Hi. And now come back to section two network fundamentals.
In this video,
we're going to see an introduction about the layer three network in layer
four transport. Here in layer three,
we're gonna see some protocols present in this layer.
So we have some protocols like arp,
IP version four and version six,
and I C M P version, I version and version six arp.
That's mean address resolution protocol.
They are both logical and visco Addresses are used for communication on a
network.
Logical addresses allow for communication among multiple networks in,
in indirectly connected devices.
Visco addresses facilitate communication on a single network segment
of devices that are directly connected to each other when a switch, for example,
these two type of addressing must work together in order for communication to
occur.
When application want to initiate a communication is already have a remote
host IP addresses.
That means that the system should have all it needed to build
the layer three through layer seven information of the packet.
It wants to transmit the only pieces of information it needs at this point.
It the layer two data link information containing the MEC addresses of
the target host
MEC addresses are needed because a switch interconnections devices
on a network using a content address addressable memory can table
which list the MEC addresses of all devices plugged in each
of each ports. If the destination MAC is a no,
then it must be resolved. The mechanism of resolution process,
the D C P IP networking, which e P four, IP four version four,
used to resolve IP addresses to make addresses.
It's called ARP Address Resolution Protocol.
The ARP resolution process use two packets,
ARP request and ARP response IP
Internet protocol. Today we have two versions, version four and version six.
IP version four is the whole work,
whole house of the communication process,
and is ultimately responsible for carrying data between devices
regardless of where the communication endpoints are located.
IP version four are 22 beat for bytes.
Assign numbers use it to uniquely identify devices.
Connected to a network is converted to base 10 and
represented as a number between zero and 255
in the format.
A B C D IP addresses consists of
two parts, a network portion and a host portion.
The network portion notifies the land local network the device is
connected to, and the host portion notifies the device itself on that network.
The network mask of our subnet mask determine which part of
the IP address belongs to the network or the host.
Part I C M P internet control message each in the,
in the ion in this version six is the utility protocol of T C
P A P responsible for providing information regarding the availability of the
devices, services, or routers on the T C I P network.
The common pinging is used to test for connectivity to a device.
It utilize I C M P to archive achieve its small
functionality.
The pinging common sends one packet at time to a device and listens
or reply to determine we where there is connectivity to the
devices.
So we have a ping echo pinging for request and an echo ping
for response. Okay,
so let's take a look and some protocols in the layer three.
So I have here my Linux call Linux environment here,
and I will start my version of Wireshark installed in this
environment. So let's, we saw in the, uh,
latest video, we have some interface, network interface protocol here.
And I will start, uh, capturing life,
capturing all the protocols in this my default networking
interface. So here we have some protocols,
some packets, some information, traffic
in my network. So let's take a look.
First of all in the IP packet structure.
So in this interface here, in this panel,
I have configured this panel here to show a graphic layer representation
of protocols of packet structure. So here, for example,
select the packet number two, it's uh,
a protocol EEG MB version two, for example. But as we saw,
we have some layers.
We have a composition of some layers here. So for example,
we have a composition for the, uh, layer 2, 3, 4,
and we have for LEO two A frame A
one, two, and three is a layer for IP protocol.
So this IP protocol is version two. Here
we have a graph per representation here.
So internet protocol, we have a version, we have some information for flags,
for example, we we're gonna see time to leave, for example.
Time to leave is, uh, uh,
information that represent the,
this packet will traffic for, for some servers, some ho some nodes.
And for each host, uh, is a mentation for this information here.
That's mean. Uh, this,
this is very interesting because the packet will try
to arrive some destination, but if some,
some proper internet and this packet will travel to some
different machines. For example, uh,
this packet has to drop 'cause it is not possible to have this,
this protocol travel into the internet forever, for example.
So time to leave is an example for, for this limitation,
we have the protocol, the source address,
and the source destination here is more simple
to, to verify this. For example, we have the version, version four.
We have some flags here.
We have the time to leave, as I said before. We have the type of protocol
and we have the source address in the destination address
here.
So this is the structure of the IP protocol.
Version four. Lemme put a filter here.
Lemme put a filter here for a protocol.
So here we have a protocol address, resolution protocol,
and we talked before that we have, uh, for a, we have two, uh,
two process requests in response. So for example,
here we have a request. Let me open the protocol.
So we have the other type here, internet,
we have the,
the protocol type for each version of the IP in this layer,
for example, so is IP four.
We have the op code in this case a request. And we have the addresses,
the address for Mac for the sender,
and the target in the ip. So we have, uh,
IP sender. So this is the address of my gateway.
So I have a, a request for the sender and the target.
Another request. We have a,
a collection of requesters and we have a reply here.
So let me check the here.
