Networking Overview CS 161: Computer Security Prof. Vern Paxson - PowerPoint PPT Presentation

Networking Overview CS 161: Computer Security Prof. Vern Paxson TAs: Jethro Beekman, Mobin Javed, Antonio Lupher, Paul Pearce & Matthias Vallentin http://inst.eecs.berkeley.edu/~cs161/ February 5, 2013

Focus For Today ʼ s Lecture • Sufficient background in networking to then explore security issues in next ~3 lectures – Networking = the Internet • Complex topic with many facets – We will omit concepts/details that aren’t very security- relevant – We’ll mainly look at IP, TCP, DNS (and later DHCP) • Networking is full of abstractions – Goal is for you to develop apt mental models / analogies – ASK questions when things are unclear o (but we may skip if not ultimately relevant for security, or postpone if question itself is directly about security) 2

Key Concept #1: Protocols • A protocol is an agreement on how to communicate • Includes syntax and semantics – How a communication is specified & structured o Format, order messages are sent and received – What a communication means o Actions taken when transmitting, receiving, or timer expires • E.g.: making a comment in lecture? 1.Raise your hand. 2.Wait to be called on. 3.Or: wait for speaker to pause and vocalize 4.If unrecognized (after timeout): vocalize w/ “excuse me” 3

Key Concept #2: Dumb Network • Original Internet design: interior nodes (“routers”) have no knowledge* of ongoing connections going through them • Not : how you picture the telephone system works – Which internally tracks all of the active voice calls • Instead: the postal system! – Each Internet message (“packet”) self-contained – Interior “routers” look at destination address to forward – If you want smarts, build it “ end-to-end ”, not “hop-by-hop” – Buys simplicity & robustness at the cost of shifting complexity into end systems * Today’s Internet is full of hacks that violate this 4

Self-Contained IP Packet Format IP = Internet Protocol 4-bit 8-bit 4-bit 16-bit Total Length (Bytes) Header Type of Service Version Length (TOS) 3-bit 16-bit Identification 13-bit Fragment Offset Header is like a is like a Header Flags letter envelope: letter envelope: 8-bit Time to contains all info contains all info 8-bit Protocol 16-bit Header Checksum Live (TTL) needed for needed for delivery delivery 32-bit Source IP Address 32-bit Destination IP Address Payload (remainder of message) . . . . .

Key Concept #2: Dumb Network • Original Internet design: interior nodes (“routers”) have no knowledge* of ongoing connections going through them • Not : how you picture the telephone system works – Which internally tracks all of the active voice calls • Instead: the postal system! – Each Internet message (“packet”) self-contained – Interior routers look at destination address to forward – If you want smarts, build it “ end-to-end ”, not “hop-by-hop” – Buys simplicity & robustness at the cost of shifting complexity into end systems * Today’s Internet is full of hacks that violate this 6

Key Concept #3: Layering • Internet design is strongly partitioned into layers – Each layer relies on services provided by next layer below … – … and provides services to layer above it • Analogy: – Consider structure of an Code You Write application you’ve written Run-Time Library and the “services” each System Calls layer relies on / provides Magnetic Domains } Device Drivers Fully isolated Voltage Levels / from user programs 7

Internet Layering (“Protocol Stack”) Note on a point of potential confusion: these diagrams are always drawn with lower layers below higher layers … 7 Application But diagrams showing the layouts of packets 4 Transport are often the opposite , with the lower layers at the top since their headers precede those 3 (Inter)Network for higher layers Link 2 1 Physical 8

Horizontal View of a Single Packet First bit transmitted Link (Inter)Network Transport Application Data: structure Layer Layer Header Layer depends on the application Header (IP) Header … 9

Vertical View of a Single Packet Link Layer Header First bit transmitted (Inter)Network Layer Header (IP) Transport Layer Header Application Data: structure depends on the application . . . . . . 10 .

