SlideShare a Scribd company logo
1 of 71
Download to read offline
那些我們睡過的網概
Jyny @ 資策會
其實原本
不是要講網概
原本是要講
ARP spoofing …
發現有很多網路基礎
要先知道
又加上
因為本人覺得網路
會通很好玩
只好來講講
網路的那些二三事
本人不是學術派
但是講話還是
很無聊很催眠
我盡量讓大家不要睡著
免不了
還是要講一下OSI
玩黑的
一定要懂網路
OSI
稱呼第x層 Lx
L1 ~ L7
我們今天講 L2, L3, L4, L7
OSI
OSI是什麼概念?
抽象化,(每⼀一層不必考慮其他層的⼯工作)
把網路上各種⼯工作細節分層
我們今天講 L2, L3, L4, L7
OSI
每⼀一層都把把上⼀一層的訊息當資料
每⼀一層都會加上每⼀一層需要的Header
每⼀一層做 包裝 or 切割
OSI
⼀一路從L7 包到 L1才從電腦送出去
送的過程有時候會解開到 L2 或 L3
我們就不講OSI原始定義
直接講我們正在用的
先來講講
L3 (網路層)
實務上來看
L3 (網路層)
我們熟悉的 IP 網路
常講的網路分佈
是抽象的,不是實體的
常⾒見狀態下可以連線到的機器
有IP address 的
實際上
L3 (網路層)
IP包含⼀一個很重要的概念 "路由"
簡單來說就是 "怎麼⾛走"
拓墣的概念
網路是怎麼分布
有點像街道地址的系統
動手做
L3 (網路層)
tracert (traceroute)
tracert -d 8.8.8.8.
traceroute 8.8.8.8
接下來
講講L4 (傳輸層)
概念上來說
L4 (傳輸層)
簡單來說就是建⽴立⼀一個連線
在電腦上建⽴立連線的最基礎單位
TCP / UDP
實際上
L4 (傳輸層)
程式會跟作業系統溝通 (socket)
程式:我要建⽴立⼀一個連線
OS:好給你連線,分配port xxxx給你
動手做
L4 (傳輸層)
netcat 這⽀支程式可以建⽴立連線
telnet也有同樣功能
下載 netcat for windows
開server聽:nc -l -p [port]
client連線:nc [ip] [port]
接下來
講講L7 (應用層)
L7 (應⽤用層)
基於 TCP / UDP 連線
根據不同Protocol
定義不同的控制訊號
定義不同的Header
動手做
L7 (應⽤用層)
HTTP
GET POST ……
nc jyny.in 80
GET / HTTP/1.0
L7 (應⽤用層)
根據不同Protocol
定義不同的字串不同意義
Protocol有很多 HTTP SMTP FTP POP3 …
差不多可以這樣理解
各層的Protocol
L7 L4 L3 L2
要不要休息一下QAQ
我知道大家一定
只想聽攻擊手法QAQ
再等一下,就快講到了
L2 (資料連結層)
L2 (資料連結層)
負責相鄰的兩的網路設備間的通訊
沒有到L3 就沒有IP,所以不存在IP概念
L2 設備,switch、hub
MAC Address
等等
為什麼
我們有了IP還要MAC?
或者
我們有了MAC 還要IP?
實際上他們在做的
是不同的事情
MAC & IP
MAC 負責 "相鄰" 的電腦之間傳送
IP 負責 "找路",在廣⼤大的 Network 上
我們怎麼判定
電腦是不是相鄰的?
LAN & WAN
最簡單理解⽅方式就是 local ip or virtual ip
同網段,共⽤用router,共⽤用gateway
透過⼦子網路遮罩來判斷
LAN & WAN
通常設定網路會設定三的東⻄西
IP,Gateway,Subnetmask
同網段,同LAN,同區網,就會直接送
不同網段,問Gateway
LAN
三段 local IP,private IP,virtual IP
A class 10.0.0.0~10.255.255.255
B class 172.16.0.0~172.31.255.255
C class 192.168.0.0~192.168.255.255
有歷史故事的,從前沒有⼦子網路遮罩
NAT
⼦子網路遮罩
IP組成有分,網路位置&主機位置
同網路位⼦子,同網段,同LAN
IP:192.168.1.1
255.255.255.0
FF.FF.FF.00
11111111.11111111.11111111.00000000
接下來就今天主角
ARP
ARP在幹麻
ARP
Address Resolution Protocol
簡單來說可以對應MAC 跟 IP ⽤用的
知道 IP ,但不知道這個 IP 是誰的
怎麼問就是漏洞所在
終於講到漏洞了
ARP Spoofing
ARP Spoofing
顧名思義,騙別⼈人ARP
⼀一直騙⼀一直騙
Gateway
可以造成MITM
Thanks

More Related Content

Featured

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfmarketingartwork
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsKurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summarySpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentLily Ray
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best PracticesVit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project managementMindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at WorkGetSmarter
 

Featured (20)

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 

Network