Section One

downloaded from

Scholarfriends

https://scholarfriends.com

Downloaded by: browsegrades@gmail.com | https://scholarfriends.com/singlePaper/197689/section-one Distribution of this document is illegal.

Section One With the help of a neat sketch explain the steps and buffers involved when an application writes to a TCP socket.

The steps for establishing a TCP socket on the client side are the following:   



Create a socket using the socket() function; Connect the socket to the address of the server using the connect() function; Send and receive data by means of the read() and write() functions.

Close the connection by means of the close() function.

The steps involved in establishing a TCP socket on the server side are as follows: 

Create a socket with the socket() function;

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/

    

Bind the socket to an address using the bind() function; Listen for connections with the listen() function; Accept a connection with the accept() function system call. This call typically blocks until a client connects with the server.

Send and receive data by means of send() and receive().

Close the connection by means of the close() function.

Below is each function described with its importance: 1. The socket() Function It specifies the type of communication protocol (TCP based on IPv4, TCP based on IPv6, UDP).The function is defined as follows: #include <sys/socket.h> int socket (int family, int type, int protocol);

Where family specifies the protocol family (AF_INET for the IPv4 protocols), type is a constant described the type of socket (SOCK_STREAM for stream sockets and SOCK_DGRAM for datagram sockets.

The function returns a non-negative integer number, similar to a file descriptor, that we define socket descriptor or -1 on error.

2. The connect() Function Used by a TCP client to establish a connection with a TCP server. The function is defined as follows: #include <sys/socket.h> int connect (int sockfd, const struct sockaddr *servaddr, socklen_t addrlen);

sockfd is the socket descriptor returned by the socket function.

The function returns 0 if the it succeeds in establishing a connection (i.e., successful TCP three-way handshake, -1 otherwise.

The client does not have to call bind() in Section before calling this function: the kernel will choose both an ephemeral port and the source IP if necessary.

3. The bind() Function Assigns a local protocol address to a socket. With the Internet protocols, the address is the combination of an IPv4 or IPv6 address (32-bit or 128-bit) address along with a 16 bit TCP port number. The function is defined as follows: #include <sys/socket.h> int bind(int sockfd, const struct sockaddr *servaddr, socklen_t addrlen);

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/

where sockfd is the socket descriptor, servaddr is a pointer to a protocol-specific address and addrlen is the size of the address structure.

Returns 0 if it succeeds, -1 on error.

4. The listen() Function It converts an unconnected socket into a passive socket, indicating that the kernel should accept incoming connection requests directed to this socket. It is defined as follows: #include <sys/socket.h> int listen(int sockfd, int backlog); Backlog is the maximum number of connections the kernel should queue for this socket.

The backlog argument provides an hint to the system of the number of outstanding connect requests that it should enqueue on behalf of the process. Once the queue is full, the system will reject additional connection requests. The backlog value must be chosen based on the expected load of the server.

The function listen() return 0 if it succeeds, -1 on error.

5. The accept() Function It is used to retrieve a connect request and convert that into a request. It is defined as follows: #include <sys/socket.h> int accept(int sockfd, struct sockaddr *cliaddr, socklen_t *addrlen);

where sockfd is a new file descriptor that is connected to the client that called the connect(). The cliaddr and addrlen arguments are used to return the protocol address of the client. The new socket descriptor has the same socket type and address family of the original socket. The original socket passed to accept() is not associated with the connection, but instead remains available to receive additional connect requests. The kernel creates one connected socket for each client connection that is accepted.

N/B: If we don’t care about the client’s identity, we can set the cliaddr and addrlen to NULL. Otherwise, before calling the accept function, the cliaddr parameter has to be set to a buffer large enough to hold the address and set the interger pointed by addrlen to the size of the buffer.

6. The send() Function We can use read and write to communicate with a socket as long as it is connected.

However, if we want to specify options we need another set of functions.

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/

send() is defined as follows: #include <sys/socket.h> ssize_t send(int sockfd, const void *buf, size_t nbytes, int flags);

The additional argument flags is used to specify how we want the data to be transmitted..

The function returns the number of bytes if it succeeds, -1 on error.

