832-TCPIP Protocols ReviewIPv6用DHCP的方式可避免.pptVIP

TCP/IP Protocols Review Protocol Model Internet Protocol – IP/ICMP/ARP Reliable Stream Transport Service - TCP User Datagram Protocol - UDP Internet Applications TCP/IP階層性架構 Internet Protocol (IP) Internet Address IP Datagram IP Fragmentation IP Routing Internet Control Message Protocol(ICMP) IP通信協定的特性 IPv6 Internet Address Network ID and Host ID (Network Mask and Subnet) Address Class and Classless IP NIC Reserved IP Address Broadcast / Loop Back / Multicast Address Internet Addressing的缺點 IP Address Class (1) Class A nnn.hhh.hhh.hhh( ~ 55) Class B nnn.nnn.hhh.hhh( ~ 55) IP Address Class (2) Class C nnn.nnn.nnn.rrr( ~ 55) Class D Multicast address( ~ 55) Special IP Address Directed Broadcast Address Network ID + all 1’s with Host ID Limited Broadcast Address Thirty-two 1s Multicast Address IGMP, Internet Group Management Protocol Loop Back Address For inter-process communication on the local machine Internet Addressing 缺點 IP位址常常必須改變 IP Spoofing 位址不夠用 IP Fragmentation Maximum Transmission Unit(MTU) Related fields in IP Header Identification Flags: w/o more Fragment, DF bit Fragment Offset Related Attack Ping of Death Tiny Fragments Fragments overlapped MTU Why Frag. is BAD 封包分割重組造成效率降低與資源虛耗 封包被分割後不含TCP/UDP Header資訊，造成防火牆過濾上的困難 可能規避安全機制(掃毒、入侵偵測)檢查 information hiding 可能造成系統當機或其他異常反應 overlapping data/header Overlapping Fragments Time to Live (TTL) 封包可以經過路由器的最大限制 (hop count) 每當封包經過一台路由器(router/gateway)時，路由器會將TTL的值減1 若TTL的值到達零，負責處理的路由器會將封包丟棄不再繼續傳遞，並傳回ICMP Time Exceeded錯誤訊息回發送端 Protocol Field IP Options 通常是empty，很少使用 Firewall可能會碰到的IP option為IP source route IP source route除mobile IP的應用外，無太大用途，反可能被攻擊者利用 有些packet filtering systems的政策是一見到IP option set，就拒絕此packet，不管它代表什麼意義 IP Routing Mapping Internet Address to Physical Address (ARP) Table Driven IP Routing Static and Dynamic Routing Routing Scenario Address Resolution Protocol 非IP Protocol ARP Cache ARP Proxy arp -a, arp -p ICMP (1) Internet Control Message Protocol ICMP only reports error conditions to the original so