You are on page 1of 32

IPv4 Overview

Cyber Security Spring 2006

Outline
• • • • Review Layered Network Architecture Network Layer protocols Transport Layer Protocols Application Layer Protocols

Reading Material
• Many texts on IP networking
– Computer Networks, Andrew Tannenbaum – Data and Computer Communications, William Stallings – Internetworking with TCP/IP Vol 1, Douglas Comer

• Plus all the originals from the Internet Engineering Task Force (IETF)
– http://ietf.org/

e. e.g. HTTP.g.g. IP. Ethernet frames. ATM media • Standard software engineering reasons for thinking about a layered design . e.g. SMTP. UDP 3: Network.OSI Reference Model • The layers – – – – – – – 7: Application. ATM cells 1: Physical. Ethernet media. e. TCP. e. IPX 2: Data link.g... FTP 6: Presentation 5: Session 4: Transport..

Layers Limit Need for Intelligence • Intermediate devices only need to process the packet headers up to the level they understand Ether Hdr IP Hdr TCP Hdr HTTP Hdr Data .

Various network devices • Hosts and servers – Operate at Level 7 (application) • Proxies – Operate at level 7 • Firewalls – Operate between levels 2 and 7. From the outside world make changes at levels 2 (in transparent mode) or 3 (in routing mode) • Routers – Operate at Level 3 (network) • Switches or Hubs – Operate at level 2 (data link) • Gateways – Operate at level 2 Data Http Hdr TCP Hdr IP Hdr Ether Hdr .

255.0 Broadcast address is the last address in the subnetwork.0 255.1 Network address.g.1.1..0 Host address is the first address in subnetwork. 192..168.1.168.g.g. 192. 192. e.g.255 Version IHL Type of service DF MF Protocol Source address Destination Address 0 or more words of options Total length Frag Offset Header checksum Identification Time to live .0/24 or 192. 192.. e.168. e. e.168.168.IPv4 • 32 bit Addressing scheme – – – – Host address.1.1.255.

Address spoofing • Sender can put any source address in packets he sends: – Can be used to send unwelcome return traffic to the spoofed address – Can be used to bypass filters to get unwelcome traffic to the destination • Reverse Path verification can be used by routers to broadly catch some spoofers .

Fragmentation • May need to fragment an IP packet if one data link along the way cannot handle the packet size – Perhaps path is a mix of different HW – Perhaps unexpected encapsulation makes the packet larger than the source expected – Hosts try to understand Maximum Transmission Unit (MTU) to avoid the need for fragmentation (which causes a performance hit) • Any device along the way can fragment – Identification field identifies all elements of the same fragment – Fragmentation stored in the MF (more fragments) and fragment offset fields – Devices can reassemble too – But generally the destination does the reassembly .

negative offsets or overlarge offsets cause buffer overflows – Firewalls can check for well formed packets. e.g.Fragmentation Flaws • Split packet to fool simple firewall and IDS – Intermediate content observers must do reassembly • Overlapping fragments – Can be used to trick IDS by hiding.g. • Resource attacks on re-assemblers – Send all but one fragment for many packets . Teardrop attack. a “get /etc/password” request – Different clients reassemble overlapping fragments differently – Just drop overlapping fragments • Bad fragment offsets exploit poor stack implementations – E.

– Need to find MAC for 192.1.3 which is in your interfaces subnetwork – Broadcast an ARP request on the link – Hopefully receive an ARP reply giving the correct MAC – The device stores this information in an ARP cache or ARP table .Address Resolution Protocol (ARP) • Used to discover mapping of neighboring ethernet MAC to IP addresses.168.

• Solutions – Encrypt all traffic – Monitoring programs like arpwatch to detect mapping changes • Which might be valid due to DHCP .governmentsecurity.php • Classic Man-in-the-middle attack – Send arp reply messages to device so they think your machine is someone else – Better than simple sniffing because packets will get to your regardless of sniffing.org/articles/TheIngredientstoARP Poison.ARP cache poisoning • Bootstrap problem with respect to security. Anyone can send an ARP reply – The Ingredients to ARP Poison. http://www.

so you use the next hop’s data-link address.Basic IPv4 Routing • – – – Static routing. interface May have routing table per incoming interface To route a packet. Used by hosts and some firewalls and routers.g. In case of a tie look at the metric • • Use the corresponding next hop address and interface to send the packet on. TTL fields got set bigger. The next hop address is on the same link as this device. e. Drop packet when it reaches 0 • • Attempt to avoid routing loops As internet got bigger. Next hop address. Routing table consists of entries of • Network. metric. 225 maximum . ethernet MAC address – Decrement “time to live” field in IP header at each hop. take the destination address and find the best match network in the table.

0. 192. outside 192.0.1.0. dmz 192.168. 192.2.Routing example • • Receive a packet destined to 192. 3.0/30. 1.3.3.5. 4. outside • • Entries 3 and 4 tie.168.1.3.0/0.56 on inside interface Local routing table for inside interface 1. 127.0/24.168. 1.1.1. outside 0. dmz 192. 192.5.0.168.168. But metric for 3 is better Entries 1 and 2 are for directly connected networks .0/24. 2.0.2. 192. 1.0/29.2. 127. 5.0. 1.168. 3.168.168.6.

• Can be used by the bad guy to avoid security enforcing devices – Most folks configure routers to drop packets with source routes set . can specify a source route – Was conceived of as a way to ensure some traffic could be delivered even if the routing table was completely screwed up.Source Based Routing • In the IP Options field.

