The next layer is called the network layer.
Discussing the network layer we will analyze details of the IP version 4 protocol and we will say a
few words about the IP version 6 to
both versions of the protocol are responsible for delivering that protocol to the given address.
One other protocol operating in the network layer is ICMP and it is used for diagnostic purposes.
Executing a ping command usually results in sending echo packets of the ICMP protocol
previously discussed ethernet address thing and MAC addressing IP numbers are called logical addresses
due to the fact that they're allocated by administrators or users
the network layer includes routing therefore IP numbers must be allocated in such a way that data will
be delivered to both correct hosts and correct networks
an IP number must contain information about the network address and recipient hosts address
IP version 4 consists of a 32 bit number divided into four octets octets are separated by dots.
This is for users convenience computers treated as a uniform byte stream.
You may ask which part of the IP is a network address and which is the host address.
We'll discuss the addressing in greater detail while analyzing the subject of submitting.
For now you should only remember that each IP address should be associated with a subnet mask
subnet mask specifies which part of the IP is the host address and which is the network address.
The mask is usually given in bits.
Usually the bits for the network address are all set to one.
The last principle of the IP version 4 addressing is the network address must precede the host address.
In the mask all Number Ones must come before the first 0
in the third layer.
IP packets are called datagrams IP spoofing is as easy as Mac spoofing there also exists the possibility
of a writing table modification attack to which IP version 6 is especially vulnerable
in the network layer.
Just as in the second layer from headers are not encrypted IP addresses of both the sender and receiver
are sent as plaintext
everyone can read them and even modify them in real time
the biggest vulnerability of the network there is IP spoofing that is impersonating other IP addresses
attackers use this method to hide their hosts if the administrator notices in the event logs that someone
is scanned his or her system the IP address of the sender of scanning packets will not always be the
one of the attacker.
It may be a random address or the address of a computer the attacker previously found in the network
IP is a readable protocol.
And the fact that IP datagrams are so easily ratable is the reason why protocols become so successful.
The IP version 4 protocol has become very popular within just a couple of years.
It has completely replaced competing protocols IPX and SBX which are now totally forgotten
when it comes to routing options.
It has been a great deal of change between the fourth and the sixth version of IP protocol the IP version
6 protocol configuration is by and large automatic.
This means for instance that if a network doesn't include the DHC server you still don't have to configure
the IP version 6 protocol manually a local address will be provided automatically.
And if your router supports IP version 6 global broadcast addresses will also be provided.
This means that the computer reacts in real time to the rudder advertisement rudders advertised some
packets and the system configuration is adjusted accordingly.
This mechanism gives rise to two risks.
First it allows attackers to spoof broadcast packets
the attacker can configure IP version 6 addresses in such a way that your computer will treat every
other machine as a member of the local network.
Usually the network firewall settings are different for local networks and external networks.
And that's how the attacker can very easily change the configuration of a host network firewall.
The second risk can now be mitigated thanks to network hardware improvements.
But in fact the vulnerability was a consequence of following they are C standards.
IP version 6 hosts listen and react to packet's broadcast by IP version 6 routers
as stated in the R-S.C. injecting false routes into the network will block hosts if you resend a spoofed
broadcast packet with a false routing pathic a couple of times it will prevent the target computer from
communicating with the network.
Usually it takes two to five hundred such packets to completely disable the computer.
It will consume 100 percent of the processor usage.
This means that every computer that supports IP version 6 and all modern operating systems that do that
by default can be remotely disabled through such an attack.
You can disable web servers and servers for cloud services in a while.
Will show just how easy it is to do that.
But first we'll discuss the second protocol of the network layer.
That's ICMP.