Common Protocols

Just as it is necessary to understand network design elements and their functions, understanding network protocols is absolutely critical to maintaining a secure network environment. In this section, we will look at some common protocols, what they do, and what they are used for. This section will cover the following topics:

 

• IPSec
• SNMP
• SSH
• DNS
• TLS, SSL
• TCP/IP
• FTPS
• HTTPS
• SFTP
• SCP
• ICMP
• IPv4 versus IPv6

 

IPSec

When you send important or sensitive information over a network, you want to ensure it is secure, not only on the computers that hold the data (encryption) but also while the data is en route over the network. One method of ensuring security is by encrypting the data stream using IPSec.

 

IPSec, or Internet Protocol Security, is a set of protocols that secures IP communications at the packet level. IPSec is closely related to VPN, in that it is by far the most popular technology for implementing VPNs on IP networks.

 

The IPSec standard uses three major protocols to accomplish information security: Authentication Headers (AHs) to ensure information in IP packets is not altered and to perform source authentication, but not encryption; Encapsulating Security Payloads (ESPs) for data confidentiality through encryption and source authentication, and to ensure data is not altered in transit; and Security Associations (SAs) to bundle the algorithms and data IPSec relies on to accomplish its goals, including key exchange, storage of keys, and encryption protocols.

 

AHs serve to authenticate communications only, not secure them from prying eyes. Because ESPs can provide the same level of authentication while allowing encryption, it is a much more robust IPSec security option.

 

IPSec encryption via ESPs functions at a low level, either by encrypting the contents of an IP packet and leaving the source and destination unencrypted (ESP – Transport Mode), or by encrypting the entire IP packet and sending it as the data portion of a new IP packet (ESP – Tunnel Mode).

 

IPSec supports the use of any one of multiple encryption algorithms as defined in RFC 4835, including Advanced Encryption Standard (AES) and the successor to Data Encryption Standard (DES): Triple Data Encryption Algorithm (3DES).

 

The SAs define the parameters IPSec is to use in securing communications. SAs are concerned with unidirectional data security. Therefore, connections are usually secured by a pair of security associations. IPSec relies on the Internet Security Association and Key Management Protocol (ISAKMP) to set up SAs, and exchange keys and manage the resulting SAs. ISAKMP does not specify any particular protocol for key exchange, but is often accomplished by use of a pre-shared key, or implementation of Internet Key Exchange (IKE and IKEv2) or other key exchange algorithms. Each SA will define the encryption algorithms and keys to be used for a single connection.

 

Because IPSec functions without regard to the content of the IP packets, it can be used to secure communication between hosts and networks for any protocol that can be routed over the IP. IPSec can support authentication-only, encryption-only, or authentication with encryption. It is a powerful tool for securing IP communications.

 

SNMP

Simple Network Management Protocol (SNMP) is a protocol for collecting and sending information regarding network-connected devices. SNMP uses UDP ports 161 and 162. SNMP does not specify specific information to be collected, but it does specify the format in which information is to be sent. The primary components of an SNMP system are managed devices, agents, and a network management system.

 

An agent records information for a managed device in a Management Information Base (MIB), which can be queried by the network management system. Agents listen on port 161 for requests for information and respond on port 161 to whatever port made the query. Agents may also send updates that are not directly requested by the manager (known as traps) from any available port to port 162.

 

The Simple Network Management Protocol is just that, simple. Information is collected in a management information base by an agent and is sent in clear text when requested by a network management system.

 

SSH

Secure Shell (SSH) uses public-key, or asymmetric, encryption to secure communication between two hosts. By default, SSH runs on TCP port 22. The most common use for SSH is as a secure means of gaining access to a remote shell session. This makes SSH an excellent alternative to Telnet, which is not an inherently secure method of gaining access to a shell session.

 

Because of weaknesses in an early version of SSH, it is advisable to use only SSH-2 when communication security is important. Other uses of SSH include SFTP and SCP.

 

DNS

One of the protocols that greatly aids the Internet’s ease of use is the Domain Name System (DNS). DNS is the protocol that allows you to type a website name into your browser and be sent to a specific computer at a specific IP address. This protocol is responsible for converting hostnames into IP addresses, among other uses.

