Join Mike Chapple for an in-depth discussion in this video Introducing TCP/IP, part of CompTIA Security+ (SY0-401) Cert Prep: Network Security.
- We use networks everyday, but don't often pause to reflect on what is happening under the covers to make those networks function properly. As we begin our exploration of network security, let's first talk about the basics of networking and a set of protocols known as TCP/IP. TCP/IP is an acronym that stands for Transmission Control Protocol, Internet Protocol. TCP and IP are two or the main protocols that make up all modern networks.
The Internet Protocol is responsible for routing information across networks. The name is a little deceiving, because it's not just used on the Internet. It's also used in the network, in your home or office. The main responsibilities of the Internet Protocol are providing and addressing scheme, known as IP addresses that uniquely identify computers on a network. And delivering information in chunks known as packets from their source to the correct destination. IP is what's know as a network layer protocol.
It supports other transport layer protocols that have higher-level responsibilities. The two main transport layer protocols are the Transmission Control Protocol, TCP, and the User Data Protocol, UDP. TCP is responsible for the majority of Internet traffic. It is a connection-oriented protocol, meaning that it establishes connections between two systems before transferring data. TCP is also a reliable protocol that guaranties delivery by having the destination system acknowledge receipt of every packet.
TCP's reliability makes it widely used for applications that require this guarantee delivery, such as email and websites. Because TCP is a connection-oriented protocol, systems must go through a handshaking process to create a connection before transmitting data. This process is known as the three-way handshake. TCP packets include special flags that identify packets used in this handshaking process. The SYN flag, S-Y-N, identifies packets that are requesting a new connection.
The FIN, F-I-N flag identifies packets that are requesting the closure of an existing connection. And the ACK, A-C-K flag, is used to acknowledge a SYN or FIN request. Let's look at the three-way handshake process in more detail. In the first step, the system originating the connection sends a packet with the SYN flag set. This indicates that it would like to open a connection to the destination system. The destination system receives this packet, and replies with another packet that does two things, it acknowledges the original connection request, and then asks to open a reciprocal connection in the other direction.
This packet has both the SYN and ACK flag set and is know as the SYN/ACK packet. Finally, the original system receives the SYN/ACK packet and send a final act to the destination system completing the reciprocal connection. Once the three packet sequence completes, the connection is opened, and the systems may begin exchanging data. The User Datagram Protocol, UDP on the other hand, is a much more light-weight protocol that doesn't use this three-way handshake because it is not connection-oriented.
Systems basically send data off to each other blindly hoping that it's received on the other end. UDP does not perform acknowledgements and therefore cannot guarantee delivery. UDP is often used for applications like voice and video where guaranteed delivery is not essential. Many networking theorists describe these protocols using a model known as the Open Systems Interconnection or OSI Model. This model describes networks as having seven different layers.
The first layer, the Physical layer is responsible for sending bits over the network using wires, radio waves, fiber optics and other means. The second layer, the Data Link layer, transfers data between two nodes connected to the same physical network. The third layer, the Network layer, expands networks to many different nodes. The Internet protocol works at this layer. The fourth layer, the Transport layer, creates connections between systems and transfers data in a reliable manner.
TCP and UDP are examples of Transpor layer protocols. The fifth layer, the Session layer, manages the exchange of communications between systems. The sixth layer, the Presentation layer, translates data so that it may be transmitted on a network. This layer describes how to represent a character in terms of bits, and performs both encryption and decryption. The seventh layer, the final Application layer, determines how users interact with data using web browsers and other client applications.
You won't hear much about the OSI model in practice, because it is rarely used and difficult to map to real-world networks. But you must understand these seven layers because they are covered on the security plus exam.
We are now a CompTIA Content Publishing Partner. As such, we are able to offer CompTIA exam vouchers at a 10% discount. For more information on how to obtain this discount, please download these PDF instructions.
- Working with the TCP/IP suite
- Securing switches and routers
- Configuring firewalls
- Setting up virtual private networks (VPNs)
- Detecting and preventing network intrusions
- Implementing unified threat management
- Using public and private network addressing effectively
- Segmenting networks
- Virtualization and cloud computing
- Managing secure networks