Welcome back and in this next segment,
we're going to talk about TCP/IP.
As network analysts, most of the protocol stacks
that we will use and most of the things
that we wiil see will revolve around
ethernet and TCP/IP.
This is because most of the other
protocols that have been used
over the years, such as SNA, Appletalk,
IPX's, PX and many other have pretty much
been phased out for need of TCP/IP.
And the reason for that is because
we needed to, as a community
standardize on a protocol stack.
There is way too much stuff out there.
And there was a lot of a
gateways put in place
to translate one protocol
to another and to allow for communication.
So essentially, back in the day when the DOD
started working with ARPAnet in creating
the foundation of a network's
internet-working and the internet.
interestingly enough, TCP/IP was in it's infancy.
And it has grown since
from many versions of
primarily the one we were using IP version 4
into what is now the defacto
or becoming a defacto standard of
IP version 6, so IPng,
the next generation.
That being sad, the reason why
this is so important is because as
as a network analysts, one of the things
that we're going to be focusing on and if,
in our capturing of data and analyzing it
is the actual protocols and how they
inter-operate and help systems
communicate with one another.
So, again the most commonly one,
commonly used one that you will see
will be TCP/IP and that's
Transmission Control Protocol
Internet Protocol.
They're 2 separate protocols
however they work together to create a
connection-oriented network
communication and together,
they form up the TCP/IP protocol sweep.
So, in our first module,
we talked about the OSI model.
There's also the DOD model which is a
4 layer version of that 7 layer model.
And the TCP/IP protocol sweep
maps to each layer of that model.
So as an example, for the network layer,
that's where the Internet Protocol,
or IP will exist and above that,
in the transport layer is where
Transmission Control Protocol -
a protocol will exist as well as you UDP.
And then above that,
the higher layer protocols that help
provide services such as
emails, SNTP, web services, HTTP,
and file transfer services, FTP
all operate at the higher layers.
So that being said, it's imperative
as a network analyst to be familiar with
these protocols to know
the interworkings of them,
and to be able to predict
their behavior because
if you do not understand what it is
that you're supposed to see
or how they're supposed to work,
then when you capture the data
you're just going to see a
whole bunch of jibbers
and you're really not going to understand
wnat it is that you're looking at
to analyze it to see if there's issues.
So as an example,
when you're troubleshooting
do you know how
IP routing is supposed to work,
and why IP address is a necessary
and how that whole logical
networking component works?
Do you know that there are source
addresses and destination addresses
and as it goes through router hops,
as you're troubleshooting and capturing data
what the next source will be
as it's transferring over from router to router?
So, for example when you capture the data
on farside segment, do you really understand
the fundamentals of IP addressing?
And ever more so,
the underlying or under the hood pieces of it,
so when it's encapsulated,
do you understand what the header is?
Do you understand what an offset is?
Do you understand what fragmentation is?
A good example is with IP fragmentation
where that could be the most
common thing that you see
because of how it works for them to you.
But you could also, as an example
see that it will be part of an attack.
So, one of the things that
we put up on the screen is
a capture of a teardrop attack
and we'll get, we'll learn about this
as we move through the course, but
if you go into the Expert,
you'll start to see that
the IP payload length, there's a,
there was a problem with it
that's showing up as a malformed packet.
But in reality, what it is is
it's actually part of an attack, and again if
you're not really sure of the inner workings
of TCP/IP, or IP for this matter,
you're really not going to understand
what it is you are capturing and
what you're looking at.
So that's why it's so important
to really understand the underlying mechanisms
of how these protocols work.
So what does it do?
And why are we analyzing TCP/IP?
Well, again as we'll learn, for example with TCP
there's a, there's a handshake sequence where
synbits are sent, they're acknowledged and
a connection will be closed or finished.
And then there's resets and
and all different types of things
and when you capture those,
what do you actually,
what are you actually looking at?
Is it normal, is it normal traffic behavior?
Is it abnormal traffic behavior?
