NETWORK PROTOCOLS

Network protocols are a set of rules outlining how connected devices communicate across a network to
exchange information easily and safely. Protocols serve as a common language for devices to enable
communication irrespective of differences in software, hardware, or internal processes.

Types of network protocols

Different protocols serve different functions to ensure efficient, quick, and secure network
communication. Various types of network protocols can be categorized into the following three broad
categories to help organizations operate seamlessly across different business scenarios:

1. Network Communication Protocols: These protocols determine the rules and formats to
transfer data across networks. Communication protocols govern various aspects of analog and
digital communications, such as syntax, authentication, semantics, and error detection, among
others. Some key network communication protocols include:
 Hyper-Text Transfer Protocol (HTTP): Commonly referred to as the protocol of the
internet that allows communication between a server and browser.
 Transmission Control Protocol (TCP): A reliable, connection-oriented protocol that
helps in the sequential transmission of data packets to ensure data reaches the
destination on time without duplication.
 Internet Protocol (IP): Facilitates routing the data packets across networks. IP contains
addressing and control information to deliver packets across a network. It works along
with TCP. While it ensures delivering the packets to the right address, TCP aligns them
in the right order.
 User Datagram Protocol (UDP): Unlike TCP, UDP is a connectionless protocol that
doesn’t ensure a connection between the application and server before transmitting a
message. It’s effective for use cases such as broadcasts or multicast connections.
 File Transfer Protocol (FTP): Allows file sharing between servers by establishing two
TCP connections, one for data transfer and the other for control. The data transfer
connection transfers the actual files while the control connection transfers control
information such as passwords to ensure data retrieval in case of data loss.

Internet Control Message Protocol (ICMP): a protocol that devices within a network use to
communicate problems with data transmission.

To help diagnose network connectivity issues, network devices employ ICMP for sending error
messages, highlighting congestion and timeouts, and transmitting other operational information
to assist in network troubleshooting.

2. Network Security Protocols: These protocols ensure safe data transmission over the network
connections. Network security protocols define the procedures to secure data from any
unauthorized access. These protocols leverage encryption and cryptography to safeguard. Here
are the most widely used network security protocols:
 Secure File Transfer Protocol (SFTP): Helps securely transfer files across a network
by using public-key encryption and authenticating the client and server.
  Hyper-Text Transfer Protocol Secure (HTTPS): Overcomes the limitation of HTTP by
ensuring the security of data transmitted between the browser and server through data
encryption. HTTPS is a secure version of HTTP.
 Secure Socket Layer (SSL): Primarily helps secure internet connections and safeguard
sensitive data using encryption. SSL protocol enables both server-client communication
and server-server communication.

3. Network Management Protocols: Network managers require standard policies and

procedures to manage and monitor the network for maintaining smooth communication.
Network management protocols ensure quick troubleshooting and optimal performance across
the network. The following are essential network protocols management:
 Simple Network Management Protocol (SNMP): Helps administrators manage
network devices by monitoring endpoint information to proactively track network
performance and pinpoint network glitches for quick troubleshooting.
 Internet Control Message Protocol (ICMP): Helps diagnose network connectivity
issues. Network devices employ ICMP for sending error messages, highlighting
congestion and timeouts, and transmitting other operational information to assist in
network troubleshooting.

How do network protocols work?

Understanding how network protocols work makes it crucial to see how connected devices
communicate over a network. The most popular model, the Open Systems Interface (OSI),
demonstrates how computer systems communicate over a network. This seven-layer model visualizes
the communication process between two network devices across seven layers.

Network protocols split the communication process into discrete tasks across each OSI model layer. To
enable network communication, one or more protocols operate at every layer. For example, the Internet
Protocol (IP) routes data by managing the information such as data packets’ source address and
destination to enable network-to-network communications. Therefore, it’s referred to as a network layer
protocol.
How do network protocols function in each OSI model layer?

Single or multiple protocols operate at each layer of the OSI model to enable communication.

 Layer 1: Physical Layer Protocols

 These protocols provide an interface between devices and network medium.

 Layer 2: Data Link Layer Protocols

 The protocols operating at this level ensure the framing of packets while proactively
identifying and rectifying packet transmission errors.

