Note

These notes use only the five references specified: Kurose & Ross (8th ed.), Gordon Lyon's Nmap Network Scanning, James Forshaw's Attacking Network Protocols, Gregor N. Purdy's Linux iptables Pocket Reference, and Wenliang Du's Computer & Internet Security: A Hands-on Approach, 2nd ed.

1. What Is a Computer Network?

A computer network is a collection of interconnected computing devices that communicate using defined protocols.

Kurose & Ross presents the Internet in two complementary ways:

Nuts-and-bolts view: end systems, packet switches, communication links, and interconnected networks.
Services view: infrastructure providing communication services to distributed applications.

                    Internet
                       |
        +--------------+--------------+
        |                             |
      Router                        Router
        |                             |
   +----+----+                   +----+----+
   |         |                   |         |
 Host A    Host B               Host C   Host D

End Systems / Hosts

Devices at the network edge that run applications.

Routers

Routers forward packets between networks.

Links

Communication paths between network devices, including copper, fiber, and radio links.

Source: Kurose & Ross, Chapter 1, §1.1 and §1.2.

2. Protocols

A protocol defines the format and order of messages exchanged between communicating entities and the actions taken when messages are sent or received.

Sender                         Receiver
   |                              |
   | -------- Message 1 --------> |
   |                              |
   | <------- Message 2 ----------|
   |                              |
   | -------- Message 3 --------> |

Important protocol properties:

Message format
Message order
Meaning of fields
Sender/receiver actions

Source: Kurose & Ross, Chapter 1, §1.1.3, What Is a Protocol?

3. Packet Switching

The Internet primarily uses packet switching. A large message is divided into packets that are forwarded through the network.

Original message
+----------------------------------------+
|                  DATA                  |
+----------------------------------------+

                ↓ divide

+----------+ +----------+ +----------+
| Packet 1 | | Packet 2 | | Packet 3 |
+----------+ +----------+ +----------+

A packet can pass through multiple routers:

Host A
  |
  v
Router 1
  |
  v
Router 2
  |
  v
Router 3
  |
  v
Host B

Source: Kurose & Ross, Chapter 1, §1.3.1, Packet Switching.

4. Delay, Loss, and Throughput

4.1 Processing Delay

Time required for a router to examine and process a packet.

Packet arrives
     ↓
Inspect header
     ↓
Forwarding decision

4.2 Queuing Delay

Time spent waiting in a router queue before transmission.

+----------------+
| Output Queue   |
| [P1][P2][P3]  |
+----------------+
        |
        v
     Transmit

4.3 Transmission Delay

For a packet of L bits and a link rate of R bits/s:

Transmission delay = L / R

4.4 Propagation Delay

Time required for a signal to physically travel through the communication medium.

Packet Loss

Routers have finite buffers. When a queue is full, arriving packets may be discarded.

Incoming packets
       ↓
+------------------+
| Router Queue     |
| [P1][P2][P3][P4]|
+------------------+
       ↓
   queue full
       ↓
     DROP

Throughput

Throughput is the rate at which bits are delivered from source to destination. A slower link on the path can become the bottleneck.

100 Mb/s → 10 Mb/s → 100 Mb/s
               ^
            bottleneck

Source: Kurose & Ross, Chapter 1, §1.4.

5. Internet Protocol Stack

Kurose & Ross uses a five-layer Internet protocol stack:

+----------------------+
| Application          |
+----------------------+
| Transport            |
+----------------------+
| Network              |
+----------------------+
| Link                 |
+----------------------+
| Physical             |
+----------------------+

Application Layer

Network applications and application protocols such as HTTP, DNS, and SMTP.

Transport Layer

Logical communication between application processes.

Main Internet transport protocols:

TCP
UDP

Network Layer

Moves datagrams between hosts across interconnected networks.

Main protocol:

IP

Link Layer

Moves frames over an individual link/LAN.

Examples:

Ethernet
Wi-Fi

Physical Layer

Carries raw bits across the physical medium.

Source: Kurose & Ross, Chapter 1, §1.5.1.

6. Encapsulation

Each layer adds its own control information.

