This document provides an overview of networking fundamentals including common network devices like hubs, switches, and routers. It describes protocols like MAC, IP, TCP/IP, and how they enable communication. Specific topics covered include IP addressing classes, private IP ranges, subnetting, DHCP/BOOTP, wireless networking standards, packet switching vs circuit switching, DNS, and network security concepts like intrusion detection/prevention systems and VPNs. The document is intended as a basic introduction and reference for networking and cybersecurity professionals.

1. MD SAQUIB NASIR KHAN
DIGITAL EVIDENCE ANALYST
DATA64 | CIALFOR
NETWORKING FUNDAMENTAL

2. Contain
 HUB, Switch, Router
 MAC
 IP
 Packet Forwarding
 Internet Protection
 WLAN
 Packet switching And Circuit switching
 DNS
 IDS & IPS
 VPN
www.malc0de.org

3. HUB VS Switch VS Router
www.malc0de.org

4. HUB
 No real understanding about transmit data
between system
 Only Broadcast packets
 Number of system increase speed will
decrease
www.malc0de.org

5. Switch
 Switch Does not broadcast Packets its share
the packet with the system for whom packets
was sent
 Does not consume Speed like HUB for packet
Sharing
www.malc0de.org

6. Router
 Router deals with broadcasting as well as
Individual Message deliver
 Act As firewall
 APR table
www.malc0de.org

7. MAC
 Media Access Control
 Only for Network Adapter
 Depends on ARP to communicate with others
 Ipconfig/ifconfig
 arp -a
www.malc0de.org

8. IP
 Unique Address given to MAC address
124. 224. 224.100
01111100 11100000 11100000 01100100
www.malc0de.org

9. Classes OF IP
 Class Range
 A 1-126 /8
 B 127-191 /16
 C 192-223 /24
 D 224-239 Multicast
 E 240-255 Experimental
 0 & 127
General Use
www.malc0de.org

10. Classes of Private IP
 Class Range
 A /8 10.0.0.0-10.255.255.255
 B /12 172.16.0.0-172.31.255.255
 C /16 192.168.0.0-192.168.255.255
www.malc0de.org

11. IP (INTERNET PROTOCOL
)
www.malc0de.org

12. Network & Host Address
 Class N/w + Host
 A N+H+H+H
 B N+N+H+H
 C N+N+N+H
www.malc0de.org

13. Class Less Inter Domain
Routing
 128,64,32,16,8,4,2,1
--------.--------.--------.--------
CIDR/28
28 ON 4 OFF
SUBNET FOR 100 SYSTEM?
300 subnet host number?
www.malc0de.org

14. 192.168.100.97/27
 Find host address, network address, number
of host gateways and broadcast address.
www.malc0de.org

15. 192.168.100.97/27
 X.X.X.11100000
 1110000> INCREMENT
NUMBER(32{128,64,32})
 X.X.X.32
 X.X.X.64
 X.X.X.96
 SUBNET :96
 Host: 00000 :31(16+8+4+2+1)
Broadcast : 96+31=127
Range: 97-126
www.malc0de.org

16. Type of IP Address
 Static address
 Dynamic address
 Public
 Private
www.malc0de.org

17. DHCP VS BOOTP
 Class A - large organizations , governments
 Class B - medium sized organizations
 Class C - small organizations
www.malc0de.org

18. Networking Mode
 Network Address Translation or NAT
 Bridge Mode
www.malc0de.org

19. APPLICATION
• HTTP, SMTP
• FTP, DNS, TELNET
TRANSPORT
• TCP
• UDP
NETWORK
• IP, ARP
• ICMP, IGMP
HOST-TO-
NETWORK
• ETHERNET
• TOKEN RING
TCP/IP
www.malc0de.org

20. Packet forwarding
 It is a process that is by default enable in
router. The router will perform packet
forwarding only if route is available in the
routing table.
www.malc0de.org

21. Metric of Dynamic Routing
 Hop Count
 Band Width
 Load
 Reliability
 Delay
 MTU
www.malc0de.org

22. Internet Protection
 Internet Key Exchange (IKE or IKEv2)
 Internet Protocol Security (IPsec)
 Kerberos
 Point-to-Point Protocol (PPP)
 Transport Layer Security (TLS)
 Secure Sockets Layer (SSL),
www.malc0de.org

23. WLAN
 A wireless LAN or WLAN is a wireless local
area network that uses radio waves as its
carrier.
 The last link with the users is wireless, to give
a network connection to all users in a building
or campus.
 The backbone network usually uses cables
www.malc0de.org

24. 1. WEP (Wired Equivalency Privacy/ Wireless Encryption Protocol)
2. WPA (Wi-Fi Protected Access)
3. WPA 2 (Wi-Fi Protected Access 2)
WIRELESS NETWORKING
www.malc0de.org

