CITS3002 Computer Networks  
prev
next CITS3002 help3002 CITS3002 schedule  

TCP/IP Overview and Vulnerabilities, continued

Examining each of the four layers.....

  • the Internet layer protocols primarily consist of the Internet protocol (IP), and the Internet Control Message Protocol (ICMP) provide the actual routed delivery of messages between source and destination, and provide only a basic network management function by reporting any observed errors.

    IPv4, particularly, is vulnerable to attack and may be exploited to not deliver messages, deliver messages to the wrong destination, or 'confuse' a destination to the extent that it may stop providing any service.

    As examples, IP datagrams may be transmitted from one (attacking) host while claiming to be from another, and forged ICMP messages may make a destination network or host appear unreachable.

  • physical layer protocols are not strictly part of the TCP/IP suite, but define how packets or frames are received via hardware, and provided to the IP (software) layer above. By its nature, interface hardware must see all packets destined for, or passing by, the interface, and most hardware may be configured by software (the operating system) to report all activity seen.

    Trivially, on a shared network, an operating system (and probably some of its programs) may capture all packets that are visible on a network.

In combination, we have multiple points of vulnerability in the network protocols themselves. This is before we consider that the network makes hosts more vulnerable to remote attack.

In addition, each operating system's implementation of the TCP/IP stack has its own idiosyncrasies. Specifically, each operating system responds differently to a variety of malformed packets. Software performing protocol fingerprinting determines an operating system from the way it 'appears' externally.


CITS3002 Computer Networks, Lecture 11, Security of TCP/IP, p2, 15th May 2024.