Application:
+------------------+
| Application Data |
+------------------+

Transport:
+-----------+------------------+
| TCP/UDP   | Application Data|
| Header    |                  |
+-----------+------------------+

Network:
+---------+---------------------+
| IP      | TCP/UDP + Data      |
| Header  |                     |
+---------+---------------------+

Link:
+---------+----------------------+----------+
| Ethernet| IP + TCP/UDP + Data | Trailer  |
| Header  |                      |          |
+---------+----------------------+----------+

The hierarchy is:

Application message
        ↓
Transport segment
        ↓
IP datagram
        ↓
Link-layer frame

Sources: Kurose & Ross, Chapter 1, §1.5.2; Forshaw, Chapter 1, Data Encapsulation.

7. Host, IP Address, and Port

A host can run multiple applications simultaneously. Transport-layer port numbers identify application endpoints.

192.168.1.10:80
192.168.1.10:22
192.168.1.10:443

Conceptually:

IP address → host/interface
Port       → transport endpoint / application process

Sources: Kurose & Ross, Chapters 2–3; Lyon, Nmap Network Scanning, Chapter 4.

8. IPv4 Addressing and Subnets

An IPv4 address is 32 bits. A prefix divides the address into network and host portions.

Example:

192.168.1.0/24

Network portion | Host portion
<---- 24 -----> | <- 8 bits ->

A host can determine whether a destination is local by comparing the destination address with its configured prefix.

Source: Kurose & Ross, Chapter 4, §4.3.2.

9. Same-Network vs Different-Network Communication

Same Network

If Host A and Host B are in the same subnet, A can use ARP to learn B's MAC address and send the Ethernet frame directly.

Host A
   |
   | Ethernet frame
   | Dest MAC = Host B
   v
Switch
   |
   v
Host B

The router does not need to route this traffic.

Different Network

If B is on another subnet, A sends the frame to its next hop, normally the default gateway.

Host A
   |
   | Ethernet:
   | Dest MAC = Router
   |
   | IP:
   | Dest IP = Host B
   v
Router
   |
   | New Ethernet frame:
   | Dest MAC = Host B
   v
Host B

Important distinction:

Different network:

Destination IP  = final Host B
Destination MAC = next hop / gateway (on the current LAN)

Sources: Kurose & Ross, Chapters 4 and 6; Forshaw, Chapter 1.

10. MAC Addresses and Ethernet

A MAC address is a link-layer address used on a local network.

Host A
MAC = AA:AA:AA:AA:AA:AA

Host B
MAC = BB:BB:BB:BB:BB:BB

An Ethernet frame contains source and destination MAC addresses.

+-------------+-------------+-------------------+
| Dest MAC    | Source MAC  | Payload           |
+-------------+-------------+-------------------+

Ethernet switches use MAC addresses for local forwarding.

Source: Kurose & Ross, Chapter 6, §6.4.2.

11. ARP — Address Resolution Protocol

ARP maps an IPv4 address to a MAC address on the local network.

Example:

Host A: Who has 192.168.1.20?

Host B: 192.168.1.20 is at BB:BB:BB:BB:BB:BB

Then A can construct:

IP destination      = 192.168.1.20
Ethernet destination = BB:BB:BB:BB:BB:BB

ARP does not determine the route. Routing determines the next hop; ARP resolves that next hop to a MAC address on the current LAN.

Destination IP
      ↓
Routing decision
      ↓
Next-hop IP
      ↓
ARP
      ↓
Next-hop MAC
      ↓
Ethernet frame

Source: Kurose & Ross, Chapter 6, §6.4.1, Link-Layer Addressing and ARP.

12. Routing vs Forwarding

Forwarding

The local action performed by a router to move a packet from an input interface to the appropriate output interface.

Incoming packet
      ↓
Forwarding table
      ↓
Output interface
      ↓
Transmit

Routing

Determines paths/reachability and produces information used for forwarding.

Network topology
      ↓
Routing algorithms/protocols
      ↓
Routing table
      ↓
Forwarding

Source: Kurose & Ross, Chapter 4, §4.1 and Chapter 5.

13. Routing Table and Longest-Prefix Match

A routing table associates destination prefixes with next hops and/or outgoing interfaces.

Destination       Next Hop        Interface
------------------------------------------------
192.168.1.0/24    directly conn.  eth0
10.0.0.0/24       192.168.1.1     eth0
0.0.0.0/0         192.168.1.254   eth0

If multiple routes match, the router chooses the longest matching prefix.

Example:

10.0.0.0/8
10.1.0.0/16
10.1.2.0/24

For 10.1.2.50, the /24 route is preferred.

Source: Kurose & Ross, Chapter 4 forwarding/routing material.