Internet Layering (“Protocol Stack”) 7 Application 4 Transport 3 (Inter)Network Link 2 1 Physical 11

Layer 1: Physical Layer 7 Application 4 Transport Encoding bits to send them over a single physical link 3 (Inter)Network e.g. patterns of Link 2 voltage levels / photon intensities / 1 Physical RF modulation 12

Layer 2: Link Layer Framing and transmission of a collection of bits into individual messages sent across a 7 Application single “subnetwork” (one physical technology) 4 Transport 3 (Inter)Network Might involve multiple physical Link 2 links (e.g., modern Ethernet) 1 Physical Often technology supports broadcast transmission ( every “node” connected to subnet receives) 13

Layer 3: (Inter)Network Layer (IP) Bridges multiple “subnets” to provide end-to-end internet connectivity between nodes 7 Application • Provides global addressing 4 Transport Works across different link 3 (Inter)Network technologies } Link 2 Different for each Internet “hop” 1 Physical 14

Layer 4: Transport Layer End-to-end communication between processes 7 Application Different services provided: TCP = reliable byte stream 4 Transport UDP = unreliable datagrams 3 (Inter)Network ( Datagram = single packet message) Link 2 1 Physical 15

Layer 7: Application Layer Communication of whatever you wish 7 Application Can use whatever transport(s) is convenient 4 Transport 3 (Inter)Network Freely structured Link 2 E.g.: 1 Physical Skype, SMTP (email), HTTP (Web), Halo, BitTorrent 16

Internet Layering (“Protocol Stack”) } Implemented only at hosts, 7 Application not at interior routers 4 Transport (“dumb network”) 3 (Inter)Network Link 2 1 Physical 17

Internet Layering (“Protocol Stack”) 7 Application 4 Transport } 3 (Inter)Network Link 2 Implemented everywhere 1 Physical 18

Internet Layering (“Protocol Stack”) 7 Application 4 Transport } 3 (Inter)Network ~Same for each Internet “hop” } Link 2 Different for each Internet “hop” 1 Physical 19

Hop-By-Hop vs. End-to-End Layers Host A communicates with Host D Host C Host D Host A Router 1 Router 2 Router 3 Router 5 Host B Host E Router 7 Router 6 Router 4 20

Hop-By-Hop vs. End-to-End Layers Host A communicates with Host D Host C Host D Host A E.g., Ethernet Router 1 Router 2 Router 3 E.g., Wi-Fi Router 5 Host B Host E Router 7 Router 6 Router 4 Different Physical & Link Layers (Layers 1 & 2) 21

Hop-By-Hop vs. End-to-End Layers Host A communicates with Host D Host C Host D Host A Router 1 Router 2 Router 3 Router 5 E.g., HTTP over TCP over IP Host B Host E Router 7 Router 6 Router 4 Same Network / Transport / Application Layers (3/4/7) (Routers ignore Transport & Application layers) 22

Layer 3: (Inter)Network Layer (IP) Bridges multiple “subnets” to provide end-to-end internet connectivity between nodes 7 Application • Provides global addressing 4 Transport Works across different link 3 (Inter)Network technologies Link 2 1 Physical 23

IP Packet Structure 4-bit 8-bit 4-bit 16-bit Total Length (Bytes) Header Type of Service Version Length (TOS) 3-bit 16-bit Identification 13-bit Fragment Offset Flags 8-bit Time to 8-bit Protocol 16-bit Header Checksum Live (TTL) 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload

IP Packet Structure 4-bit 8-bit 4-bit 16-bit Total Length (Bytes) Header Type of Service Version Length (TOS) 3-bit 16-bit Identification 13-bit Fragment Offset Flags Specifies the length of the entire 8-bit Time to IP packet: bytes in this header 8-bit Protocol 16-bit Header Checksum Live (TTL) plus bytes in the Payload 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload

IP Packet Structure 4-bit 8-bit 4-bit 16-bit Total Length (Bytes) Header Type of Service Version Length (TOS) 3-bit 16-bit Identification 13-bit Fragment Offset Flags Specifies how to interpret the start of the Payload , which is 8-bit Time to 8-bit Protocol 16-bit Header Checksum the header of a Transport Live (TTL) Protocol such as TCP or UDP 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload

IP Packet Structure 4-bit 8-bit 4-bit 16-bit Total Length (Bytes) Header Type of Service Version Length (TOS) 3-bit 16-bit Identification 13-bit Fragment Offset Flags 8-bit Time to 8-bit Protocol 16-bit Header Checksum Live (TTL) 32-bit Source IP Address 32-bit Destination IP Address Options (if any) Payload

IP Packet Header (Continued) • Two IP addresses – Source IP address (32 bits) – Destination IP address (32 bits) • Destination address – Unique identifier/locator for the receiving host – Allows each node to make forwarding decisions • Source address – Unique identifier/locator for the sending host – Recipient can decide whether to accept packet – Enables recipient to send a reply back to source 28