Ethics, Privacy and Computer Forensics Chap 14 Network Basics For Digital Investigation.
-
Upload
cecily-freeman -
Category
Documents
-
view
224 -
download
1
Transcript of Ethics, Privacy and Computer Forensics Chap 14 Network Basics For Digital Investigation.
Ethics, Privacy and Ethics, Privacy and Computer ForensicsComputer Forensics
Chap 14 Network Basics For Chap 14 Network Basics For Digital InvestigationDigital Investigation
Overview of NetworksOverview of Networks
Imagine a long long cord …. These are networksImagine a long long cord …. These are networks Computer connected to a network is called hostComputer connected to a network is called host NIC – network interface card is the primary NIC – network interface card is the primary
interface with a networkinterface with a network Use hubs, routers, etc. to connect networks of Use hubs, routers, etc. to connect networks of
computerscomputers Computers connected to the global internet use a Computers connected to the global internet use a
protocol called TCP/IPprotocol called TCP/IP Enable communication of dissimilar networksEnable communication of dissimilar networks Common language of network talkCommon language of network talk An IP address is the address of a host on the network An IP address is the address of a host on the network
just like a phone numberjust like a phone number
Overview of NetworksOverview of Networks
Routers are highly susceptible to Routers are highly susceptible to attacks because they are critical to attacks because they are critical to communicationcommunication
Firewalls are security devices that block Firewalls are security devices that block service and traffic destined to a certain service and traffic destined to a certain portport
Network services include Telnet and FTPNetwork services include Telnet and FTPHosts have logs that details network Hosts have logs that details network
transactions and their data and timetransactions and their data and time
Network TechnologyNetwork Technology Attached Resource Computer Network (ARCNET) Attached Resource Computer Network (ARCNET)
Earliest network technologyEarliest network technology Developed by Datapoint Corp in 1970’sDeveloped by Datapoint Corp in 1970’s Used active and passive hubs in the topologyUsed active and passive hubs in the topology Based on token scheme (proprietary)Based on token scheme (proprietary) Speeds from 2.5 Mbps (copper) to 20 Mbps (fiber)Speeds from 2.5 Mbps (copper) to 20 Mbps (fiber)
EthernetEthernet Most popular and accepted technology for networkingMost popular and accepted technology for networking Each computer has a NIC and it is connected to a central Each computer has a NIC and it is connected to a central
hub, switch or routerhub, switch or router Variable speedsVariable speeds Uses Carrier Sense Multiple Access with Collision Detection Uses Carrier Sense Multiple Access with Collision Detection
(CSMA/CD)(CSMA/CD) Like people at a dinner party, when two start talking at the Like people at a dinner party, when two start talking at the
same time, both stop talking and then only one starts same time, both stop talking and then only one starts talking againtalking again
A typical ARCNET configuration. A typical ARCNET configuration.
Network TechnologyNetwork Technology
Fiber Distributed data Interface (FDDI)Fiber Distributed data Interface (FDDI) Encoding pulses of lightEncoding pulses of light Expensive but fastExpensive but fast Data travel in only one directionData travel in only one direction
Developed in mid-1980’sDeveloped in mid-1980’s High Speed backbone connection between High Speed backbone connection between
distributed LANsdistributed LANs Dual Counter Rotating Rings: one primary, one Dual Counter Rotating Rings: one primary, one
secondarysecondary Attach up to 1000 workstations in both directionsAttach up to 1000 workstations in both directions Multiple messages/tokens rotate at the same timeMultiple messages/tokens rotate at the same time
Token PassingToken Passing
Token circulates on a Ring TopologyToken circulates on a Ring Topology Sender acquires free token, attaches Sender acquires free token, attaches
message and sends downstreammessage and sends downstream Receiver copies message and Receiver copies message and
acknowledges same in busy tokenacknowledges same in busy token Original sender responsible for taking the Original sender responsible for taking the
message off the ring and sending a free message off the ring and sending a free token downstreamtoken downstream
Deterministic performanceDeterministic performance Good for factoriesGood for factories Can calculate maximum time to get to a unitCan calculate maximum time to get to a unit
An FDDI network with primary and secondary token rings. During normal conditions, only An FDDI network with primary and secondary token rings. During normal conditions, only one of the rings is used and data travels in one direction. When a station or a cable one of the rings is used and data travels in one direction. When a station or a cable segment fails, the traffic loops to form a closed ring, moving data in the opposite segment fails, the traffic loops to form a closed ring, moving data in the opposite direction.direction.
