The document provides an overview of networking concepts including the OSI 7 layer model, TCP/IP models, common network protocols, and application layer protocols. It discusses networking components, physical layer vulnerabilities, and connection-oriented and connectionless protocols like TCP and UDP. The document also reviews typical network applications with client-server models and examples of internet applications mapped to application and transport layer protocols.

1. 
Networking Recap
Network Security Workshop
Dedi Dwianto, C|EH, OSCP
Daftar ISI

2. Contents
 Review of networking basics
 OSI 7 layer models
 TCP/IP – Internet models
 Common network protocols

3. Review of networking basics
Networking

4. Networking Components
 HUB
 SWITCH
 ROUTER
 HOST

5. Networking Components
 Network edge :
 Applications
 Hosts
 Network core :
 Routers
 Network of networks
 Access network, physical media :
 Communication links

6. The Network Core
 Mesh of interconnected routers

7. OSI 7 Layer Model

8. Physical Layer Vulnerabilities
 Loss of power
 Loss of environmental control
 Physical damage or destruction of data and hardware
 Unauthorized changes to the functional environment
 Disconnection of physical data links
 Undetectable interception of data

9. Data Link Layer Vulnerabilities
 MAC address spoofing
 VLAN circumvention
 Spanning tree errors

10. Network Layer Vulnerabilities
 Route spoofing - propagation of false network topology
 IP Address Spoofing- false source addressing on malicious
packets
 Identity & Resource ID Vulnerability

11. Transport Layer Vulnerabilities
 Mishandling of undefined, poorly defined, or “illegal”
conditions
 Differences in transport protocol implementation allow
“fingerprinting’ and otherenumeration of host information
 Overloading of transport-layer mechanisms such as port
numbers limit the abilityto effectively filter and qualify
traffic.
 Transmission mechanisms can be subject to spoofing and
attack based oncrafted packets.

12. Session Layer Vulnerabilities
 Weak or non-existent authentication mechanisms
 Session identification may be subject to spoofing and
hijack
 Leakage of information based on failed authentication
attempts
 Unlimited failed sessions allow brute-force attacks on
access credentials

13. Presentation Layer Vulnerabilities
 Poor handling of unexpected input can lead to application
crashes or surrender of control to execute arbitrary
instructions.
 Unintentional or ill-advised use of externally supplied
input in control contexts may allow remote manipulation
or information leakage.
 Cryptographic flaws may be exploited to circumvent
privacy protections .

14. Application Layer Vulnerabilities
 Open design issues allow free use of application resources
by unintended parties
 Backdoors and application design flaws bypass standard
security controls
 Inadequate security controls force “all-or-nothing”
approach, resulting in either excessive or insufficient
access.

15. TCP/IP – Model

16. TCP Header

17. UDP Header

18. IP Header

19. TCP/IP Tunneling

20. Connection-oriented service
 TCP – Transmission Control Protocol
 TCP Service [ RFC 793 ]
 Reliable, in-order byte stream data transfer
 Flow control
 Congestion control

21. Connection-oriented service
 TCP handshaking :
 Setup (prepare for) data transfer ahead of time

22. Connection-oriented service
 TCP – Transmission Control Protocol
 TCP Service [ RFC 793 ]
 Reliable, in-order byte stream data transfer
 Flow control
 Congestion control

23. Connectionless
 UDP – User Datagram Protocol
 UDP Service [ RFC 768 ]
 Unreliable data transfer
 No flow control
 No congestion control

24. Internet
 Internet “millions of connected computing devices :
hosts, end-system”
 Internet “ network of networks”
 Internet standard :
 RFC : Request for comments
 IETF : Internet Engineering Task Force

25. Common Network Protocol
 Protocols – control sending, receiving of messages
 Example :
 TCP
 IP
 HTTP
 FTP
 PPP

26. Application Layer Protocols
 Application : communicating, distributed processes
 Application-layer protocols :
 One “piece” of an application
 Define messages exchanged by applications and action
taken
 Use communication services provided by lower layer (TCP,
UDP)
 Types of messages exchanged

27. Application Layer Protocols
 Public domain protocols :
 Defined in RFCs
 Allows for interoperability
 Example : HTTP, SMTP
 Proprietary protocols :
 Skype
 MS Exchange
 VTP

28. Network Application
 Typical network application has two pieces : client and
server
 Client :
 Initiates contact with server
 Typically request services from server
 Web : client implemented in browser
 Email : in mail reader

29. Network Application
 Server:
 Provides requested service to client
 Example :
 Web server send requested web page

30. Internet Apps : application, transport
protocols
Application App Layer Protocol Transport Protocol
Email SMTP [RFC 2821] TCP
Remote Terminal Access Telnet [RFC 854] TCP
Web HTTP [RFC 2616] TCP
File transfer FTP [RFC 959] TCP
Streaming multimedia Proprietary TCP and UDP