14. IPv4 Datagram

An IPv4 datagram consists of an IPv4 header followed by a payload.

+------------------------------------------------+
| IPv4 Header                                    |
+------------------------------------------------+
| IPv4 Payload                                   |
+------------------------------------------------+

Important header fields include:

Version
Header Length
Total Length
Identification
Flags
Fragment Offset
TTL
Protocol
Header Checksum
Source Address
Destination Address

Sources: Kurose & Ross, Chapter 4, §4.3.1; Lyon, Nmap TCP/IP Reference.

15. TTL

IPv4 contains a TTL (Time to Live) field. A router decrements TTL when forwarding a packet.

Initial TTL = 5

Router 1 → 4
Router 2 → 3
Router 3 → 2

This prevents a packet from circulating indefinitely. Kurose & Ross connects TTL expiration with ICMP error reporting.

Sources: Kurose & Ross, Chapter 4; Lyon, Nmap TCP/IP Reference.

16. IP Protocol Field

The IPv4 Protocol field identifies the protocol carried in the IP payload.

IP
 |
 +-- TCP
 |
 +-- UDP
 |
 +-- ICMP

Sources: Kurose & Ross, Chapter 4; Lyon, Nmap TCP/IP Reference.

17. TCP

TCP is a connection-oriented transport protocol.

It provides mechanisms for:

Reliable data transfer
Ordering
Acknowledgments
Retransmission
Flow control
Congestion control

Three-Way Handshake

Client                         Server
   | -------- SYN ------------> |
   | <------ SYN + ACK -------- |
   | -------- ACK ------------> |
   |                            |
   |      Connection ready      |

Important TCP fields/concepts:

Source port
Destination port
Sequence number
Acknowledgment number
Flags
Window
Checksum

Source: Kurose & Ross, Chapter 3, §3.5.

18. UDP

UDP is a connectionless transport protocol.

UDP provides a simpler transport service than TCP and contains:

Source port
Destination port
Length
Checksum

+-------------------------+
| UDP Header              |
+-------------------------+
| Application Data        |
+-------------------------+

There is no TCP-style connection establishment.

Sources: Kurose & Ross, Chapter 3, §3.3; Lyon, Nmap TCP/IP Reference.

19. TCP vs UDP

Feature	TCP	UDP
Connection-oriented	Yes	No
Three-way handshake	Yes	No
Reliable transfer	Yes	No built-in reliability
Ordering	Yes	No
Retransmission	Yes	No
TCP congestion control	Yes	No
Header complexity	Higher	Lower

Source: Kurose & Ross, Chapter 3.

20. DNS

The Domain Name System (DNS) provides name-resolution services.

www.example.com
       ↓
DNS resolver
       ↓
DNS system
       ↓
IP address

DNS is an application-layer protocol.

Source: Kurose & Ross, Chapter 2, §2.4.

Du discusses DNS from the security perspective, including DNS attacks.

21. HTTP

HTTP is an application-layer protocol used for Web communication.

Client                         Server
   | -------- HTTP request ---> |
   | <-------- HTTP response -- |

In the traditional HTTP-over-TCP model:

HTTP
 ↓
TCP
 ↓
IP
 ↓
Ethernet

Source: Kurose & Ross, Chapter 2, §2.2.

22. ICMP

Internet Control Message Protocol (ICMP) provides network-layer control and error-reporting functions.

Examples:

Echo request/reply
Destination unreachable
Time exceeded

Host A
  |
  | ICMP Echo Request
  v
Host B
  |
  | ICMP Echo Reply
  v
Host A

ICMP is also used in connection with TTL expiration and certain forwarding errors.

Source: Kurose & Ross, Chapter 5, §5.6.

Nmap uses ICMP behavior for host discovery.

23. NAT

Network Address Translation (NAT) translates addresses between address spaces.

Private host
192.168.1.10
      |
      v
     NAT
      |
      v
Public address

Kurose & Ross explains NAT conceptually; Purdy explains Linux Netfilter/iptables NAT operations.

Important operations in Purdy include:

DNAT
SNAT
MASQUERADE
REDIRECT

Sources: Kurose & Ross, Chapter 4, §4.3.3; Purdy, NAT sections.

24. Firewall

A firewall filters traffic according to a security policy.

