CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [45]
The following sections delve into issues related to TCP/IP and security. Many of these issues will be familiar to you if you’ve taken the Network+ or Server+ exam from CompTIA. If there are any gaps in your knowledge of the topics, however, be sure to read the sections carefully.
Working with the TCP/IP Suite
The TCP/IP suite is broken into four architectural layers:
■ Application layer
■ Host-to-Host or Transport layer
■ Internet layer
■ Network Interface layer
Computers using TCP/IP use the existing physical connection between the systems. TCP/IP doesn’t concern itself with the network topology, or physical connections. The network controller that resides in a computer or host deals with the physical protocol, or topology. TCP/IP communicates with that controller and lets the controller worry about the network topology and physical connection.
In TCP/IP parlance, a computer on the network is a host. A host is any device connected to the network that runs a TCP/IP protocol suite, or stack. Figure 2.6 shows the four layers in a TCP/IP protocol stack. Notice that this drawing includes the physical, or network, topology. Although it isn’t part of the TCP/IP protocol, the topology is essential to conveying information on a network.
FIGURE 2.6 The TCP/IP protocol architecture layers
The four layers of TCP/IP have unique functions and methods for accomplishing work. Each layer talks to the layers that reside above and below it. Each layer also has its own rules and capabilities.
The following sections discuss the specific layers of the TCP/IP protocol as well as the common protocols used in the stack and how information is conveyed between the layers. I also discuss some of the more common methods used to attack TCP/IP-based networks. Finally, I briefly discuss encapsulation, the process used to pass messages between the layers in the TCP/IP protocol.
The Application Layer
The Application layer is the highest layer of the suite. It allows applications to access services or protocols to exchange data. Most programs, such as web browsers, interface with TCP/IP at this level. The most commonly used Application layer protocols are as follows:
Hypertext Transfer Protocol Hypertext Transfer Protocol (HTTP) is the protocol used for web pages and the World Wide Web. HTTP applications use a standard language called Hypertext Markup Language (HTML). HTML files are normal text files that contain special coding that allows graphics, special fonts, and characters to be displayed by a web browser or other web-enabled applications.
File Transfer Protocol File Transfer Protocol (FTP) is an application that allows connections to FTP servers for file uploads and downloads. FTP is a common application used to transfer files between hosts on the Internet.
Simple Mail Transfer Protocol Simple Mail Transfer Protocol (SMTP) is the standard protocol for e-mail communications. SMTP allows e-mail clients and servers to communicate with each other for message delivery.
Telnet Telnet is an interactive terminal emulation protocol. It allows a remote user to conduct an interactive session with a Telnet server. This session can appear to the client as if it were a local session.
Domain Name Service Domain Name Service (DNS) allows hosts to resolve hostnames to an Internet Protocol (IP) address. IP is discussed in the section on the Internet layer.
Routing Information Protocol Routing Information Protocol (RIP) allows routing information to be exchanged between routers on an IP network.
Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a management tool that allows communications between network devices and a management console. Most routers, bridges, and intelligent hubs can communicate using SNMP.
Post Office Protocol Post Office Protocol (POP) is a protocol used in many e-mail systems. It allows for advanced features and is a standard interface in many e-mail servers. POP is used