Rechnernetze und -Organisation Michael Hutter Karl C. Posch.

Größe: px

Ab Seite anzeigen:

Download "Rechnernetze und -Organisation. 2010 Michael Hutter Karl C. Posch. www.iaik.tugraz.at/content/teaching/bachelor_courses/rechnernetze_und_organisation/"

Gabriel Kappel
vor 8 Jahren
Abrufe

1 und -Organisation 2010 Michael Hutter Karl C. Posch 1 Overview - Application-Layer Protocols - Hypertext Transfer Protocol (HTTP) - Automatic Network Configuration (DHCP) - Post Office Protocol (POP) - Internet Message Access Protocol (IMAP) - Network Address Translation - Network Security - Firewalls - Intrusion Detection System 2 1

Protocols - Hypertext Transfer Protocol (HTTP) - Automatic Network Configuration (DHCP) - Post Office

2 Application-Layer Protocols HTTP FTP DHCP DNS Application Layer TCP UDP Transport Layer IP Internet Layer Ethernet FDDI Token Ring Link Layer Application-layer protocols are based on lower-level protocols 3 Hypertext Transfer Protocol (HTTP) - Used to transport data over a network - Transmit websites over the World Wide Web - Text-oriented protocol - Client-server model (request-response) - Client requests for a website from a web server - Web server answers with an HTTP response - HTTP Client Request GET /index.html HTTP/1.1 Host: - HTTP Server Response HTTP/ OK Server: Oracle-Application-Server-10g OracleAS-Web-Cache-10g/ ETag: "1b4b77-1ff-4ab08b5e" Content-Type: text/html Message header <CRLF> Message body Last-Modified: Wed, 16 Sep :53:18 GMT Connection: Close Content-Length: 511 Date: Tue, 18 May :27:15 GMT Accept-Ranges: bytes <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" " <html> </html> 4 2

Client requests for a website from a web server - Web server answers with an HTTP response - HTTP Client Request GET /index.html HTTP/1.1 Host: www.tugraz.at - HTTP Server Response HTTP/1.

3 Example - Telnet - Command-line interface tool to establish a TCP connection - Based on a reliable transport protocol (typ. TCP) - HTTP/1.0: for each packet, a TCP connection is established and closed - HTTP/1.1: reuse of the connection for several transmissions (faster) - Common request operations - GET: Read a resource (data is part of the URL, e.g. /index.html?test=123) - POST: Used to send data to the server (data is part of the request message) - OPTIONS: Lists the allowed features of the server - HEAD: Transmits only the message header - PUT: Can be used to store a website on the server - DELETE: Used to delete a resource - TRACE: The sent message is simply returned by the server - CONNECT: Used by proxy server to establish a SSL connection - Web Browsers (Clients) - Lynx, Firefox, Internet Explorer, Opera, 5 Automatic Network Configuration - Dynamic Host Configuration Protocol (DHCP) - Automatic network configuration of clients - Clients retrieve IP address, netmask, gateway, - Based on the UDP protocol - DHCP server (UDP port 67), clients listen on UDP port 68 - DHCP simplifies network administration - Plug n Play network configuration - Client-server model 1) Client sends a broadcast message (DHCPDISCOVER) 2) Server responds with the configuration information (DHCPOFFER) 3) Client sends a request to the server (DHCPREQUEST) 4) Server reserves an IP address for some lease time and acknowledges the reservation to the client (DHCPACK) 6 3

1: reuse of the connection for several transmissions (faster) - Common request operations - GET: Read a resource (data is part of the URL, e.g. /index.html?