Incoming packet
       |
       v
+---------------+
|   Firewall    |
+---------------+
       |
    +--+--+
    |     |
  Allow  Block

Filtering may use:

Source IP
Destination IP
Protocol
Source port
Destination port
Connection state

Sources: Kurose & Ross, Chapter 4, §4.5, Middleboxes; Purdy; Du firewall material.

25. Netfilter / iptables

Netfilter is the Linux kernel's packet-processing subsystem.

iptables is the user-space tool used to configure Netfilter.

User space
    |
    v
iptables
    |
    | configure rules
    v
Netfilter
    |
    v
Linux networking stack

Important hooks:

PREROUTING
INPUT
FORWARD
OUTPUT
POSTROUTING

Forwarding path:

Incoming packet
      ↓
PREROUTING
      ↓
Routing decision
      ↓
FORWARD
      ↓
POSTROUTING
      ↓
Outgoing interface

Local delivery:

PREROUTING
    ↓
Routing
    ↓
INPUT
    ↓
Local process

Locally generated:

Local process
    ↓
OUTPUT
    ↓
Routing
    ↓
POSTROUTING

Primary source: Purdy, Linux iptables Pocket Reference, Concepts, Chains, Packet Flow, Tables, Rules, and Connection Tracking.

26. iptables Tables and Rules

Purdy groups rules into tables according to function.

filter

Packet filtering:

ACCEPT
DROP
REJECT

nat

Network address translation:

DNAT
SNAT
MASQUERADE
REDIRECT

mangle

Packet modification/mangling.

A rule can be understood as:

Rule = Match + Target

Examples of matches:

Source IP
Destination IP
Protocol
TCP port
UDP port
Interface
Connection state

Examples of targets:

ACCEPT
DROP
REJECT
LOG
DNAT
SNAT

Source: Purdy, Tables, Rules, Matches, and Targets.

27. Connection Tracking

Purdy describes connection tracking as a stateful mechanism that allows packets to be interpreted in relation to a connection.

Packet
  ↓
Connection tracking
  ↓
Connection state
  ↓
Firewall rule
  ↓
Decision

A connection can have states such as:

NEW
ESTABLISHED

This is particularly important for TCP.

Source: Purdy, Connection Tracking, p. 14 and state match material.

28. Packet Sniffing

Packet sniffing means capturing and inspecting network traffic.

A captured packet can be examined layer by layer:

Ethernet
   ↓
IP
   ↓
TCP / UDP / ICMP
   ↓
Application protocol

Forshaw's Chapter 2 focuses on capturing application traffic and packet analysis. Du's packet-sniffing material discusses packet capture using pcap.

Sources: Forshaw, Chapter 2; Du, Chapter 15.

29. Packet Spoofing

Packet spoofing means constructing packets whose fields do not truthfully represent the actual sender or intended properties.

Example: a forged source IP address.

Actual sender
      |
      | source IP = forged address
      v
    Network

Spoofing is relevant to several network attacks, including some DoS and ARP-related attacks.

Sources: Forshaw network-protocol attack material; Du packet spoofing/TCP-IP attack material.

30. IP Fragmentation

IPv4 fragmentation divides an IP datagram's payload when the datagram cannot fit into the next link's MTU.

The IPv4 header is copied into each fragment; it is not split.

Original:

+----------+---------------------------+
| IP HDR   | IP Payload               |
+----------+---------------------------+

After fragmentation:

+----------+------------------+
| IP HDR   | Payload part 1   |
+----------+------------------+

+----------+------------------+
| IP HDR   | Payload part 2   |
+----------+------------------+

+----------+------------------+
| IP HDR   | Payload part 3   |
+----------+------------------+

Because TCP is inside the IP payload, a deliberately tiny first fragment can cause the TCP header to span fragments.

Important fields:

Identification
Flags
Fragment Offset

Fragment offset is expressed in 8-byte units:

Actual byte offset = Fragment Offset × 8

MF = 1 means more fragments follow; MF = 0 identifies the last fragment.

Sources: Du, The Internet Protocol (IP) and Attacks, IP Fragmentation; Lyon, fragmentation/firewall material.

31. IP Fragmentation and Reassembly

Fragments belonging to the same original datagram use the same identification information and offsets that allow reconstruction.

Conceptually:

Fragment 1
Fragment 2
Fragment 3
      |
      v
Destination
      |
      v
Reassembly
      |
      v
Original IP datagram

Reassembly occurs at the destination. Du also discusses a reassembly timer; if the required fragments do not arrive in time, the partial datagram is discarded.