Network TechnologyNetwork Technology
Asynchronous Transfer Mode (ATM)Asynchronous Transfer Mode (ATM) Uses fiber optics and special equipment called Uses fiber optics and special equipment called
ATM switchesATM switches Gigbts/sec communication rateGigbts/sec communication rate Establishes a connection firstEstablishes a connection first ATM switch is connected to a large networkATM switch is connected to a large network
Connection-oriented protocol (over virtual Connection-oriented protocol (over virtual paths and/or channels)paths and/or channels)
Backbone Technology; switch-based; fiber Backbone Technology; switch-based; fiber basedbased
WirelessWireless
WLAN – uses RF technologyWLAN – uses RF technology WAP – Wireless Access Point – WAP – Wireless Access Point –
connects to wired LAN; acts as a connects to wired LAN; acts as a wireless hubwireless hub
WLAN Adapters – wireless NICs with WLAN Adapters – wireless NICs with antennasantennas
Wireless supports peer-to-peer Wireless supports peer-to-peer without WAPswithout WAPs
IEEE 802.11gIEEE 802.11g
Speeds of 1-54 MbpsSpeeds of 1-54 MbpsUses the 2.4GHz bandUses the 2.4GHz band Is backwards compatible with IEEE Is backwards compatible with IEEE
802.11b802.11bRatified in June of 2003Ratified in June of 2003
802.11 Wireless Security Issues802.11 Wireless Security Issues
Easy to “listen” for id and passwordEasy to “listen” for id and passwordEasy to mimic in order to gain access Easy to mimic in order to gain access
to the wired Networkto the wired NetworkEarliest Protection was WEP – Wired Earliest Protection was WEP – Wired
Equivalent Privacy – which was easy Equivalent Privacy – which was easy to crackto crack
WPAWPA
Wi-Fi Protected AccessWi-Fi Protected AccessReplacement for WEPReplacement for WEPWPA password initiates encryptionWPA password initiates encryptionEncryption key changes every packetEncryption key changes every packetMuch harder to crack than WEPMuch harder to crack than WEPDoes not work in Ad Hoc ModeDoes not work in Ad Hoc Mode
BluetoothBluetooth
A wireless standard; short rangeA wireless standard; short rangeUsed to connect network appliances, Used to connect network appliances,
printers, …printers, …Low Power; max speed – 1Mbps over Low Power; max speed – 1Mbps over
30 foot area or less30 foot area or lessOperates in the 2.4GHz band and can Operates in the 2.4GHz band and can
interfere with 802.11binterfere with 802.11bConnects devices point to pointConnects devices point to point
A WLAN with two access points. A WLAN with two access points.
Wireless standards. Wireless standards.
Multiple access points with overlapping coverage. Multiple access points with overlapping coverage.
OSI Reference ModelOSI Reference Model
Provides useful way to describe Provides useful way to describe and think about networkingand think about networking
Breaks networking down into Breaks networking down into series of related tasksseries of related tasks
Each aspect is conceptualized as Each aspect is conceptualized as a layer a layer
Each task can be handled Each task can be handled separatelyseparately
The OSI Communications The OSI Communications Reference ModelReference Model
OSI – Open Systems Interconnection OSI – Open Systems Interconnection Committee of ISOCommittee of ISO
Reference adopted in 1978 (took 6 Reference adopted in 1978 (took 6 yrs)yrs)
Resulted in very little actual product Resulted in very little actual product (software)(software)
Is THE standard for describing Is THE standard for describing networks; the networks; the linqua francalinqua franca of of networking world widenetworking world wide
Understanding LayersUnderstanding Layers
Layering helps clarify process of Layering helps clarify process of networkingnetworking
Groups related tasks & Groups related tasks & requirementsrequirements
OSI model provides theoretical OSI model provides theoretical frame of referenceframe of referenceClarifies what networks are Clarifies what networks are Explains how they workExplains how they work
OSI Reference Model OSI Reference Model StructureStructure
Breaks networked communications Breaks networked communications into even layers:into even layers:ApplicationApplicationPresentationPresentationSessionSessionTransportTransportNetworkNetworkData LinkData LinkPhysicalPhysical
OSI Reference Model OSI Reference Model StructureStructure
Each layer responsible for different Each layer responsible for different aspect of data exchange aspect of data exchange
Each layer puts electronic envelope Each layer puts electronic envelope around data as it sends it down layers around data as it sends it down layers or removes it as it travels up layers for or removes it as it travels up layers for deliverydelivery
Each layer of OSI model communicates Each layer of OSI model communicates and interacts with layers immediately and interacts with layers immediately above and below itabove and below it
OSI Reference Model OSI Reference Model StructureStructure
Interface boundaries separate Interface boundaries separate layerslayers
Individual layer communicates Individual layer communicates only adjacent layers only adjacent layers
““Peer layers” describes logical or Peer layers” describes logical or virtual communication between virtual communication between same layer on both sending and same layer on both sending and receiving computersreceiving computers
Relationships Among Relationships Among OSI LayersOSI Layers
OSI Reference Model OSI Reference Model StructureStructure
Date is broken into Date is broken into packetspackets or or PDUsPDUs as it as it moves down stackmoves down stackPDU stands for protocol data unit, packet data PDU stands for protocol data unit, packet data