 

DNS is also responsible for mapping domain names with certain services and the addresses of the hosts responsible for providing those services. A DNS record does not only consist of an IP address and a hostname but also a record type. The following is a partial list of all the types of DNS records:

 

• A records – map hostnames to IP addresses
• MX records – map a domain name to a Message Transfer Agent (MTA) for the domain
• CNAME records – map hostnames to other hostnames
• AAAA records – map hostnames to IPv6 addresses
• PTR records – return a hostname and are commonly used for reverse DNS (mapping IP addresses to specific names)

 

DNS records also include a class entry (almost always IN, for Internet) and a Time-to-Live (TTL), which is the amount of time, in seconds, the record should be considered valid by a server that caches DNS records without refreshing. A single complete DNS record is comprised of a name, class (IN), type, data, and TTL. DNS operates over UDP port 53.

 

TLS, SSL

Secure Socket Layer (SSL) and Transport Layer Security (TLS) are protocols that can be used to encrypt and secure connection-oriented protocols, such as HTTP, SMTP, and FTP. TLS is the successor to the SSL protocol.

 

The secure communication between the client and the server is stateful, meaning it is brought up and secured, and then lasts only as long as the communication session does. This is accomplished by means of a secure handshake, wherein the client and the server agree on which encryption type to use; the client receives the server’s authentication information, which includes the server’s public encryption key; the client encrypts a random number with the server’s public key and responds; and the server and the client use the shared random number to generate any additional key material and complete the handshake.

 

SSL was first released as version 2.0, with version 1 never released. A number of security vulnerabilities led to SSL 3.0 being developed as a replacement. TLS was designed to improve on the features of SSL and improve the security of SSL. SSL has been almost completely replaced by TLS, but TLS allows for downgrading of TLS connections to SSL 3.0 in those cases a client does not support TLS.

 

Many applications that communicate over TLS use alternate port numbers and are identified with an alternate acronym and port number. HTTP, when protected by TLS or SSH, as it very often is, is referred to as HTTPS (HTTP Secure) and most commonly uses port 443.

 

TCP/IP

The Transmission Control Protocol and Internet Protocol model (TCP/IP) is the most widely used communications protocols in the world. The Internet is based on TCP/IP. All IP networks are based on TCP/IP. All networks that use TCP are based on TCP/IP. There can be some confusion when referring to TCP/IP, because TCP/IP refers to the model followed by networks and applications, not just the IP protocol and the TCP protocol.

 

In the past, it was not uncommon for different vendors to have their own networking protocol. Apple computers would run on their own network and communicate using AppleTalk, Windows and Unix computers might be on a TCP/IP network, and Novell might be on an IPX/SPX network. Now, with the ubiquity of the Internet, almost all “networked computers” are running on IP.

 

The TCP/IP model is a standardized, open, network communications model that any vendor can employ to make systems that can be interconnected.

 

The “layers” of the TCP/IP model include the Physical and Link/Data-link/Network interface Layers, often combined into one Network Interface Layer. This layer is concerned with the physical properties of the communications medium and the methods of encoding information to be sent across the physical medium.

 

The next higher layer is the Network/Internetwork/Internet Layer. This layer is concerned with logical IP addressing and routing. It allows for hierarchical routing, so that individual hosts do not need to know how to reach each other individual host, but can rely on an intermediary device to reach their destination. IP is the only protocol contemplated in the TCP/IP model.

 

The Transport Layer is concerned with the establishment of communication between two end hosts, and the passing of data between them, regardless of the physical or logical links between the hosts. This means that whether the two devices are in the same office or on opposite sides of the world, the Transport Layer will send the same data and expect the same response. This layer introduces the concept of port numbers, which can be used to track connections and route data to the correct application at the next level up. The Transport Layer protocols in the TCP/IP model are TCP (for connection-oriented communication) and UDP (for connectionless or unordered data).

 

The top layer of the TCP/IP model is the Application Layer. This layer is concerned with providing services to applications running on computers. This is the layer where user interaction occurs. Protocols that exist at the Application Layer are far too numerous to list, but they include HTTP, FTP, DNS, TFTP, SMTP, HTTPS, and many, many others.

 

FTPS

FTP-Secure (FTPS) is simply FTP utilizing a TLS/SSL connection for security. It is not the same protocol as Secure FTP (SFTP). Because FTP is a connection-oriented protocol, it can take advantage of TLS to secure both the initial TCP handshake and the data passed between the client and the server for the duration of the connection. An FTPS connection can encrypt the command channel (to protect username and password authentication data), the data channel (to protect the contents of the files being transferred), or both.

 

In much the same way TLS can be used with HTTP to form HTTPS, TLS can be used with FTP to form FTPS. FTPS operates over TCP and UDP port 989 for data and port 990 for control information.
HTTPS

HTTP-Secure (HTTPS) is HTTP utilizing a TLS/SSL connection for security. This is one of the most common uses for TLS. Using an HTTPS connection prevents eavesdroppers from viewing the information being sent or received during an HTTP session, while ensuring the identity of the server at the far end of the HTTP session.

