
Explore network encapsulation by showing how a message is wrapped with multiple headers—GDP header, DCP header, IP header—and the data, protecting the information as it travels to the server.
Explain the mac header structure, including preamble, start of frame delimiter, destination and source mac addresses, payload, and crc, with six-octet fields and size limits.
Explains how arp resolves ip addresses to mac addresses through broadcast requests and replies, updating the arp table.
Learn how arp spoofing exploits broadcasted addresses by an attacker replying to broadcasts, posing as a legitimate device and altering the IP table.
Learn how IP routing uses routing tables to forward packets, assigns destination IP addresses, and determines the next hop to deliver data between machines.
Exposes the security problems in IP packets, including unprotected packets, spoofed source addresses, unencrypted IP headers, unauthenticated routing information, and risks like disruption and denial of service.
TCP identifies two types of OPEN calls:
Active Open. In an Active Open call a device (client process) using TCP takes the active role and initiates the connection by sending a TCP SYN message to start the connection.
Passive Open A passive OPEN can specify that the device (server process) is waiting for an active OPEN from a specific client. It does not generate any TCP message segment. The server processes listening for the clients are in Passive Open mode.
Three-way Handshake
Step 1. Device A (Client) sends a TCP segment with SYN = 1, ACK = 0, ISN (Initial Sequence Number) = 2000.
The Active Open device (Device A) sends a segment with the SYN flag set to 1, ACK flag set to 0 and an Initial Sequence Number 2000 (For Example), which marks the beginning of the sequence numbers for data that device A will transmit. SYN is short for SYNchronize. SYN flag announces an attempt to open a connection. The first byte transmitted to Device B will have the sequence number ISN+1.
Step 2. Device B (Server) receives Device A’s TCP segment and returns a TCP segment with SYN = 1, ACK = 1, ISN = 5000 (Device B’s Initial Sequence Number), Acknowledgment Number = 2001 (2000 + 1, the next sequence number Device B expecting from Device A).
Step 3. Device A sends a TCP segment to Device B that acknowledges receipt of Device B’s ISN, With flags set as SYN = 0, ACK = 1, Sequence number = 2001, Acknowledgment number = 5001 (5000 + 1, the next sequence number Device A expecting from Device B)
Analyze how a TCP sync flood attack floods a server with sync requests, causing long waiting times and queued responses, slowing the server and preventing legitimate clients from connecting.
The DNS resolver will almost invariably have a cache (see above) containing recent lookups. If the cache can provide the answer to the request, the resolver will return the value in the cache to the program that made the request. If the cache does not contain the answer, the resolver will send the request to one or more designated DNS servers. In the case of most home users, the Internet service provider to which the machine connects will usually supply this DNS server: such a user will either have configured that server's address manually or allowed DHCP to set it; however, where systems administrators have configured systems to use their own DNS servers, their DNS resolvers point to separately maintained name servers of the organization. In any event, the name server thus queried will follow the process outlined above, until it either successfully finds a result or does not. It then returns its results to the DNS resolver; assuming it has found a result, the resolver duly caches that result for future use, and hands the result back to the software which initiated the request.
Explore how global name resolution uses a recursive dns process, querying local and root name servers to translate a domain into its ip address.
This channel will help you to grow further...
This course will tell you about different types of attacks that are happened over the internet... how someone exploit others profiles and their private data... its will teach you about spoofing,sniffing and many other types of attacks. encapsulation of data, header files and their details. from intermediate to advance level.. so this course is for intermediate and advance levels people.