课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Introducing TCP/IP

课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

开始一个月试用 购买团队方案

Introducing TCP/IP

“

- [Instructor] We use networks every day, but we don't often pause to reflect upon what's happening under the covers to make those networks function properly. As we begin our exploration of communication and network security, let's first talk about the basics of networking and a set of protocols known as TCP/IP. TCP/IP is an acronym that stands for Transmission Control Protocol, TCP, Internet Protocol, IP. TCP and IP are two of the main protocols that make up all modern networks. The Internet Protocol is responsible for routing information across networks. Now, the name is a little deceiving because it's not just used on the internet. It's also used on the network in your home or office. The main responsibilities of the Internet Protocol are providing an addressing scheme, known as IP addresses, that uniquely identify computers on a network and delivering information in chunks, known as packets, from their source to the correct destination. IP is known as a network layer protocol. It supports transport layer protocols that have higher level responsibilities. The two main transport layer protocols are the Transmission Control Protocol, TCP, and the User Datagram Protocol, UDP. TCP is responsible for the majority of internet traffic. It's a connection-oriented protocol, meaning that it establishes connections between two systems before transferring data. TCP is also a reliable protocol that guarantees delivery by having the destination system acknowledge the receipt of every packet. TCP's reliability makes it widely used for applications that require this guaranteed delivery, such as email and web traffic. Now, because TCP is connection-oriented, systems go through a handshaking process to create a connection before transmitting data. This process is known as the TCP three-way handshake. TCP packets include special flags that identify the packets that are being used in this handshaking process. The SYN flag identifies packets that are requesting a new connection, the FIN flag identifies packets that are requesting the closure of an existing connection, and the ACK flag is used to acknowledge a SYN or FIN packet. Now let's take a look at that three-Way handshake process in more detail. In the first step, the system originating the connection sends a packet with the SYN flag set. This indicates that the system would like to open a connection to the destination system. The destination system receives this packet and replies with another packet that does two things. It acknowledges the original connection request, and then it asks to open a reciprocal connection in the other direction. This packet therefore has both the SYN and ACK flag set, and then finally, the original system receives that SYN/ACK packet and sends a final ACK back to the destination system, completing the reciprocal connection. Once the three-packet sequence completes, the connection is open, and the systems may begin exchanging data. The User Datagram Protocol, on the other hand, is a much more lightweight protocol that doesn't use this three-way handshake because it is not connection-oriented. Systems basically send data off to each other blindly, hoping that it's received on the other end. UDP does not perform acknowledgements, and therefore, it cannot guarantee delivery. It's often used for applications like voice and video where guaranteed delivery isn't essential. Every single packet doesn't have to reach the final destination for video and voice to be comprehensible. Many networking theorists describe these protocols using a model known as the Open Systems Interconnection, or OSI Model. This model describes networks as having seven different layers. The first layer, the physical layer, is responsible for sending bits over the network using wires, radio waves, fiber optics, or other means. The second layer, the data link layer, transfers data between two nodes connected to the same physical network. The third layer, the network layer, expands networks to many different nodes. The Internet Protocol works at this layer. The fourth layer, the transport layer, creates connections between systems and transfers data in a reliable manner. TCP and UDP are transport layer protocols. The fifth layer, the session layer, manages the exchange of communications between systems. While the sixth layer, the presentation layer, translates data so that it may be transmitted on a network. The presentation layer describes how to represent a character in terms of bits and performs encryption and decryption. And the seventh and final layer, the application layer, determines how users interact with data using web browsers or other client applications. In addition to the OSI model, CISSP candidates must be familiar with the TCP network model. The creators of the TCP/IP network stack developed this model as they attempted to actually implement the more theoretical OSI model. like the OSI model, the TCP model uses layers to describe different parts of a network communication, but it does so with fewer layers. The physical layer and data link layer of the OSI model are replaced by a single network interface layer in the TCP model. The OSI's network layer is simply renamed as the internet layer. While the OSI's transport layer retains the same name in the TCP model. At the top of the model, three layers are combined with the OSI model's session layer, presentation layer, and application layer combined into a single application layer in the TCP/IP model. Now, you won't hear much about these models in practice because they are rarely used, and they're difficult to map to real-world networks. But you must understand the layers of both models because they are covered on the exam.

内容