A good example would be
on a network where you're trying
to access the server and you're looking at
the underlying TCP communication
and you see, let's say, for example
a retransmission or 2.
So do you think that that's a problem or not?
When in fact, the whole point of TCP is
to allow for the ability of it
to be able to retransmit so that
if data is lost, it can then be resent.
However, what if you saw
within a certain time period
dozens of retransmissions?
That would then indicate maybe a problem,
maybe there was contention on the network
or buffering issue or something causing it
to retransmit often. Maybe the server
can't handle the communication
so it's causing it to retransmit.
But again, that's why working with
and understanding specifically,
how these protocols work is key
to working effectiviely with Wireshark.
It's going to help you
after you capture the data, then
be able to further filter it and refine it
and understand where to look
and then you can analyze -
is that normal behavior or
is that abnormal behavior?
Common issues that you'll see with the,
when you're troubleshooting IP,
as an example is you may have
routing problems.
Maybe you have a asynchronous
routing issue and you're seeing
data coming at a sequence - why is that?
You may have inccorect TCP/IP configuration.
And you may capture that, for example,
why can't a host communicate.
When you run a capture,
that it has incorrect default
gateway assignment.
Therefore, the packets are not going
to the router to be routed across
the network, and other things.
And in order to really troubleshoot that
and really dig deep and look inside it,
you're going to capture the packets
and drill down into the details pane
to see specific things, like in this example,
we are looking for the source and
destination IP addresses here.
I can see that the source is in a PIP address
and I can see right there that
I have a problem with my, my host, maybe.
For example, the DHCP server
is not giving out addresses. Therefore,
it's not getting in the correct IP assignment
and it will not, not allow it to communicate.
So again, there's, there's a lot of reasons
why you wanted to be able to understand
specifics so that these protocols
in the sweep because if you don't
understand how DHCP works
you don't understand how IP works,
then the data you capture and you inspect -
you will not really know what to,
what the problem would be.
And again, as the example I used earlier,
there may be things that you think
is the problem but that's normal behavior
for the protocol and it's ok.
So, for example, a duplicate act
one or two of them, not a big deal.
Maybe, you know, data got dropped
for a moment. It's indicating that there is
something is going on but
is that a, a really bad problem? Is it a
is it indicating systematic ongoing issue,
or is it just for a moment in time
the server was overwhelmed and dropped traffic.
And so that it didn't really impact the client
because it was able to hold the connection up.
But again, without that understanding
of how those protocols are working
you would not be able to really figure out
or make that determination.
So when you capture the protocol data,
TCP/IP, HTTP, SNMP, any of these protocols
and Wireshark is used, you can open the data
up for inspection and to further analyze it.
So as we mentioned before when we
brought up the, the teardrop attack
with the, or the IP fragmentation attack
we're able to take a look at this possible issue
then drill down into it and see specifics,
like in here, there's a bad payload
and the Expert flagged it as a malformed,
malformed packet. So again, you can see that
while using Wireshark, you're able to drill
down into the data and really analyze it
and see within the protocols and the
packets that are transmitted. And again,
it helps find problems that you cannot see
without capturing the data for inspection. So,
a great example would be this particular capture.
How would you know without capturing this data
that you had this issue? You may be able to run
gigantic ping and see the outcome.
You might be able to do other tests but
when you use Wireshark to capture this data
it's really exposed and you can dig,
dig deep into it and drill down into it.
And you can also recreate
the problem which is very helpful.
So that being said, just remember
when using Wireshark
one of the key things you want to do is
be able to look at some RFC's or get a
really good book on the TCP/IP and really
really undestand how
each one of those protocols work.
Another thing, key thing that can be done
is you can do traffic analysis
as we mentioned earlier.
There's things you can do with Wireshark.
You can do protocol analysis.
You can do packet analysis.
You can do traffic analysis.
And with traffic analysis, you'll be able to find
bandwidth and latency issues, and other
types of issues when using Wireshark.