unit, or payload data unitunit, or payload data unitPDU is self-contained data structure from one PDU is self-contained data structure from one
layer to anotherlayer to anotherAt sending end, each layer adds special formatting At sending end, each layer adds special formatting
or addressing to PDUor addressing to PDUAt receiving end, each layer reads packet and At receiving end, each layer reads packet and
strips off information added by corresponding layer strips off information added by corresponding layer at sending endat sending end
Application LayerApplication Layer
Layer 7 is top layer of OSI reference Layer 7 is top layer of OSI reference modelmodel
Provides general network accessProvides general network accessIncludes set of interfaces for Includes set of interfaces for
applications to access variety of applications to access variety of networked services such as:networked services such as:File transferFile transferE-mail message handlingE-mail message handlingDatabase query processingDatabase query processing
May also include error recoveryMay also include error recovery
Presentation LayerPresentation Layer
Layer 6 handles data formatting and Layer 6 handles data formatting and protocol conversionprotocol conversion
Converts outgoing data to generic Converts outgoing data to generic networked formatnetworked format
Does data encryption and decryptionDoes data encryption and decryptionHandles character set issues and Handles character set issues and
graphics commandsgraphics commandsMay include data compressionMay include data compression Includes redirector software that Includes redirector software that
redirects service requests across redirects service requests across networknetwork
Session LayerSession Layer Layer 5 opens and closes sessionsLayer 5 opens and closes sessions Performs data and message exchangesPerforms data and message exchanges Monitors session identification and securityMonitors session identification and security
Performs name lookup and user login and Performs name lookup and user login and logoutlogout
Provides synchronization services on both Provides synchronization services on both endsends
Determines which side transmits data, Determines which side transmits data, when, and for how longwhen, and for how long
Transmits keep-alive messages to keep Transmits keep-alive messages to keep connection open during periods of connection open during periods of inactivityinactivity
Transport LayerTransport Layer
Layer 4 conveys data from sender Layer 4 conveys data from sender to receiverto receiver
Breaks long data payloads into Breaks long data payloads into chunks called segmentschunks called segments
Includes error checksIncludes error checksRe-sequences chunks into original Re-sequences chunks into original
data on receiptdata on receiptHandles flow controlHandles flow control
Network LayerNetwork LayerLayer 3 addresses messages for deliveryLayer 3 addresses messages for deliveryTranslates logical network address into Translates logical network address into
physical MAC addressphysical MAC addressDecides how to route transmissionsDecides how to route transmissionsHandles packet switching, data routing, and Handles packet switching, data routing, and
congestion controlcongestion controlThrough fragmentation or segmentation, Through fragmentation or segmentation,
breaks data segments from Layer 4 into breaks data segments from Layer 4 into smaller data packetssmaller data packets
Reassembles data packets on receiving endReassembles data packets on receiving end
Data Link LayerData Link LayerLayer 2Layer 2 creates data frames to send to creates data frames to send to
Layer 1Layer 1On receiving side, takes raw data from On receiving side, takes raw data from
Layer 1 and packages into data framesLayer 1 and packages into data framesData frame is basic unit for network traffic on Data frame is basic unit for network traffic on
the wirethe wireSee next slide for contents of typical data See next slide for contents of typical data
frameframePerforms Cyclic Redundancy Check (CRC) Performs Cyclic Redundancy Check (CRC)
to verify data integrityto verify data integrityDetects errors and discards frames Detects errors and discards frames
containing errorscontaining errors
Data FrameData Frame
Physical LayerPhysical Layer
Layer 1 converts bits into signals for Layer 1 converts bits into signals for outgoing messages and signals into bits outgoing messages and signals into bits for incoming messagesfor incoming messages
Manages computer’s interface to mediumManages computer’s interface to medium Instructs driver software and network Instructs driver software and network
interface to send data across mediuminterface to send data across mediumSets timing and interpretation of signals Sets timing and interpretation of signals
across mediumacross mediumTranslates and screens incoming data for Translates and screens incoming data for
delivery to receiving computerdelivery to receiving computer
Actions of Each layer of Actions of Each layer of OSI Reference ModelOSI Reference Model
OSI in SummaryOSI in Summary
The Reference Model breaks the The Reference Model breaks the communication process into seven communication process into seven distinct and independent layersdistinct and independent layers
Each layer’s functionality is well Each layer’s functionality is well defined as is its interface with defined as is its interface with surrounding layers and peer layerssurrounding layers and peer layers
Lower layers service upper layers in Lower layers service upper layers in sequencesequence
Network interconnection hardware operates at various layers of Network interconnection hardware operates at various layers of the OSI model.the OSI model.