 Layer 3: Network Layer Protocols

 By leveraging the right set of network layer protocols, administrators route packets
efficiently while managing the network flow and congestion to prevent network resource
depletion.
 Layer 4: Transport Layer Protocols
 These protocols ensure reliable end-to-end packet delivery across networks in the right
sequence at the receiving end.

 Layer 5: Session Layer Protocols

 Protocols at the session layer help manage dialogues and user sessions by seamlessly
establishing and terminating sessions for communication exchange.

 Layer 6: Presentation Layer Protocols

 These protocols are necessary to encode and decode data to smoothly mask the
variations in data formats across different systems.
  Layer 7: Application Layer Protocols
 These protocols help transform user requests to network-friendly formats.

An overview of the OSI model and its security threats

Layer1: Physical Layer

This layer is responsible for the transmission and reception of raw bit streams (the binary 1 and 0) over
physical mediums such as cables, wires, and wireless signals. It can establish, maintain, and
deactivate the physical connection. It synchronizes the data bits and defines the data transmission rate
and the data transmission modes, such as full-duplex and half-duplex modes. The devices that are
used in the physical layer are cables such as Ethernet, coaxial, fiber-optic, and other connectors.

Denial of Service (DoS) attacks are targeted at the physical layer, as this is the hardware, the tangible
layer of the system. DoS attacks halt all network functions. A DoS attack can be accomplished by
physically cutting or unplugging network cables. Physical layer vulnerabilities can be mitigated with
physical security measures, such as access control, video surveillance, tamper-proof electromagnetic
interference shields, and the use of redundant links.
Layer 2: Data Link Layer

This layer works with information flows that are encapsulated in “frames”. This layer detects and
corrects errors in data, ensuring reliable transmission between network devices over a physical link. It
is responsible for sequential and consistent data exchange, error control, and flow control. Cyclic
Redundancy Check (CRC) monitors against lost frames, which can then be retransmitted. Devices
such as bridges, switches, and Network Interface Controllers (NICs) and protocols such as Address
Resolution Protocol (ARP), Point-to-Point Protocol (PPP) Spanning Tree Protocol (STP), Link
Aggregation Control Protocol (LACP) belong to this layer.

Data link layer attacks originate from the internal LAN (Local Area Network), some of these attacks are:

 ARP spoofing – ARP spoofing is a Man in The Middle (MiTM) attack, where the threat actor
pretends to be both sides of a network communication channel; sniffing packets to steal data
and alter communications, perform session hijacking, and Distributed Denial of Service (DDoS)
attacks. To prevent this attack, enable private VLANS, static ARP, and install Intrusion
Detection Systems (IDS).
 MAC flooding attack – This attack is carried on the network switch. The threat actor overflows
the Media Access Control (MAC) address table of the switch with fake MAC addresses, which
replaces valid addresses. This forces the switch to behave like a network hub, that is, when a
valid user attempts to access the web, they create a broadcast “flood” throughout the network.
The data intended for the authentic user will now be received by the attacker instead. This
attack can be mitigated by enabling port security and authentication with an Authentication,
Authorization, and Accounting (AAA) server.
 Spanning Tree attack – The Spanning Tree Protocol (STP) removes potential loops between
redundant switches from causing an endless broadcast traffic storm. The threat actor alters the
operation by adding a new STP device to become the root bridge, and the traffic will then
transmit across the attacker`s switch. Enabling Bridge Protocol Data Unit (BPDU) guard on
switches will prevent this attack.

Layer 3: Network Layer

The network layer operates on “packets”, routing them across devices and networks. It manages logical
device identification and addressing, and performs routing by choosing the shortest, and most logically
efficient path to forward the packets. Routers and switches are the most common devices associated
with this layer. The protocols that function at this layer include Internet Protocol (IP), Internet Control
Message Protocol (ICMP), Routing Information Protocol (RIP), and Open Shortest Path First (OSPF).

Attacks in the network layer are performed over the internet, such as DDoS attacks, where a router is
targeted and overwhelmed with illegitimate requests, subsequently rendering it unable to accept
genuine requests. Packet filtering controls, and security mechanisms such as Virtual Private Networks
(VPNs), IPsec, and firewalls are common methods to limit the chance of network layer attacks.

Layer 4: Transport Layer

This layer establishes a point-to-point connection between the source and the destination, ensuring that
the data is transmitted in the correct order. It also performs flow control, error control, data reassembly,
and segmentation. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are
examples of transport layer protocols.

