In this section we will analyze a specific example that involves a communication flow (i.e., an FTP Request) between two network devices, specifically an FTP client and an FTP server, as depicted in Figure 1.7 below:
Figure 1.7 – Traffic Flow Example
| Note: This example presents an FTP Request packet but the specific Application Layer information is not relevant in analyzing the overall layer structure in a generic packet.
|
Traffic flow in this example will be analyzed from the perspective of the TCP/IP layers, as inspected by traffic analyzer software (Wireshark in this case) that captures packets as they are transmitted over the wire between the two devices.
Figure 1.8 – Traffic Analysis of the Overall Layer Structure
Figure 1.8 above shows the overall TCP/IP layers as presented by the traffic analyzer, with the Network Access Layer divided into the Physical Layer and the Data Link Layer. Each line in the output above represents a specific TCP/IP layer, as follows:
- First line: Physical Layer
- Second line: Data Link Layer
- Third line: Network Access Layer
- Fourth line: Transport Layer
- Fifth line: Application Layer
Next, each layer will be described in detail as it is presented by the traffic analyzer, starting with the Physical Layer.
Traffic Analysis – Physical Layer
Figure 1.9 – Traffic Analysis of the Physical Layer
The Physical Layer fields in Figure 1.9 above contain information about the actual packet signaling and bits as they are passed over the wire. Of particular importance is the total number of bits included on the first line, which is 576 bits. The remaining output in Figure 1.9 is not relevant at the moment.
Traffic Analysis – Data Link Layer
Figure 1.10 – Traffic Analysis of the Data Link Layer
The Data Link Layer presented in Figure 1.10 above shows the following important Layer 2 (Ethernet in this case) information:
- Destination device MAC address (Layer 2 address): 00:ff:58:fd:fa:0b (FTP server)
- Source device MAC address (Layer 2 address): 00:ff:57:fd:fa:0b (FTP client)
- EtherType: 0x0800, indicates which protocol is encapsulated in the payload of the Ethernet Frame (IPv4 in this case)
Traffic Analysis – Network Access Layer
Figure 1.11 – Traffic Analysis of the Network Access Layer
As shown in Figure 1.11 above, Layer 3 contains relevant information about the Network Access Layer protocol used, which is IPv4 in this case. The information structure of Layer 3 correlates with the IPv4 packet structure that will be presented in subsequent sections. This includes IP addressing information and other Layer 3 overhead:
- Internet protocol version: 4 (identifying IPv4)
- Header length
- Differentiated Services field (QoS marking)
- Total packet length
- Identification, flags, and fragment offset
- TTL (Time To Live) information
- Transport Layer protocol: TCP in this case
- Header checksum
- Source IP address: 10.7.0.6 (FTP client)
- Destination IP address: 192.168.1.250 (FTP server)
Traffic Analysis – Transport Layer
Figure 1.12 – Traffic Analysis of the Transport Layer
As shown in Figure 1.12 above, the Transport Layer contains information about the Layer 4 protocol in use: TCP in this case. Because TCP is a reliable protocol, it uses the overhead of sending sequence numbers and acknowledgements. The tracking information includes the following fields:
- Source Port Number (random high port number)
- Destination Port Number (FTP port 21)
- Sequence Number
- Acknowledgement Number
- Window Size
- Flags
- Checksum
| Note: Port numbers are assigned by the Session Layer when the transmission parameters are negotiated to ensure that the data goes to the proper application on the destination device.
|
Traffic Analysis – Application Layer
Figure 1.13 – Traffic Analysis of the Application Layer
The Application Layer contains relevant information related to the specific application used (i.e., service provided for the user) and the specific packet type, which is an FTP Request in this case.