinking. Find out more about him at

https://www.mitnicksecurity.com/.

TCP Ports

1. A TCP packet has two 16-bit fields containing the source and destination port numbers.

3. Ports also help network administrators to stop or disable services that are not needed.

4. Port numbers can go up to 65,535 but only the first 1023 ports are considered well-

5. Conclude this section by describing some of the most important or frequently used ports

and the services they represent. These ports include:

a. Ports 20 and 21 for FTP

b. Port 25 for SMTP

Hands-On Ethical Hacking and Network Defense, Third Edition 2-5

Teaching

Tip

Read about these services and play around with them before explaining them to

your students. Although this is not a network course, it is important for your

students to become familiar with all these ports.

User Datagram Protocol (UDP)

1. Describe UDP as a fast but unreliable protocol that also operates on the Transport layer

2. Although unreliable, UDP is widely used on the Internet because of its speed. Higher

The Internet Layer

1. Explain to your class that the Internet layer is responsible for routing packets to their

2. Introduce the Internet Control Message Protocol (ICMP) and the major commands that

help network administrators troubleshoot network connectivity problems. These

3. Use Table 2-2 to illustrate the ICMP type codes that can be used by network

administrators and security professionals to block ICMP packets from entering or

leaving the network. Several attacks can be avoided by blocking ICMP traffic.

Security

Tip

Read about the Ping of Death attack at:

http://www.webopedia.com/TERM/P/ping_of_death.html.

Hands-On Ethical Hacking and Network Defense, Third Edition 2-6

Quick Quiz 1

1. For computers to communicate with one another over the Internet or across an office,

they must speak the same language. This language is referred to as which of the

following?

A. port

B. protocol

C. segment

D. header

2. What are the four layers of the TCP/IP stack?

3. Which of the following Application-layer protocols enables users to securely log on to a

remote server and issue commands interactively?

A. IRC

B. SNMP

C. FTP

D. SSH

4. True or False: User Datagram Protocol (UDP) is a connection-oriented protocol.

5. Which term best describes the logical, not physical, component of a TCP connection?

A. port

B. protocol

C. segment

D. header

IP Addressing

1. Explain how addressing works using IP addresses. IP addresses are divided into two

components: the network address and the host address. Depending on how many bytes

are used for each component, IP addresses can be divided into classes:

2. Use Table 2-3 to illustrate the differences between these three classes.

Hands-On Ethical Hacking and Network Defense, Third Edition 2-7

3. Describe the main characteristics of a Class A address:

a. First byte is reserved for the network address.

4. Describe the main characteristics of a Class B address:

a. Addresses are divided evenly between a two-octet network address and a two-octet

5. Describe the main characteristics of a Class C address:

a. Addresses have a three-octet network address and a one-octet host address.

Teaching

Tip

There are also Class D and E IP addresses. Read more about their characteristics

at http://computer.howstuffworks.com/question549.htm.

6. Introduce students to the concept of subnetting, which is where a network administrator

can divide a larger network into smaller network segments.

7. Demonstrate the process of using a subnet mask to determine the network address

CIDR Notation

1. Introduce students to Classless Inter-Domain Routing (CIDR). Point out that CIDR was

2. Use Table 2-4 to discuss the list of important CIDR prefixes.

Planning IP Address Assignments

1. Explain the process of assigning a network address to each network segment. Your

2. Next, explain the process of sending a packet to a different network using a gateway.

When a packet is sent by a computer, TCP/IP uses the sender’s subnet mask to

IPv6 Addressing

2. Explain that IPv6 was developed to increase the IP address space and provide additional

security.

Overview of Numbering Systems

1. This section provides a review of the binary, octal, and hexadecimal numbering

systems.

Reviewing the Binary Numbering System

1. Explain the structure of the decimal numbering system. This system uses 10 as its base.

Each number can be represented as the sum of each digit multiplied by a power of 10.

2. Now, introduce the binary numbering system. The binary numbering system uses the

4. Give some examples on how to convert binary numbers to decimal numbers.

5. Define a nibble as a half-byte or a group of four bits. Explain that nibbles help with

6. Finally, explain the process for converting nibbles to decimal values. This process can

Reviewing the Octal Numbering System

1. Introduce the octal numbering system. This system uses the number 8 as its base, so the

2. Using the UNIX permission scheme, illustrate the use of the octal numbering system.

Recall that in UNIX, you can specify three sets of permissions over a file or directory:

Reviewing the Hexadecimal Numbering System

1. Introduce the octal numbering system. This system uses the number 16 as its base, so

Reviewing the Base-64 Numbering System

1. Explain to students that a common use for base-64 is for the encoding and

Hands-On Ethical Hacking and Network Defense, Third Edition 2-10

Quick Quiz 2

1. An IP address consists of four bytes divided into two components: a network address

and which of the following?

A. class c address

B. binary address

C. host address

D. subnet address

2. Which of the four bytes of a Class C address is reserved for the host address?

A. First

B. Second

C. Third

D. Fourth

3. True or False: Companies need to assign a unique network address to each network

segment that is separated by a router.

4. What is the decimal value of 1100111011001 (base 2)?

A. 6617

B. 6518

C. 6715

D. 6615

5. A network administrator needs to subnet his network. He wants to create a subnetwork

with only 30 hosts. Which CIDR prefix should he use for that subnetwork?

A. /23

B. /27

C. /25

D. /26

Class Discussion Topics

2. What do you think of a computer that uses some other numbering system instead of the

binary numbering system? Is it possible?

Hands-On Ethical Hacking and Network Defense, Third Edition 2-11

Additional Projects

1. Ask the students to explore the contents of a real packet/frame sent through a network.

2. When is it best to use a Class A, B, or C IP address? Ask your students to write specific

examples for each case.

Additional Resources

1. IP addressing links:

2. IP addressing and subnetting for new users:

3. SMTP links:

4. DNS stuff:

5. DNS links:

6. How Domain Name Servers Work:

http://computer.howstuffworks.com/dns.htm

8. HTTP links:

Key Terms

See Glossary for definition of key terms.

➢ ACK

➢ TCP flag

➢ three-way handshake

Hands-On Ethical Hacking and Network Defense, Third Edition 2-13

➢ Transmission Control Protocol/Internet Protocol (TCP/IP)

➢ User Datagram Protocol (UDP)

➢ SYN-ACK

➢ TCP flag

➢ three-way handshake

➢ Transmission Control Protocol/Internet Protocol (TCP/IP)

➢ User Datagram Protocol (UDP)

Technical Notes for Activities

Activity 2-1: This activity requires a Web browser and an Internet connection.

Activity 2-2: This activity requires a Telnet client and an Internet connection.

Activity 2-3: This activity requires a Telnet client and an Internet connection.