IP Options in General • Originally envisioned as a means to add more features to IP later • Most routers drop packets with IP options set – Stance of not passing traffic you don’t understand – Therefore. there are security Options – Used for DNSIX. a MLS network encryption scheme . IP Option mechanisms never really took off • In addition source routing.

Can encode nontechnical transit constraints. e.Dynamic Routing Protocols • For scaling.g. Domain X will only carry traffic of paying customers • Receives full paths from neighbors. . discover topology and routing rather than statically constructing routing tables – Open Shortest Path First (OSPF): Used for routing within an administrative domain – RIP: not used much anymore – Border Gateway Protocol (BGP): Used for routing between administrative domains. so it avoids counts to infinity.

Dynamic Routing • Injecting unexpected routes a security concern. rather than discover them. – BGP supports peer authentication – BGP blackholing is in fact used as a mechanism to isolate “bad” hosts – Filter out route traffic from unexpected (external) points – OSPF has MD5 authentication. and can statically configure neighbor routers. .

feedback on potential bad route Echo Request and Echo reply. performance ping • Can use information to help map out a network – Some people block ICMP from outside domain . bad header field Source quench. TTL hit 0 Parameter problem. throttling mechanism rarely used Redirect. ping Timestamp request and Timestamp reply.Internet Control Message Protocol (ICMP) • Used for diagnostics – – – – – – – Destination unreachable Time exceeded.

Spoof the victim's address as the source • The echo request receivers dutifully send echo replies to the victim overwhelming it • Fraggle is a UDP variant of the same attack .Smurf Attack • An amplification DoS attack – A relatively small amount of information sent is expanded to a large amount of data • Send ICMP echo request to IP broadcast addresses.

Transport layer • UDP and TCP • Transport flows are defined by source and destination ports – A pair of devices can have numerous flows operating simultaneously by communicating between different pairs of ports • Applications are associated with ports (generally just destination ports) – IANA organizes port assignments http://www.iana.org/ • Source ports generally dynamically selected – Ports under 1024 are considered well-known ports – Would not expect source ports to come from the well-known range • Scanners probe for listening ports to understand the services running on various machines .

Datagram Transport • User Datagram Protocol (UDP) – – – – A best-effort delivery..g.323 also use UDP . no ACK Lower overhead than TCP Good for best-effort traffic like periodic updates No long lived connection overhead on the endpoints • Some folks implement their own reliable protocol over UDP to get “better performance” or “less overhead” than TCP – Such efforts don’t generally pan out • TFTP and DNS protocols use UDP • Data channels of some multimedia protocols. e. no guarantee. H.

UDP Header Source Port UDP Length Destination Port UDP checksum .

323 control channels .. HTTP. e. H. FTP. SSH.Reliable Streams • Transmission Control Protocol (TCP) – Guarantees reliable.g. ordered stream of traffic – Such guarantees impose overhead – A fair amount of state is required on both ends • Most Internet protocols use TCP.

TCP Header Source Port Sequence Number Acknowledgement number HDR Len U A P R S F R C S S Y I G K H T N N Window Size Urgent Pointer Options (0 or more words) Destination Port Checksum .

A sends SYN with its sequence number X B replies with its own SYN and sequence number Y and an ACK of A’s sequence number X A sends data with its sequence number X and ACK’s B’s sequence number Y 3. – – – Send many of the first message to B. 2. This leaves B with a bunch of half open (or embryonic) connections that are filling up memory Firewalls adapted by setting limits on the number of such half open connections. Never respond to the second message. .Syn flood • • A resource DoS attack focused on the TCP three-way handshake Say A wants to set up a TCP connection to B 1.

e. e. FTP and H.g. e. Netbios and DNS .g. SMTP • Dynamic Multi-connection Protocols.323 – Have a well known control channel – Negotiate ports and/or addresses on the control channel for subsidiary data channels – Dynamically open the negotiated data channels • Protocol suites. HTTP.Application Protocols • Single connection protocols – Use a single connection.g.

Spoofing Applications • Often times ridiculously easy • Fake Client – Telnet to an SMTP server and enter mail from whoever you want – Authenticating email servers • Require a password • Require a mail download before server takes send requests • Fake server – Phishing: misdirect user to bogus server .

DHCP • Built on older BOOTP protocol (which was built on even older RARP protocol) – Used by diskless Suns • Enables dynamic allocation of IP address and related information • Runs over UDP • No security considered in the design. • Other solutions – Physically secure networks – Use IPSec . obvious problems – Bogus DHCP servers handing out addresses of attackers choice – Bogus clients grabbing addresses • IETF attempted to add DHCP authentication but rather late in the game to do this.

consider shinrich. Use TCP based zone transfer to keep up to date • Like DHCP.cs. no security designed in – But at least the DNS server is not automatically discovered – Although this information can be dynamically set via DHCP • Queries and responses use UDP. – The name space is divided into non-overlapping zones – E.uiuc.uiuc.Domain Name System (DNS) • Hierarchical service to resolve domain names to IP addresses. – Packet interception attacks – Name chaining attacks – Untrustworthy.edu.cs. and one for .edu. One for .edu.edu • Can have primary and secondary DNS servers per zone.g. – DNS servers in the chain.uiuc. one for .. trustworthy servers .

. not confidentiality • DNS Threat Analysis in RFC 3833.DNSSEC • Seeks to solve the trust issues of DNS • Uses a key hierarchy for verification • Has been under development for a decade and still not really deployed • Provides authentication.

Summary • IPv4 not designed with security in mind • Complexity can be exploited – Poor implementations – Edge cases in standards • Bootstrapping can be exploited – Easy of configuration vs strong trust .