Source: Du, IP Fragmentation and reassembly material.

32. ARP Attack Vector

ARP maps IPv4 addresses to MAC addresses, but the protocol does not strongly authenticate ARP information.

An attacker on a local network can attempt to poison a victim's ARP cache.

Victim cache:

B's IP address
      ↓
Attacker's MAC address

Instead of:

B's IP address
      ↓
B's MAC address

This can redirect traffic through the attacker and enable interception or disruption.

Primary source: Du, ARP cache-poisoning material / TCP-IP attacks.

33. IP Fragmentation Attack Vectors

Fragmentation is legitimate, but malformed fragments can exploit implementation weaknesses.

Ping of Death

Fragments are crafted so that reassembly describes a packet larger than the maximum IPv4 size.

Fragments
    ↓
Reassembly
    ↓
Apparent size > 65,535 bytes
    ↓
Vulnerable implementation
    ↓
Crash / DoS

Teardrop

Fragments are crafted with overlapping byte ranges.

Fragment 1
0 ---------------- 1000

Fragment 2
       800 ---------------- 1300
       ^^^^^ overlap ^^^^^

A vulnerable reassembly implementation may mishandle the overlap.

Tiny Fragment Attack

The first fragment is made very small so important transport-layer header information is split across fragments, complicating simple firewall filtering.

Sources: Du, IP fragmentation attacks; Lyon, Nmap firewall/IDS fragmentation material.

34. Denial of Service and DDoS

DoS aims to make a network, host, or service unavailable or degraded.

Kurose & Ross describes broad DoS categories including:

Vulnerability attacks
Bandwidth flooding
Connection flooding

Bandwidth Flooding

Attack traffic
     ↓
Link capacity exceeded
     ↓
Queue growth / packet loss
     ↓
Service degradation

Connection Flooding

Many connection attempts
        ↓
TCP state / backlog consumed
        ↓
Resource exhaustion

DDoS

A distributed attack uses many sources.

Source 1 \
Source 2  \
Source 3   \
Source 4    ---> Victim
Source 5   /
Source 6  /
Source 7 /

Source: Kurose & Ross, Chapter 1, §1.6, Networks Under Attack.

35. TCP SYN Flood

Normal TCP:

Client                         Server
   | -------- SYN ------------> |
   | <------ SYN + ACK -------- |
   | -------- ACK ------------> |

SYN flood:

Attacker                         Server
   | -------- SYN ------------> |
   | -------- SYN ------------> |
   | -------- SYN ------------> |
   | -------- SYN ------------> |
   | -------- SYN ------------> |
   |             ...            |

The target can accumulate incomplete connection state.

SYNs
 ↓
Half-open connections
 ↓
Backlog/state consumption
 ↓
Resource exhaustion
 ↓
Legitimate connections affected

Sources: Kurose & Ross, Chapter 1, §1.6 and Chapter 3, TCP connection management; Du, Chapter 16 / TCP-IP Attack material.

36. SYN Cookies

SYN cookies are a countermeasure to SYN flooding.

Instead of immediately maintaining normal per-connection state for every SYN, the server encodes connection information into a server-generated sequence number.

Client                         Server
   | -------- SYN ------------> |
   | <--- SYN-ACK + cookie -----|
   |                            |
   | -------- ACK ------------> |
   |                            |
   |      Verify cookie         |
   |                            |
   |   Create normal state      |

Conceptually:

SYN arrives
    ↓
Generate cookie
    ↓
Send SYN-ACK
    ↓
Wait for ACK
    ↓
Verify cookie
    ↓
Create connection state

The defense changes the resource cost of incomplete SYN attempts; it does not prevent the SYN packets from arriving.

Primary source: Du, Chapter 16, TCP attacks / SYN-cookie countermeasure and the associated SEED TCP/IP Attack Lab.

37. Flooding as a Queueing Problem

A useful model is:

λ = arrival rate
μ = service rate

If:

λ < μ

service capacity can keep up.

If:

λ > μ

queues tend to grow.

With finite queue capacity:

Queue grows
   ↓
Queue full
   ↓
Packets/requests dropped
   ↓
Service degrades

Source: Kurose & Ross, Chapter 1, §1.4.