Okay,
so we have here first a request for the sender or this ip
and the target was this IP here. And we have, uh,
reply
from this request for the sender here
to this IP here. So here we have a cycle,
the beginning of a request, and then the response.
Okay? And at last, let's take a look of the pinging.
The IIC m p protocol is use it for verify the
connectivity of a network, for example. So lemme in this filter,
I'll open a terminal section here and I will
p
our website just to produce some
protocols for our analysis here.
So let me to take a pinging for example, or
one gov we have pinging here.
This is a, uh, ip, uh, version, uh, six. So,
and analyze here, okay, for here we have our,
uh, I C M P version six.
So here we have all the layers composing
this information, this protocol here. So we have the IP version six.
Here we have looked at a little different from a structure of IP six
i IP four. So we have here IP four,
we all the information here, the headers here,
and I have now another packet, IP six.
So we have some difference on flags
to leave. T t L was changed for hope. Hope limit here. Okay?
But the idea is the same.
We have the source address and the destination address.
This is a little different from IP four. Just look here,
we have more information and we have a big, uh,
range of addresses.
So this is 128 beats different from
22 beats for version four. Okay? Uh,
this give me more a huge number of devices that I
can use for IB six. Okay?
So this give me more flexibility and, uh,
a huge number of devices because this was a,
a, a problem in i p four.
We have a limited available numbers for device for addresses in i
P four. And this was resolved in in IP six.
Because of this, the number of devices is a huge in this version here.
So we have our address stores and our destination address here.
And we have M C P version six because the
IP here was six. So we have, uh,
structured and forces a request, a section
for data here. Look for this is only to,
to get the connectivity.
So we have some request as we saw here.
Hype is echoing. Request
location request two.
And the number of seconds is changed because we are exchanging information on
to get the information go and down. Okay,
let me start here again. The capturing, let
start another pinging.
Okay, this website here,
we have IP version four. Okay. In the format,
as I say A, B, D, and D.
Okay, let put a filter
for I M P. So here we have the,
the IP four,
and we have request and reply. Okay,
because this is showing to me, to me the responsibility
of this address. So we have some information here.
We have a sequence for I M P, we have, uh, time to leave.
That's mean. That is a good route because any,
any packet was not the number here. D T L was not changed.
That's mean that there is not any problem in the flow for this communication.
If, for example,
this packet go into a different server to arrive in the
destination, the t t l here will be decremented, for example.
The time of the response is very low. That's means is a,
is a good connection. And we have a request and reply here.
So let me close here and look for the request
echo.
We have this shorter here and the data.
And for reply, we have some changes.
First of all, reply the response time because this is a,
is a reply type
and the, the destination of the reply here,
the, the, the address, the request,
and the reply. Here in the layer four transport,
we have two main protocols.
T C P and U D P C P means transmission control protocol.
And U D P means user datagram protocol.
Part P is provide end-to-end reliability for the delivery of data.
So it's able to handle this data sequencing, error,
recovery and ensure data place delivery.
R p is a connection oriented protocol.
So that's mean that he's able to establish a formal connection before con
transmitting data. He's able to track packet delivery.
He's able to attempts to formally close communication channels.
Maintain transmission is complete in many commonly used application layer
protocols use to deliver the packet to the final destination.
For this protocol, we have some ports. So we have, uh,
six 5,525 ports available for use
when communicating with T C P. And we have two groups,
a system port group or external port or known port.
In this group,
we have port number one to port number 1020 23.
And another group is a ephemeral port group. That's mean that we can use,
uh, this port for our applications, our connection, for example,
and start in the port a hundred,
1,024 to six
5,525 port.
And for this communication, for example, http use a t p for,
for connection. And we have some ways, okay,
for open connection to close a connection
and to close more abruptly a connection
for open a connection, we have a T C P three-way handshake.
So all the T C P based communication must begin with a handshake
between the two hosts for the following purpose. For example,
the first one is it allows the transmitting host to ensure that
the recipient host is up and able to communicate.
It lets the transmitting host check that the recipient is listening
on the port that transmitting host is attempted to communicate on.
So this ensure the communication between the two hosts and it allows
the transmitting host to send its starting segment number
to the recipient so that both hosts can keep this stream of packets
in the proper segment because we have, uh,
segment number in this, uh, streaming.
And we have this representation here. So we have host here, we has o host A,
communicate with host B,
and first of all have to create packets for start connection.
First of all,
host A will send a packet with the flag sync to host B.
Host B will respond, uh, when another package, uh,
when the flag scene to host a. And finally,
host A will send a packet with the flag X to host B.
So this is how open connection start.
We have a T C P tier down to close the connection.
So it's used to gracefully and a connection between two devices
After they have finished communicate all the communication.
This process involves our package and is it utilize
the fin flag to signify the end of connection.
