Hello everyone. Welcome back in this playlist
section will take a deep dive into the network. Protocols
such as TCP and UDP and Sumo. So,
in part one, we'll be taking a look at ECP first
part by the UDP.
So as we have looked at in a previous module as
to, how does a TCP session is being maintained?
So TCP is a connection-oriented protocol. That
means it will create the history as
to what the request was and ensure
that packets are being delivered in a timely fashion. So
just to reiterate the TCP handshake, is
a three-way handshake in which the first step the
client will send out syn packet, which
will have a random value X, just to initiate the connection.
Followed by talk knowledge that particular request, the
server will send back seen an attack in
which the app could be limited by value. 1
and sin will have understood random number and
order to finally confirm the
connection to client will again acknowledge was
knowledgeable and packet with an
increment value of y plus 1. So
now let's try to figure out, how can we actually analyze
using the tools?
You can see, I have a tool called Wireshark that
I will be using in order to analyze the TCP packets.
So my shop is nothing but a packet capture
tool which can be used over the network to
capture draw traffic and this particular tool
will actually segregate each of those requests and
give us more addition Commission.
This is something very similar to
a proxy tool that we can use for web browsers as
well, which are actually sniff out the web traffic such
as top speed of Fiddler. Let's
try to focus on the first three requests over here.
It's what I've tried for your is that I've actually
looked at an entire TCP stream connection. So
this is the first particular packet that I have on
my packet capture.
So as we can see, we have all
the three particular handshake in place. That is
the same packet followed by the scene
and back.
And the last again being an act packet. That is
a three-way handshake.
This is the particular header sequence that we can see
who you that has the source port and the
recession Port of those communication between two particular eyepiece. So,
if you look at the first sequence 0,
that is something known as a relative sequence
number. The reason particular
tool is showing the degree sequence. Number is
just for human readable form.
In actual practice, we will have a huge pseudo random number
that will be used for the network. It
is something that makes it very difficult and interesting for
the network. In order to perform any session. Hijacking. So
if we want to actually see the raw sequence
number, so what can do is that just go to
edit?
Preferences.
Protocols and scroll all the
way down to TCP.
Once you go to TCP, we see a particular option that
says rate of sequence numbers. Just try to uncheck
this box.
Just let us click on, okay.
Now what we see is a pseudo random
number. So that is how a particular
value as we increment. I to 1. If you see in
this particular, second request was intact. So the logic to
remain the same. We're sequence, packet
will have a pseudo random number in order to make the session ID,
quite unique and record backward would
be incremented by 1. And similarly, on
the last packet. You can see an ack packet
would be granted by one.
This is something we can actually use to analyze. And
for each of those TCP streams. You can actually
if you want to understand how the companies are really
happening. You can just click on a particular packet and
just click on follow. And the TCP stream that
is how you can actually see the raw packet in place.
So based on the traffic, this is since is something that
is being encrypted over SSL and TLS. We
see that we are not able to read actual
data, but for normal scenarios, there
is a place where a non-secure protocols
such as FTP or
an HTTP protocol is being used. That
is somewhere. We can actually see the raw packets in place and
we can actually read what data is being
transferred between both of those assets over
there.
Cool.
Moon covered. Let's look at UDP protocol.
So in contrast seed, TCP itself, this
is the conditions less protocol and in base, the data is
sent over the connection automatically.
Unlike PCP. There's no proper communication in
which there will be no acknowledgement or anything.
Once the client sends a request. So
will actually start bombarding with the response and
just hoping with the fact that the data just reaches client.
This protocol is actually needed in terms as
compared to TCP because there are many protocols
that would need a faster data services,
such as DNS tftp or
corrected example, we can focus on video
stream. So these have to be real time
in such a way that all the packets are
sent back to the client as soon as possible.
Let's take a look at again, over the wash cycle itself. How
does one actually figure out, figure out or
UDP packet? Or the search bar?
You can just type our UDP.
What is that do is that it will list out all the protocols that
are working over? UDP.
So unlike TCP, we can see that a UDP packet is quite
small in beta cells. Eight, bytes in the header and
only four fields. That
would be your Source. Port destination, port and
the length of the data itself. That's one where
the packet which will actually use to check the checksum.
So checksum is just to calculate if all
the data has been sent as it is or if
they have been tampered.
But if you see in this particular scenario, it shows that it
is unverified. So again, let's go back
to edit.
Preferences.
Protocols, scroll down all the way
to UT p.
So we do see an option, which says validate
the you to pick Jackson. So let's just click on
it.
So once we just clicked on it, we can see. Now it is able to
actually calculate the checksum. This is something that
will actually validate the data saying if someone
has actually tampered it or not.
Same time if you want to figure out if which Protocols are
actually using UDP, we can just click on the YouTube
itself and just apply as
column. So which will actually say
if a particular protocol over the sniffed
packet itself is actually using you to be
alone.
So just a summary to the section PCP is
always reliable and it will follow a three-way handshake. This
is used in most of the cases where
We need to ensure that connection is
actually reliable weather. Data is actually arriving on
time and in sequence.
And UTP is something that is being used
for more, offer fast data transmission. So
that means that the application layer
is the one which will have to take care of
all the error control or the sequence of data to
something that the protocol itself will not take.
Edible section. Thank you.