Attacks in this layer are often conducted through vulnerable open ports identified by port scanning.

 SYN flood attack – is a type of DDoS attack that exploits the TCP three-way handshake. The
attacker sends multiple synchronization (SYN) packets to every port of a server. The server
acknowledges by sending a Synchronize-Acknowledge (SYN-ACK) message for each SYN packet.
 If the malicious client doesn’t send the final ACK packet as expected, it creates “half-open” sessions
on the server. As the server’s ability to process requests becomes depleted, new requests and
services to legitimate clients will be denied. If the SYN flood continues, the server will malfunction or
crash. SYN flood attacks can be mitigated by allocating micro-blocks, as few as 16 bytes for a SYN
request, and maintaining SYN cookies and RST cookies.
 Smurf attack – named after a popular toy figure from the 1980s that appeared to be everywhere,
the Smurf attack is also a type of a DDoS attack. This attack is carried out by generating fake ICMP
Echo request (PING) packets to an IP broadcast network using the targeted server`s IP address as
the source IP address. With so many ICMP responses, seeming to come from everywhere, the
target server becomes overwhelmed and is bought down. Inspection of incoming, traffic and
blocking illegal ICMP responses will limit the chances of a Smurf attack.

Layer 5: Session Layer

This layer is responsible for establishing, maintaining, and terminating sessions between a local and
remote device. It`s responsible for synchronization and recovery, it adds checkpoints during the
transmission of data. If there are any during any instance transmission errors, the transmission will
resume from the last good checkpoint.

Common attacks in this layer include:

 Session hijacking – A threat actor takes over a web session by compromising the session
token to gain access to personal information and passwords. Strong passwords with multifactor
authentication, VPNs, and keeping software up to date are a few mitigations against session
hijacking attacks.
 MiTM attack – During this attack, the threat actor is positioned between a two parties’ data
transmission session to eavesdrop and relay messages. Open, unsecured Wi-Fi connections
are the most popular vector for this type of attack. Other communication technologies, such as
Secure Shell (SSH) will limit these types of attacks

Layer 6: Presentation Layer

This layer is responsible for translating data from a sender-dependent format to a common format that
is understood by the application layer. For example, the translation of different character sets, such as
ASCII to EBCDIC. Most importantly from a cyber-security perspective, this layer handles the encryption
and decryption of data. Data compression for network transmission is also managed at the
Presentation layer. Secure Sockets Layer (SSL) hijacking, also known as session hijacking attacks
occur in the presentation layer. Encryption technologies ensures the confidentiality and integrity of data
during transmission.

Layer 7: Application Layer

This layer provides services for the end user, such as mail services, directory services, file transfer,
access, and management (FTAM). File Transfer Protocol (FTP), Simple Network Management Protocol
(SNMP), Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), and email protocols
(SMTP, POP3, IMAP) are some examples of application layer protocols.

Application layer attacks are the hardest to defend against because many vulnerabilities are
encountered here since it`s the layer that is most exposed to the outer world. Employing application
monitoring technologies to detect layer 7 and zero-day attacks, and updating the applications regularly
are best practices to secure the application layer.

The most common cyberattacks occur at this layer, including viruses, worms, Trojan horses,
phishing attacks, DDoS attacks, HTTP floods, SQL injections, cross-site scripting, and many
more.
NETWORK ADDRESS ALLOCATION

Dynamic Host Configuration Protocol (DHCP) is a system for assigning Internet Protocol (IP)
addresses to each network device (known as a host) on an organization’s network. A host may be a
desktop computer, a laptop, a tablet, a mobile device, a thin client, or other types of devices. Each host
must have an IP address to communicate with other devices over the internet. The DHCP network
protocol assigns addresses automatically, rather than requiring network administrators to make manual
assignments. DHCP is also responsible for automatically assigning new IP addresses when devices
move to new locations on the network. In addition to IP addresses, a DHCP service assigns
configuration parameters like Domain Name System (DNS) addresses, subnet masks, and default
gateways that are essential to network communications.

DOMAIN NAME RESOLUTION

The Domain Name System (DNS) is like the internet’s phone book. It helps you find websites by
translating easy-to-remember names (like [Link]) into the numerical IP addresses (like
[Link]) that computers use to locate each other on the internet. Without DNS, you would have to
remember long strings of numbers to visit your favorite websites.

