GROUP3_AMAK: Network protocol analysis

Network protocols defines a language of rules and conventions for communication between network devices.

List of Protocols with examples of each : -

1 Layer 1 protocols (Physical Layer)

• ADSL Asymmetric digital subscriber line
• ISDN Integrated Services Digital Network

2 Layer 2 protocols (Data Link Layer)

• Ethernet
• IEEE 802.11
• IEEE 802.16

Layer 3 protocols (Network Layer)

• IPv4 Internet Protocol version 4
• IPv6 Internet Protocol version 6

Layer 4 protocols (Transport Layer)

• TCP Transmission Control Protocol
• UDP User Datagram Protocol

Layer 5 protocols (Session Layer)

• NCP NetWare Core Protocol
• NFS Network File System

Layer 7 protocols (Application Layer)

• FTP, File Transfer Protocol
• HTTP, HyperText Transfer Protocol
• IMAP, Internet Message Access Protocol
• POP3 Post Office Protocol Version 3
• Telnet, a remote terminal access protocol
• SOAP, Simple Object Access Protocol

What is Network Protocol Analysis and Protocol Analyzer?

The packet analyzer (also known as a network protocol) is computer software or computer hardware that can intercept and log traffic passing over a digital network or part of a network.

Network protocol analysis is a process for a program or a device to decode network protocol headers and trailers to understand the data and information inside the packet encapsulated by the protocol. To conduct protocol analysis, packets must be captured at real time for line speed analysis or later analysis. Such program or device is called a Protocol Analyzer.

The uses of network analysers :

• Analyze network problems
• Detect network intrusion attempts
• Gain information for effecting a network intrusion
• Monitor network usage
• Gather and report network statistics
• Filter suspect content from network traffic
• Spy on other network users and collect sensitive information such as passwords
• Debug client/server communications
• Debug network protocol implementations

Notable Network analysis applications : -

• dSniff
• Microsoft Network Monitor
• Wireshark (formerly known as Ethereal)
• Snoop (part of Solaris)
• OPNET Technologies ACE Analyst

Group3_AMAK: How internet works?

The internet is a standardized, global system of interconnected computer networks that connects millions of people. The system uses IP/TCP standard rules for data representation. It carries a vast array of information resources and services in the form of interlinked hyper text documents of the world wide web(www) and the infrastructure to support electronic mail.

As we know that the internet is a global network of computers, each computer must have a unique address in the form of nnn.nnn.nnn.nnn where nnn ranges between 0-255. This unique address is known as IP address. If you connect to internet through an Internet Service Provider(ISP), you are assigned a temporary IP address for the session. If you connect to the internet through LAN(Local Area Network) you might be assigned a permanent IP address or a temporary one from DHCP(Dynamic Host Configuration Protocol) server.
Once the computer is connected to the internet and we want to communicate with the other computers, the message must be translated from alphabetic text to electronic signals and is sent over the medium through which it is connected. The receiving computer translates it back into alphabetic text and this is achieved through the use of protocol stack.The protocol stack used on the internet is referred to as TCP/IP protocol stack.

The protocol stack consists of layers that have different functions:

1.)Application Protocols layer: it is the protocol which is specific to the applications such as WWW,FTP,E-Mail.etc.
2.)Transmission Control Protocol Layer: directs packets to a specific application on a computer using a port number.
3.)Internet Protocol Layer: it directs packets to a specific computer using IP address.
4.)Hardware Layer: Converts binary packet data into network signals and back.

The data to be transmitted works its way downward the stack. The data to be transmitted is broken into smaller chunks of data known as packets.Each packet is assigned a port number.Port numbers are necessary because we need to determine the program on the computer which requires the information.From the TCP layer the packets proceed to the IP layer where they are assigned a destinatin IP address. Now that the packet has the port number and the IP address it proceeds to the hardware layer where it becomes ready to be sent over the internet. The packets work their way upwards in the protocol stack at the receiving computer. When the data reaches the top of the stack the data is reassembled in its original form.

The DNS is a distributed database which keeps track of computer's names and their corresponding IP addresses on the Internet. Many computers connected to the Internet host part of the DNS database and the software that allows others to access it. These computers are known as DNS servers. No DNS server contains the entire database; they only contain a subset of it. If a DNS server does not contain the domain name requested by another computer, the DNS server re-directs the requesting computer to another DNS server.