25. WEP ( RC4 40bits to 128bits)
 Wired Equivalent Privacy (WEP) – A protocol to protect
link-level data during wireless transmission between
clients and access points.
 Services:
 Authentication: provides access control to the network by
denying access to client stations that fail to authenticate
properly.
 Confidentiality: intends to prevent information compromise
from casual eavesdropping
 Integrity: prevents messages from being modified while in
transit between the wireless client and the access point
www.malc0de.org

26. Authentication
CRC (Cyclic Redundant Check) www.malc0de.org

27. WPA
 48 bit IV
 128 Bit key
 TKIP (Temporal Key Integrity Protocol )
 A Message Integrity Code (MIC) called Michael
www.malc0de.org

28. WAP 2
 Uses the Advanced Encryption Standard
(AES)
 Symmetric-key block cipher using 128-bit keys.
 Generates CCM Protocol (CCMP):
 CCMP = CTR + CBC + MAC
 CTR = Counter Mode Encryption
 CBC/MAC = Cipher Block Chaining/Message
Authentication Code
www.malc0de.org

29. Protocol Release
date Op. Frequency
Data rate
(Max)
Range
(indoor)
Range
(outdoor)
Legacy 1997 2.5~2.5 GHz 2 Mbit/s
802.11a 1999
5.15~5.35/5.47~5.72
5/5.725~5.875 GHz
54 Mbit/s ~25 m ~75 m
802.11b 1999 2.4~2.5GHz 11 Mbit/s ~35 m ~100 m
802.11g 2003 2.4~2.5GHz 54 Mbit/s ~25 m ~75 m
802.11n 2007 2.4GHz or 5GHz 540 Mbit/s ~50 m ~125 m
802.11
802.11 802.11a 802.11b 802.11g 802.11n
802.11 Wireless LAN Working
Group
www.malc0de.org

30. Packet Switching Vs Circuit
Switching
www.malc0de.org

31. DOMAIN NAME SYSTEM
 DNS is directory Service.
 Provides Name to IP address
 Maps IP to Domain name and reverse
 DNS runs on port 53
 Runs on UDP
 A –Address record name to 32 bit address
 AAAA – Address Record name to 128 bit IPV6
address

www.malc0de.org

32. DNS Caching
www.malc0de.org

33. www.malc0de.org
DNS Cache Poisoning Attack
 Exploit DNS poisoning attack
 Change IP addresses to redirect URLs to fraudulent sites
 Potentially more dangerous than phishing attacks
 No email solicitation is required
 DNS poisoning attacks have occurred:
 January 2005, the domain name for a large New York ISP, Panix,
was hijacked to a site in Australia.
 In November 2004, Google and Amazon users were sent to Med
Network Inc., an online pharmacy
 In March 2003, a group dubbed the "Freedom Cyber Force Militia"
hijacked visitors to the Al-Jazeera Web site and presented them
with the message "God Bless Our Troops"

34. DNS Spoofing Tools
 Dsniff
 dnsspoof
 Example
 abc.com IP address is 10.0.0.1
 Make it spoof to respond 100.0.1.1
 In the text file dnssniff.txt write
 100.0.1.1 abc.com
 [gateway]# dnsspoof -i eth0 -f /etc/dnssniff.txt
 [bash]# host abc.com
 abc.com has address of 100.0.1.1
www.malc0de.org

35. INTRUSION DETECTION
SYSTEM
 Intrusion Detection Systems look for attack
signatures, which are specific patterns that
usually indicate malicious or suspicious intent.
www.malc0de.org

36. Intrusion Detection Systems
(IDS)
 Different ways of classifying an IDS
IDS based on
 anomaly detection
 signature based misuse
 host based
 network based
www.malc0de.org

37. Anomaly based IDS
 This IDS models the normal usage of the
network as a noise characterization.
 Anything distinct from the noise is assumed to
be an intrusion activity.
 E.g flooding a host with lots of packet.
 The primary strength is its ability to recognize
novel attacks.
www.malc0de.org

38. Signature based IDS
 This IDS possess an attacked description that
can be matched to sensed attack
manifestations.
 The question of what information is relevant to
an IDS depends upon what it is trying to
detect.
 E.g DNS, FTP etc.
www.malc0de.org

39. Network based IDS
 This IDS looks for attack signatures in
network traffic via a promiscuous interface.
 A filter is usually applied to determine which
traffic will be discarded or passed on to an
attack recognition module. This helps to filter
out known un-malicious traffic.
www.malc0de.org

40. INTRUSION PREVENTION
SYSTEM
www.malc0de.org

41. Host Based IPS
www.malc0de.org

42. Network Based IPS
www.malc0de.org

43. VIRTUAL PRIVATE
NETWORK
 A virtual private network (VPN) is a
technology that creates an encrypted
connection over a less secure network. The
benefit of using a VPN is that it ensures the
appropriate level of security to the connected
systems when the underlying network
infrastructure alone cannot provide it.
www.malc0de.org

44. VIRTUAL PRIVATE NETWORK
www.malc0de.org

45. Any Q?
www.malc0de.org

46. Thank you
www.malc0de.org