 

Because of the many security improvements over HTTP, HTTPS is an excellent solution whenever security is required in a web session. As with any other TLS-supported application, a number of encryption algorithms can be used, and the strongest available encryption will be chosen at connection establishment. HTTPS operates over TCP port 443.

 

SFTP

Secure FTP (SFTP) is not the FTP protocol modified to make use of a different layer, but an entirely new protocol for transferring and managing files. The SFTP client assumes it is operating over a connection that is secured by another technology. Many implementations of SFTP utilize SSH tunneling to establish the connection, and then pass the SFTP data through the secure tunnel. SFTP runs over TCP port 22 (SSH) by default.

 

SCP

Secure Copy (SCP) is a protocol for securely transferring files between hosts on a network. It relies on SSH to establish a connection between the source and the destination hosts, and then transfers the file as specified. It only supports file transfer, not the additional file management operation available in SFTP. SCP runs over TCP port 22 (SSH) by default.

ICMP

Internet Control Message Protocol (ICMP) messages are not usually seen by an end-user. They are messages that are sent back to the source of an IP packet, usually to indicate errors in the flow of traffic from one point to another, such as having to route to the final host or exceeding the TTL of a packet. ICMP operates by sending an echo packet to a remote host, and the remote host responds with a reply packet.

 

A few protocols that a network administrator might use that make use of ICMP messages are ping, pathping, and tracert. ICMP packets are also known as ping packets.

 

IPv4 versus IPv6

So far, when discussing IP addressing, it was assumed that we were using Internet Protocol version 4 (IPv4). IPv4 has a 32-bit address and is represented in the format x.x.x.x, where each x represents one byte, or octet. Instead of a 32-bit address, Internet Protocol version 6 (IPv6) uses a 128-bit address written in hexadecimal notation. Hexadecimal notation uses the numbers 0 to 9 and the letters a to f so that each digit can represent up to sixteen possible combinations, or 4 bits. An IPv6 address is written in eight groups separated by colons, with four hexadecimal digits (16 bits) in each group.

 

A typical IPv4 address might be 162.155.32.65, whereas a typical IPv6 address might be 126d:eadb:eef3:0000:0000:0147:12c7. To make the presentation of IPv6 addresses easier, a number of conventions have been adopted. One is that leading 0s in any 16-bit group may be omitted. Our example IPv6 address could just as accurately be written 126d:eadb:eef3:0:0:147:12c7. Another convention is that a maximum of one time per address, consecutive colons can replace any number of groups with consecutive zeros. Thus our sample address could also be written 126d:eadb:eef3::147:12c7 .

 

In IPv6, all networks hold 2⁶⁴ hosts by default. IPv6 provides for many more addresses. Where the total address space of IPv4 is 2³² or about 4.3 billion at most, IPv6’s address space is 2¹²⁸, or approximately 3.4 x 10³⁸. Because of the immense number of devices connected to the Internet, even considering address space-saving technologies such as NAT with PAT, the number of individually addressed devices will soon exceed the available addresses in the IPv4 address space. This paucity of available addresses is the primary impetus for the move to IPv6.

 

The greatly increased address space of IPv6 will no longer support NAT. This means that internal addresses will be viewable to the outside world. Because NAT will no longer be deployed at the network boundary, it is important that firewalls allow only incoming connections as specified by the administrator. Allowing only inbound connections as necessary, instead of allowing inbound connections by default, replicates the greatest security strength of NAT.

 

The IPv6 protocol suite includes built-in support for IPSec. Though not every connection over IPv6 will be fully encrypted, the support for encryption and authentication will be there at the IP level. Right now, we think of IPSec primarily in conjunction with VPN connections. This will still be the primary use of IPSec in IPv6 for a time after the immediate rollout. IPv6 support for IPSec does not mandate the use of IPSec. The integrated support for IPSec will, however, mean that support will be available for easier implementation in the future, giving even more opportunity to secure communications.

 

IPv6 makes a number of other changes in areas such as ICMP flow control messaging, multicasting to designated device types, and dynamic address configuration. With all these changes, you can think of IPv6 as a more robust delivery system for all the traffic that we currently send over IPv4.

 

In IPv4, the default size of a network before subnetting varies depending on the class of the network. This has changed in IPv6, as the IPv6 address is divided into two parts: a 64-bit network address and a 64-bit host address.