So in this representation here,
we have a host A and host B host A has to end the
connection. So host A using send a packet with a flag fin egg to host B,
host B will res respond host A in two packets.
First a packet with a flag egg,
and then a packet with a flag fin egg. Finally,
host A will send a package to flag win a flag A to host
B. So the connection will be gracefully close.
And we have the d p reset.
That's mean that when we have to aim a Berkeley a connection,
so host A will all host b uh,
is depend of who will the host that will end the
connection. Uh,
we'll send a packet with the flag r s t to reset the
connection. And we have we,
the protocol u d p, that's mean user datagram protocol.
Uh, and it's aimed to provide speedy transmission.
It's aless protocol. That's mean that when host A and host B, we don't have,
uh, the formality open connection and close connection, for example,
in the same way as T C P.
So don't not formally establish the eliminate connection. Uh,
the protocol that reply on U D P typically have their own
re reliability services or use certain features of I C
M P, for example,
to make the connection somehow more reli like D N s and
D H C P.
So this protocol use U D P as the transport protocol
to have more, uh, speed for the, for the connection,
but they implement some building features for reliability.
And, uh, we're gonna see more details. But these both, uh, protocols.
So now let's take a look in the D C P N D P protocols
and in more detail, uh, in more detail. And let me open, uh,
the Wireshark. So here is our,
our shark, the list of inter network interfaces.
And let me start the live capturing
package. Okay? So we start to capture all the,
the package traffic in my network, uh, between the, my,
my laptop here and my router.
Lemme open a web browser
and I'll access the web, the Google website.
Let stop the captain and let's analyze all the captors.
So I have, I access the, the website, the Google website here.
And let's take a look in the three-way handshake or T
C P or here we have some of the package,
the filter. T C P is more,
is more interesting here. So
here, here we have, uh, this IP here,
this IP here, 1 5 7.
Lemme choose a good example.
Okay? These are good example here.
So here we have my IP address here.
And send us a syn for this, uh, destination here.
So if we take a look,
we have the IP six,
we have all the package composed by passing through
the layers, okay? That the, for the O S I model,
we have the IP four in D C P. Here
we have the, the femoral port that we talked before.
Uh, destination port in the,
the ip, the source in the destination, okay?
Was at tcp. As we're taking, uh,
observation here, we have the flag here for sync.
We have a set of flags and this is the,
the sink flag for open the communication.
We have some optional, uh, plugs here too.
And that's it. Okay,
so we have the first is a sync for the first package here,
the destination will respond, means sync act. Okay?
And then the first,
this device here that open the connection will respond,
mean act. That's mean that the connection,
the connection here is open. 'cause we have this, uh,
this package, assemble of package here, sync syn,
e and E. So the connection is done.
That's mean that we can exchange data between this
host here, ACT data. Okay?
We have the, all the, the communication between these both, uh,
hosts. Okay?
We have some transmissions here.
This filter is applied for all the life capturing captain.
That's mean that this can have more package from other
devices and hosts, okay?
But you have to pay attention and the source destination here,
for example, we have others example of the transmission.
That's mean that the data is flowing to one host from or
another in the act. That's mean that, okay, I receive this, uh, this data,
you are allowed to go ahead. For example,
we saw the open connection.
This is our other open connection for other device o other
host here. And here, here we have the,
the formality, the package for close a connection. Okay?
We have a finac, we have a,
a act here we have another finac look,
this IP here, send a finac the,
the destination package,
the version of the flow send a finac to, okay?
So this is configuring and, uh,
gracefully finish a connection.
We have a end of connection here,
okay? And for U D P,
let put a filter here, DP or D N s.
Okay,
we saw that d s use the U D P in order
the communications. So we have a D n ss.
D n S is a package responsible
to, uh, identify
our destination to check where is,
if I put address, for example,
D N SS is a protocol to resolve this,
this IP here. So for d n s,
we have a lot of package here. And for example, here,
we have here U D P user DATAGRAM protocol here,
okay? Use it for,
get more speed for the, the information for D N Ss.
We have some information here. Okay?
D n s is is a protocol that queries some
curious to resolve package because the,
the protocol user package, for example,
to resolve the name he sent for a hope for, for a host. This host don't,
if this host has to resolve the, the address,
he'll give the, the result. If not,
he will send another d n s request for another host and another host and another
host. That's mean, that is a, like a, a loop.
So see the number of curries? And for each queue we have,
we have the re the, the answer. Uh, and we have
the use of U D P. Here we have the structure.
Here is a protocol
different from D C P. So the header is very different.
We have the source port, the smash port,
some checks on applied for the D n s and the payload is, uh,
is information here. Okay?
In this video we saw some main protocols.
Use it in the layers three and four of the OZ model.
The next section, we'll take a look at net penetration test.
I hope see you there.