Before you start to learn about hacking and all of the fun stuff with cybersecurity First you need to
have a good understanding about network protocols and addresses that are used in networking.
So what is a network.
Networks are a collection of nodes that communicate with each other.
And now were can be smaller in size like your home network or large like the Internet network models
are used to standardize how networked devices communicate with each other.
Each network model layer plays a different role to help data forward out of point.
Now we're interface cards onto the network.
There are two types of network models.
TCAP IP and oocyte both models have the same objective but they have some differences including the
types of layers that are used as you can see each layer has different sets of protocols protocols can
be thought of as different languages that are used between network devices at each layer.
Now let's take a look at each of these layers to help you understand the traffic flow for a network
device.
At the application layer data like web applications and email are created application layer protocols
like HTP are used to sign communication between endpoint applications.
In this example you can see that the HTP protocol was used to ask the Web server for the Web site's
home page.
Once the data has been created it is passed through each model layer to prepare the data to be transferred
onto the network TZP and UDP our transporter protocols that are used for host to host communication
these protocols use port numbers for sockets to control which applications received data on endpoints.
Once TCAP or UDP is used to establish a connection between hosts then the higher layer data like TTP
can be sent to an TZP is considered to be a reliable protocol to handle host connections since it uses
acknowledgements and requires a three way handshake to establish a connection.
UDP is unreliable transport protocol since it does not track the state of a connection.
Here's a list of well-known TCAP and UDP ports.
Allée cybersecurity engineer you should know what ports applications use so that you can secure vulnerable
applications.
In fact most firewall filtering is based on TCAP and UDP port numbers at the network layer.
IP addresses are used.
These later three addresses are used to route IP packets from one network to another between routers.
They serve the same purpose as phone numbers.
When someone wants to call you they type in the phone number that is assigned to your phone and the
phone call is routed all the way through the phone network to you and your phone rings.
Just like a phone call when a computer wants to talk to a network device like a printer.
It points to the IP address to connect every network device needs an IP address just like every phone
needs a phone number.
IP addresses can be public or private depending on if they are on an internal network like a home or
business or the internet
once IP addressing information is added to a packet.
It is then wrapped into an Ethernet frame the Internet frame is responsible for error checking and forging
data after it has been routed onto a LAN.
Frames rely on Ethernet addresses called MAC addresses to deliver frame data MAC addresses are globally
unique addresses that are assigned to network interface cards.
Once data has traveled through each layer we end up with an encapsulated frame that contains all of
the higher level information once the frame is ready.
It is settled down to the physical layer the physical layer is responsible for sending our data ones
and zeroes as signals out of the network interface card NICS can connect via wire or wireless.
OK so now what we're going to do is fire up my computer and go to a Web site and then open up a packet
capture software so that I can show you what each layer looks like in a real world connection on a network.
So I'm going to open up my wireshark software here.
Boyer's shark is a free pass to capture software and it will actually show you broad data for what's
happening at each of your network model layers.
If you check the resources for this video lecture you will see that I posted a link to the wireshark
Web site so that you can download the wireshark software.
If you don't already have Ok so the first thing has to do with wireshark to capture data is choose which
network interface card you want to capture data on.
So my layer 1 network interface that I'm going to use is my wireless connection besides the fact I know
I'm connected to the wireless.
I can see that primarily my network data is traversing this network interface card.
So I'm going to double click on that and now I have a packet capture open up and it's capturing all
of my traffic so I'm going to launch a Web browser here just by going to being dot com I have created
network data on my computer Susan I know that my connection to being dotcom was a HTP connection.
I'm going to filter with wireshark which does have some like pre-built filters if you hit this filter
option and it will only show you packets that match that filter.
So I'm going to filter to HTP and it looks like here's my connection to being non-comp so I've clicked
on this traffic flow so this shows that for my IP address of my wireless network interface card of 10.0
the 11. Loven it went to this destination IP address.
So this is back to the analogy about making a phone call.
I have my network address as my source and I'm sending my request to this web servers IP address so
that's all I'm getting from point A to point B from my house all the way across the Internet all the
way to the web server at being dot com.
So now that I have that packet selected.
If you look down below here you can actually drill down into each network model layer.
So we already know for layer 1.
I'm using my wireless network interface card.
Well let's jump to layer 2 so layer 2.
It shows that here's my source and destination MAC address so we have our layer to frame that was built
here with my network interfaces.
MAC address and then my Gateway's MAC address and then down to layer 3.
We have our IP address information to route across the network and then here we have our layer for information
which HTP uses TCAP as a transport protocol and uses the well-known TCAP port 80.
So my computer picked a random source poor.
And then since I knew I wanted to talk to the HTP application on the being web server I set my destination
TCAP port to port 80.
And here you see some of the application data that I requested when I sent traffic from my computer
to that server.
In addition to wireshark if you're on a Windows Mac or Linux computer there are certain commands that
you can run to verify your network information on your computer.
I am on a Windows computer and I can run IP config and that commands are going to show me my IP address
for my wireless network interface card.
And if I do IP config for it all I could actually find out more information like my my mac address for
my wireless network interface card up here somewhere right here.
So this shows me my really my layer one layer 2 Layer 3 information for my puter.
OK so now that you should have a pretty good understanding of the networking fundamentals and the next
video we're going to take a look at some of networking protocols that can be used in network attacks.