4 Post Office Protocol (POP) - Protocol used to retrieve s from a mail server 1) The mail server listens on port 110 2) A client connects to the mail server 3) Messages are retrieved and stored on the client machine 4) The messages are deleted on the server 5) Connection is closed - It uses the TCP protocol for client-server connection - Transmission of username and password in plaintext - Use TLS/SSL for encrypted authentication - Current standard has version 3 (POP3) 7 Internet Message Access Protocol (IMAP) - Similar to POP3 but provides - more features with increased complexity - s are left on the server until explicit deletion - IMAP supports folder structure (POP3 does not) - Partial fetch - Instead of downloading the entire message, only individual parts are transmitted (e.g. without attachments) - Allows multiple client access - It can handle concurrent client connections and modifications - Message search on the server side - Current version is IMAPv4. 8 4

TLS/SSL for encrypted authentication - Current standard has version 3 (POP3) 7 Internet Message Access Protocol (IMAP) - Similar to POP3 but provides - more features with increased complexity -

5 Network Address Translation (NAT) - A method that is typically implemented in routers - Allows mapping of many private IP addresses to a small number of public IP addresses - Large networks can access the Internet by needing only a few IP addresses - Solution to the problem of the small IPv4 address space - Also known as IP masquerading - Breaks end-to-end connection - Internal network nodes do not know the external IP address - Port and Address Translation (PAT) - Special form of NAT where also port numbers are mapped - A single public IP address is used by many private LAN hosts 9 How does NAT work? Destination IP Client Source IP NAT-enabled Router Web server 1) A client in a private network would like to send a HTTP request to a public web server 2) Client sends a TCP packet with destination IP address of the web server and MAC address of the NAT router 10 5

nodes do not know the external IP address - Port and Address Translation (PAT) - Special form of NAT where also port numbers are mapped - A single public IP address is used by many private LAN hosts

6 Client How does NAT work? Dest. IP+port Destination IP NAT-enabled router 80 Source IP+port NAT/PAT table Source IP Web server 3) The NAT router modifies the source IP address of the packet and makes a (IP and port) mapping entry into the NAT table. It can map many private addresses ( x.x) to one public IP address ( ) NAT port 11 Client How does NAT work? Destination IP NAT-enabled Router Source IP Web server 4) The web server answers with an HTTP response 12 6

12 Web server 3) The NAT router modifies the source IP address of the packet and makes a (IP and port) mapping entry into the NAT

7 Client How does NAT work? Destination IP Source IP Dest. IP+port NAT-enabled Router 80 Web server 5) The NAT router modifies the destination IP of the packet by making a NAT table lookup. Source IP+port NAT/PAT table NAT port 13 Firewalls - Specially programmed router that connects two networks - Provides protection against - unwanted remote access (information theft, modifications,) - transfer of infected programs (trojans, viruses, ) -...attacks (denial-of-service, buffer overflows, ) - Deny or permit access using policies and rules - Packet filtering - Inspection of connection states - Content filtering - Allow the monitoring, logging, and notification of events (alerts) 14 7

Source IP+port 2591 4593 NAT/PAT table NAT port 13 Firewalls - Specially programmed router that connects two networks - Provides protection against - unwanted remote access

8 Intrusion Detection System (IDS) - Used to detect attacks on networks or hosts - Network traffic is analyzed - Network data is compared with signatures of existing attacks - Heuristic methods are applied to detect intrusions and anomalies - If an attack is identified, an alert is given - Intrusion Prevention Systems (IPS) try to prevent the attack instead of giving an alert. - E.g. Packets are thrown away, connection termination, - Try open-source program Snort (IDS+IPS) 15 What should you know by now? Understand the terms; understand the connections between them; be able to operate with them: Different Application-layer protocols HTTP Message structure Request operations GET, POST, HEAD, TRACE, Telnet Automatic Configuration of networks using DHCP POP3 vs. IMAP Partial Fetch NAT IP masquerading NAT Table Port and Address Translation Firewalls Firewall Protection Packet filtering Content filtering Intrusion Detection Systems Intrusion Prevention Systems 16 8

ven - Intrusion Prevention Systems (IPS) try to prevent the attack instead of gi

Ähnliche Dokumente

Cameraserver mini. commissioning. Ihre Vision ist unsere Aufgabe

Cameraserver mini. commissioning. Ihre Vision ist unsere Aufgabe Cameraserver mini commissioning Page 1 Cameraserver - commissioning Contents 1. Plug IN... 3 2. Turn ON... 3 3. Network configuration... 4 4. Client-Installation... 6 4.1 Desktop Client... 6 4.2 Silverlight