7. The receive() Function The recv() function is similar to read(), but allows to specify some options to control how the data are received. It is defined as follows: #include <sys/socket.h> ssize_t recv(int sockfd, void *buf, size_t nbytes, int flags);

The function returns the length of the message in bytes, 0 if no messages are available and peer had done an orderly shutdown, or -1 on error.

8. The close() Function Used to close a socket and terminate a TCP socket. It returns 0 if it succeeds, -1 on error.

It is defined as follows: #include <unistd.h> int close(int sockfd);

Section Two In this section, you will explore the various tools that an end user can use to discover how a machine is connected to the network and what the network looks like beyond the first hop. You investigation will use the following tools: 1. netstat 2. traceroute 3. whois All of these tools should be available on any machine running a UNIX-based operating system.

1. netstat i). What is netstat and what is it used for?

The network statistics (netstat) command is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/

incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command. ii). What parameters for netstat should you use to show all the TCP connections established? Include a printout of this list for your machine. Be sure to explain what all fields are.

netstat –o: Displays active TCP connections and includes the process ID (PID) for each connection. You can find the application based on the PID on the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and –p netstat –n: Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names. iii). How can use netstat to detect malicious software in Windows 1.

2.

3.

4.

5.

6.

7.

8.

Press Windows + X keys together to open the Windows Super User Menu. Click on the Command Prompt (Admin) option to open Command Prompt with Administrative privileges In the Command Prompt window, type netstat followed by a switch name. In this example, we’ll use –b. Press the Enter key. The switch –b displays the executable involved in creating each connection or listening port.

The netstat command displays the Active Connections on your system.

The data is presented in four columns – Proto, Local Address, Foreign Address, and Status.

Proto – Displays the Network Connection Protocol.

Local Address – Displays the Address of the User’s Computer.

Foreign Address – Displays the Address of the IP Address the User’s Computer is Connected to.

Status – Displays the Current Status of the Network Connection In the Command Prompt window, type netstat –bo, and then press Enter.

A fifth column called PID (process identifier) will be displayed as well Right-click on the Taskbar, and click Task Manager The PID column is hidden by default in the Windows Task Manager. Right-click on the Information bar, and click on PID to show it as a column in Task Manager.

Sort the processes by PID

9. Now, here you can easily locate the process through its PID. The WpnService process is Service Host: Windows Push Notifications.

After all these steps, you can see how we can find out about the processes that are currently connected to the internet. If you see a program name that does not look like a familiar, you can easily track and, and block or remove it.

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/

This way, we can detect and block malware (viruses) using the netstat command in Windows. iv). Open multiple different applications like email client, browser and find out which program is opening which port, how many ports and so on. What information do those options display and what to understand from those options.

2. traceroute i). Explain in detail how traceroute works.

Before running a traceroute command, you should understand a network mechanism called “time to live” (TTL). TTL limits how long data can “live” in an IP network. Every packet of data is assigned a TTL value. Every time a data packet reaches a hop, the TTL value is decreased by one.

Traceroute ensures each hop on the way to a destination device drops a packet and sends back an ICMP error message. This means traceroute can measure the duration of time between when the data is sent and when the ICMP message is received back for each hop—giving you the RTT value for each hop.

Traceroute will send packets with a TTL of one to the destination server. The first network device the data passes through will decrease the TTL to the value of zero, and a message informing you the packets were dropped is sent. This gives you the RTT for hop number one.

From there, the data packets are sent to the destination server with a TTL of two. As the packets pass through the first hop, the TTL decreases to one. When they pass through the second hop, it decreases to zero. The message is sent again. This gives you the RTT for hop number two.

This process will repeat until the data packets either reach the destination device or it reaches the maximum number of hops. By the end of this test, you will know the number of hops to the destination device, the RTT length for each hop, and the device name and IP address for each hop. ii). Perform a traceroute from your machine to two different locations  In Europe  In US Include a copy of the output and explain what happened including a description of what each of the field’s means. iii). traceroute to www.kca.ac.ke, and identify each hop by using whois command. Note that whois takes IP addresses as parameter.

This study source was downloaded by 100000830919685 from CourseHero.com on 06-15-2022 08:51:56 GMT -05:00

https://www.coursehero.com/file/135700056/ass1docx/ Powered by TCPDF (www.tcpdf.org)