Domain Name System (DNS) is a hostname used for IP address translation services. DNS is a
distributed database implemented in a hierarchy of name servers. It is an application layer protocol for
message exchange between clients and servers. It is required for the functioning of the Internet.

DIRECTORY SERVICES

Directory Service Protocols: are communication standards used for accessing and managing
directory information within directory services. These protocols enable clients to perform operations
such as querying directory data, adding or modifying entries, and authenticating users. Some common
directory service protocols include:

LDAP (Lightweight Directory Access Protocol):

 LDAP is a widely used open protocol for accessing and managing directory information.
 It provides a lightweight and efficient means of querying and updating directory data over
TCP/IP networks.
 LDAP is commonly used in directory services such as Active Directory, OpenLDAP, and Apache
Directory Server.

LDAPS (LDAP Secure):

 LDAPS is a secure variant of LDAP that adds SSL/TLS encryption to LDAP communications for
enhanced security.
 LDAPS encrypts data transmitted between LDAP clients and servers to protect against
eavesdropping and tampering.
 LDAPS typically uses port 636 for encrypted LDAP communication.

Kerberos:

 Kerberos is a network authentication protocol that provides secure authentication for users and
services within a network.
 It uses tickets to authenticate users and encrypt communication between clients and servers.
  Kerberos is commonly used in conjunction with LDAP for authenticating users in directory
services such as Active Directory.

SAML (Security Assertion Markup Language):

 SAML is an XML-based standard for exchanging authentication and authorization data between
identity providers and service providers.
 It enables single sign-on (SSO) and federated identity management across different domains or
organizations.
 SAML is often used in federated directory services to enable seamless access to resources
across trusted domains.

OAuth (Open Authorization):

 OAuth is an open standard for authorization that enables secure access to resources without
sharing user credentials.
 It allows users to grant permissions to third-party applications to access resources on their
behalf.
 OAuth is commonly used in modern authentication and authorization frameworks for web and
mobile applications.

WEB AND NETWORK COMMUNICATIONS

IPsec - Internet Protocol Security

IPsec solves an important problem which arises when embedded systems are connected to the
Internet. Since the Internet protocol has no data security built-in, both application and user data is sent
in clear text. This enables a third party to inspect or even modify data from the embedded system as it
traverses the Internet. For example, passwords are sent in the open and can be seen and used to
compromise a system.

IKE - Internet Key Exchange

IKE handles exchange of encryption keys when two hosts want to communicate securely using the
IPSec protocol. Distributing encryption keys is a difficult task, which requires careful consideration.
Before the keys are exchanged, none of the hosts can encrypt any information and if keys are sent in
clear text, they can be picked up by someone listening in on the communication. In order to exchange
the keys securely, IKE uses state-of-the-art key exchange algorithms, specifically designed to meet the
challenge of secure key distribution in embedded systems.

SSH - Secure Shell

SSH is short for Secure Shell. As the name implies, the protocol creates a secure terminal connection
between an SSH client and an SSH server. This means that embedded systems can communicate at
the application level over a connection that is encrypted and provides data integrity and replay
protection. This effectively eliminates eavesdropping, connection hijacking, IP spoofing and other
network-level attacks.

SSL - Secure Socket Layer

SSL was invented by Netscape to include security in their products in order to make communication
safe. SSL was originally intended for use with the HTTP protocol used by web servers and browsers
but has since evolved to be an important component in all kinds of secure Internet communication.
SSL can be used to implement strong authentication, privacy, non-repudiation and integrity for
customer specific client or server applications as well as interface to standard Internet applications.

HTTPS - Secure Embedded Web Server

Integrating an Embedded Web Server in a dedicated device presents special requirements on the
server in terms of memory consumption, performance, security and functional requirements. The
Secure Embedded Web Server is a versatile, configurable, high performance HTTP server that has low
ROM and RAM footprint. It is specifically designed for operating in an embedded environment.

RADIUS - Remote Authentication Dial In User Service

Embedded RADIUS is used to grant remote access dial in users access to an embedded system.
Verification is done with either the PAP or the CHAP password schemes.

The Embedded RADIUS client is easy to use and to provides high performance when many logins are
in progress. RADIUS is designed for embedded systems and is configurable and under complete
control of the user application.