38. Layer-by-Layer View

+----------------------+
| Application          |
+----------------------+
| Transport            |
+----------------------+
| Network              |
+----------------------+
| Link                 |
+----------------------+
| Physical             |
+----------------------+

Common examples:

Layer	Examples / concepts
Application	HTTP, DNS, SMTP
Transport	TCP, UDP, ports
Network	IPv4, routing, ICMP, TTL
Link	Ethernet, MAC, ARP
Physical	Signals / bits

39. Security Topics Mapped to the Stack

Application
    ↓
HTTP / DNS attacks

Transport
    ↓
SYN flood / TCP attacks

Network
    ↓
IP spoofing / fragmentation / ICMP attacks

Link
    ↓
ARP cache poisoning / Ethernet attacks

This layered view connects the networking fundamentals in Kurose & Ross to the attack and defense material in Du, Nmap, Forshaw, and Purdy.

40. Important Relationships to Memorize

IP vs MAC

IP  → Layer 3 / network delivery
MAC → Layer 2 / local-link delivery

Routing vs ARP

Routing
  → determines next-hop IP

ARP
  → resolves next-hop IPv4 address to MAC

Packet vs Frame

IP packet/datagram
  → network layer

Ethernet frame
  → link layer

TCP vs IP

TCP
  → end-to-end transport behavior

IP
  → packet delivery across networks

Switch vs Router

Switch
  → MAC / frame forwarding

Router
  → IP / packet forwarding

41. Core Packet Journey

Suppose Host A sends data to Host B on another network.

Application data
      ↓
TCP/UDP header added
      ↓
IP header added
      ↓
Routing determines next hop
      ↓
ARP resolves next-hop MAC
      ↓
Ethernet frame sent to router
      ↓
Router examines destination IP
      ↓
Routing lookup
      ↓
New link-layer frame
      ↓
Destination network
      ↓
Host B

The critical distinction is:

End-to-end IP destination:
    B

Current-link Ethernet destination:
    next hop

42. Specialist Mental Model

When analyzing any networking problem, ask:

1. Which layer is involved?
        ↓
2. What address identifies the endpoint?
        ↓
3. What is the next hop?
        ↓
4. Which protocol is responsible?
        ↓
5. What packet/frame is actually transmitted?
        ↓
6. Which resource/state is being consumed?

For a packet going across networks:

Destination IP
      ↓
Routing
      ↓
Next-hop IP
      ↓
ARP
      ↓
Next-hop MAC
      ↓
Ethernet frame
      ↓
Router
      ↓
Repeat for next link

43. Book-to-Topic Map

Topic	Primary source
Internet architecture	Kurose & Ross, Ch. 1
Protocols	Kurose & Ross, §1.1.3
Packet switching	Kurose & Ross, §1.3
Delay/loss/throughput	Kurose & Ross, §1.4
Layering/encapsulation	Kurose & Ross, §1.5; Forshaw Ch. 1
HTTP	Kurose & Ross, Ch. 2
DNS	Kurose & Ross, Ch. 2; Du Ch. 18 security material
TCP	Kurose & Ross, Ch. 3; Du Ch. 16
UDP	Kurose & Ross, §3.3; Nmap TCP/IP Reference
IPv4	Kurose & Ross, Ch. 4; Nmap TCP/IP Reference
Routing/forwarding	Kurose & Ross, Ch. 4–5
ICMP	Kurose & Ross, Ch. 5; Nmap TCP/IP Reference
Ethernet	Kurose & Ross, Ch. 6
ARP	Kurose & Ross, §6.4.1; Du ARP attack material
Ports / scanning	Nmap, Ch. 4–5
Packet capture / protocol analysis	Forshaw, Ch. 1–3; Du Ch. 15
Resource exhaustion / DoS	Forshaw, Ch. 9
Netfilter / iptables	Purdy
Connection tracking	Purdy
NAT implementation	Purdy
TCP attacks / SYN flooding	Du, Ch. 16
Firewalls	Purdy; Du, Ch. 17
IP fragmentation attacks	Du; Nmap fragmentation material

44. Exact References

Kurose & Ross

James F. Kurose and Keith W. Ross, Computer Networking: A Top-Down Approach, 8th ed., Pearson, 2020

Relevant sections:

Chapter 1, §1.1 — What Is the Internet?
§1.1.3 — What Is a Protocol?
§1.3 — The Network Core
§1.3.1 — Packet Switching
§1.4 — Delay, Loss, and Throughput
§1.5 — Protocol Layers
§1.5.1 — Layered Architecture
§1.5.2 — Encapsulation
§1.6 — Networks Under Attack
Chapter 2, §2.2 — HTTP
Chapter 2, §2.4 — DNS
Chapter 3, §3.3 — UDP
Chapter 3, §3.5 — TCP
Chapter 4, §4.1 — Network Layer Overview
Chapter 4, §4.2 — What's Inside a Router?
Chapter 4, §4.3 — IP
§4.3.1 — IPv4 Datagram Format
§4.3.2 — IPv4 Addressing
§4.3.3 — NAT
Chapter 4, §4.5 — Middleboxes
Chapter 5, §5.2 — Routing Algorithms
Chapter 5, §5.6 — ICMP
Chapter 6, §6.4.1 — ARP
Chapter 6, §6.4.2 — Ethernet
Chapter 6, §6.4.3 — Link-Layer Switches

Warning

The detailed IPv4 fragmentation discussion was removed from the main text of the 8th edition. Do not cite older-edition fragmentation pages as 8th-edition content.

Gordon Lyon — Nmap

Gordon Lyon, Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning, Nmap Project, 2009

Relevant material:

TCP/IP Reference — IPv4, TCP, UDP, ICMP packet structures
Chapter 3 — Host Discovery — ICMP, TCP SYN/ACK, UDP, ARP
Chapter 4 — Port Scanning Overview — ports and port states
Chapter 5 — Port Scanning Techniques — TCP behavior and UDP scanning
Firewall/IDS Evasion and Spoofing — fragmented packets, MTU, DF, fragment offsets
Subverting Intrusion Detection Systems — fragment assembly and IDS behavior

Official book: https://nmap.org/book/

James Forshaw

James Forshaw, Attacking Network Protocols: A Hacker's Guide to Capture, Analysis, and Exploitation, No Starch Press, 2017

Relevant material:

Chapter 1 — The Basics of Networking
Network architecture and protocols
Internet protocol suite
Data encapsulation
Headers, footers, and addresses
Data transmission
Network routing
Network protocol analysis
Chapter 2 — Capturing Application Traffic
Chapter 3 — Network Protocol Structures
Chapter 9 — The Root Causes of Vulnerabilities
Denial-of-Service
Memory exhaustion
Storage exhaustion
CPU exhaustion
Algorithmic complexity

Gregor N. Purdy

Gregor N. Purdy, Linux iptables Pocket Reference, O'Reilly Media, 2004

Relevant material:

Introduction — Netfilter and iptables
Concepts — tables, chains, rules, matches, targets
Packet Flow — PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING
Connection Tracking
Network Address Translation
Stateless and Stateful Firewalls
Internet Protocol match options, including -f / --fragments

Wenliang Du

Wenliang Du, Computer & Internet Security: A Hands-on Approach, 2nd ed.

Relevant material:

IP and fragmentation material — IPv4 fragmentation, reassembly, Ping of Death, Teardrop, Tiny Fragment Attack
Chapter 15 — Packet Sniffing and Spoofing
Chapter 16 — TCP Attacks, including SYN flooding and SYN cookies
Chapter 17 — Firewall, Netfilter, iptables
Chapter 18 — DNS and attacks

45. Final Revision Sheet

NETWORKING BASICS
=================

Five layers:
    Application
    Transport
    Network
    Link
    Physical

Addressing:
    Port → application endpoint
    IP   → network-layer addressing
    MAC  → local-link addressing

Protocols:
    HTTP / DNS
    TCP / UDP
    IP / ICMP
    Ethernet / ARP

ROUTING:
    Destination IP
        ↓
    routing table
        ↓
    longest-prefix match
        ↓
    next hop / interface

ARP:
    next-hop IP
        ↓
    ARP
        ↓
    next-hop MAC

ENCAPSULATION:
    Application data
        ↓
    TCP/UDP segment
        ↓
    IP datagram
        ↓
    Ethernet frame

SAME NETWORK:
    IP destination = B
    MAC destination = B
    Router not required

DIFFERENT NETWORK:
    IP destination = B
    MAC destination = next hop/router
    Router forwards packet

ROUTER:
    receive frame
        ↓
    inspect IP destination
        ↓
    routing lookup
        ↓
    outgoing interface
        ↓
    new link-layer frame

SECURITY:
    ARP → ARP cache poisoning
    IP  → spoofing / fragmentation attacks
    TCP → SYN flooding / SYN cookies
    Firewall → filtering / Netfilter / iptables