LifesFun's 101

"The only true wisdom is in knowing you know nothing." - Socrates


Pentest Primer: Basic Networking: Protocols and OSI, TCP/IP Models

18 Nov 2024

Understanding networking protocols is like knowing the language of the internet. Protocols are what allow devices to communicate effectively across networks, and understanding them is essential for anyone pursuing cybersecurity or penetration testing.

Think of protocols as the road signs or guidelines that dictate how data should travel from one point to another. Without standardized protocols, devices from different manufacturers and running different operating systems would be unable to communicate, making the internet as we know it impossible.

What are Networking Protocols?

Networking protocols are formal standards and policies that define rules, procedures, and formats for communication between network devices. They specify how data is formatted, transmitted, received, and acknowledged across networks.

Protocols govern everything from how web browsers request web pages to how email is sent and received. They ensure that data arrives at its destination intact, in the correct order, and without corruption. Understanding protocols is crucial for penetration testing because exploiting protocol weaknesses is a common attack vector.

Networking Models: OSI and TCP/IP

Networking models provide a structured framework for understanding and implementing these protocols. They offer a blueprint that organizes the tasks and functions of networking into layers, each handling specific responsibilities. Two of the most widely used models are OSI and TCP/IP.

The OSI Model: A Theoretical Framework

The OSI (Open Systems Interconnection) model divides the networking process into seven distinct layers. While the OSI model is more theoretical than practical, it provides an excellent educational framework for understanding how networks function.

The Seven Layers of the OSI Model:

Layer 7 - Application Layer: The closest layer to the end user. This layer provides network services directly to applications. Examples include HTTP, FTP, SMTP, and DNS.

Layer 6 - Presentation Layer: Responsible for data translation, encryption, and compression. Ensures data is in a usable format and handles encoding/decoding.

Layer 5 - Session Layer: Manages sessions and connections between applications. Controls dialogues and keeps different applications’ data separate.

Layer 4 - Transport Layer: Ensures reliable data transfer with error checking and flow control. Primary protocols: TCP (connection-oriented, reliable) and UDP (connectionless, faster).

Layer 3 - Network Layer: Handles routing and forwarding of data packets across networks. IP addresses operate at this layer. Determines the best path for data to reach its destination.

Layer 2 - Data Link Layer: Provides node-to-node data transfer and handles error correction from the physical layer. MAC addresses operate here. Manages how devices on the same network communicate.

Layer 1 - Physical Layer: Deals with the physical transmission of raw bit streams over physical media (cables, wireless signals, etc.).

The TCP/IP Model: Practical Implementation

The TCP/IP (Transmission Control Protocol/Internet Protocol) model is a practical model that our computers actually use. It’s how networking actually happens on the internet and in most modern networks.

The TCP/IP model consists of four layers that map to the OSI model’s seven layers:

Application Layer: Combines OSI layers 5, 6, and 7. Includes protocols like HTTP, HTTPS, FTP, SSH, DNS, SMTP.

Transport Layer: Corresponds to OSI layer 4. Uses TCP for reliable, connection-oriented communication or UDP for faster, connectionless communication.

Internet Layer: Corresponds to OSI layer 3. Primarily uses IP (Internet Protocol) for addressing and routing packets across networks.

Network Access Layer: Combines OSI layers 1 and 2. Handles the physical transmission of data and data link protocols like Ethernet.

Why Networking Models Matter for Penetration Testing

Understanding these networking models is crucial for penetration testing and cybersecurity for several reasons:

Attack Surface Identification: Each layer presents different attack vectors. Understanding the layers helps identify where vulnerabilities might exist.

Protocol Analysis: Knowing how protocols operate at each layer enables more effective packet analysis and traffic manipulation.

Defense Evasion: Understanding network layers helps attackers bypass security controls that operate at specific layers.

Troubleshooting: When attacks don’t work as expected, understanding the networking stack helps diagnose where things are failing.

Tool Selection: Different security tools operate at different layers. Understanding the models helps select the right tools for specific tasks.

Common Protocols by Layer

Understanding which protocols operate at each layer helps with both offensive and defensive security:

Application Layer: HTTP/HTTPS (web), DNS (name resolution), FTP/SFTP (file transfer), SSH (remote access), SMTP/POP3/IMAP (email), SMB (file sharing)

Transport Layer: TCP (reliable), UDP (fast), SCTP (specialized)

Network/Internet Layer: IP (addressing), ICMP (diagnostics/ping), ARP (address resolution), IPsec (encryption)

Data Link/Network Access: Ethernet, WiFi (802.11), PPP

Protocol Weaknesses and Security Implications

Many protocols were designed decades ago without modern security threats in mind. Understanding protocol weaknesses is essential for penetration testing:

  • Unencrypted protocols (HTTP, FTP, Telnet) expose data in transit
  • DNS lacks authentication, enabling DNS spoofing and cache poisoning
  • ARP is unauthenticated, allowing ARP spoofing for man-in-the-middle attacks
  • ICMP can be used for reconnaissance or covert channels
  • TCP handshakes can be exploited for port scanning and fingerprinting

Learning to identify and exploit these protocol weaknesses is a core skill for penetration testers.

Practical Applications

As you progress in penetration testing, you’ll regularly interact with these networking models:

  • Packet capture and analysis with tools like Wireshark operates across all layers
  • Port scanning with Nmap targets the transport and application layers
  • Man-in-the-middle attacks often exploit data link layer protocols
  • Firewall evasion requires understanding how packets are processed at each layer

This foundational knowledge of networking protocols and models will be referenced throughout your cybersecurity journey and is essential for understanding more advanced attack techniques.


comments powered by Disqus