Network Security

Concepts
IPsec

 A suite of protocols used to secure IP communications by

authenticating and encrypting each IP packet in a communication
session.
 Why it’s used:
• Ensures confidentiality, integrity, and authenticity of data.
• Commonly used in VPNs.
IPsec

Tunnel Mode:
Transport Mode:
Encrypts the entire IP
Encrypts only the
packet (used in
data.
VPNs).
IP Packet
IPsec
VPN (Virtual Private Network)
VPN

 A secure tunnel over the internet between two networks or

between a user and a network.
 Why it’s used:
• For remote secure access to internal network.
• To hide your IP and encrypt internet traffic.
 How it works:
• Encrypts traffic using IPsec, SSL, or other protocols.
• Your data goes through a VPN server before reaching the internet.
 Problem
INTERNET

[Link]

Firewal
l

Client
IS
P
 VPN installation
INTERNET
VPN
server
[Link]

VPN
client
Firewal
l

Client
IS
P
 Client
side

SIP – My IP
SIP – My IP
DIP – VPN
DIP – [Link] Layer addition
Encrypted Encrypted
Encryption software
server
algorithm
packet
Encrypted packet
Other data
packet
 VPN installation
INTERNET
VPN
server
[Link]

VPN
client
Firewal
l

Client
IS
P
 Server
side

SIP – My IP
SIP – My IP
DIP – VPN
D IP – [Link]
Encrypted
Layer removal Encrypted
server Decryption software
Encrypted packet
algorithm packet
Other data
packet
 Dynamic Host
Configuration
Protocol (DHCP)
Dynamic Host Configuration Protocol (DHCP) is a
client/server protocol that automatically provides
an Internet Protocol (IP) host with its IP address
and other related configuration information such
as the subnet mask and default gateway. DHCP
allows hosts to obtain required TCP/IP configuration
information from a DHCP server.

Every device on a TCP/IP-based network must have

a unique unicast IP address to access the network
and its resources. The DHCP server maintains a
pool of IP addresses and leases an address to any
DHCP-enabled client when it starts up on the
network. Because the IP addresses are dynamic
(leased) rather than static (permanently assigned),
addresses no longer in use are automatically
returned to the pool for reallocation.
Operations in DHCP
DNS (Domain Name System)
 Who is
0 [Link]?
1 0
1. [Link] is [Link]
.10
0
is m? 2.1 ISP’s Root
ho .cos 1
7
W bc i DNS DNS
a om
c.c
ab
Application Data
[Link]
[Link]
[Link]
google.com142.250.7
[Link] [Link]
7.78
google.com142.250.7
[Link]
7.78
[Link]
[Link]
[Link]
[Link]
[Link]
 Recursive
DNS
.com TLD is
[Link]
Root DNS
a bc
DNS
is 1
12.
10.
10.
10
Ab
17 [Link]
2.
10 m is .com TLD
.1
01 DNS
.1
00

[Link]
[Link]
[Link]
[Link]
google.com142.250.7
google.com142.250.7
7.78
7.78
[Link] [Link] DNS
[Link]
[Link]
[Link]
[Link]
[Link]

[Link]
SSH (Secure Shell)
Telnet
•Telnet is a network protocol used to
virtually access a computer and to
provide a two-way, collaborative and
text-based communication channel
between two machines.
•It follows a user command
Transmission Control Protocol/Internet
Protocol (TCP/IP) networking protocol
for creating remote sessions. On the
web, Hypertext Transfer Protocol
(HTTP) and File Transfer Protocol (FTP)
simply enable users to request
specific files from remote computers,
while, through Telnet, users can log
on as a regular user with the
privileges they are granted to the
specific applications and data on that
computer.
Problems
with Telnet
•All the text sent between
computers using Telnet is
in plain text. This
includes usernames and
passwords as well. If
you're using Telnet,
someone can easily
intercept the connection
and will be able to see
any credentials you send
using a "man-in-the-
middle attack."
SSH (Secure
Shell)
•The SSH protocol uses
encryption to secure
the connection
between a client and a
server. All user
authentication,
commands, output,
and file transfers are
encrypted to protect
against attacks in the
network.
 Password authentication

SSH Filtering known hosts

security
Encryption
RP (Address Resolution Protocol
 Who has Route
[Link]? Tell r Internet
[Link] 192.168.0
. 1 is at .1
68. 0
192.1 C address
A
[Link] Device this M
00 A at s [Link] Router

this MAC address

[Link] is at
[Link] Router is es [Link] Device
0.1 dr 00 A
8. ad [Link] Device
Device
. 16 AC 01
[Link] B
192.168.0.
A 9 2 M Mobile
1 is 02
100
th
Who has
[Link]? Tell
[Link]

[Link]? Tell
[Link]
[Link]
Mobile
[Link] Device 02

Who has
01 B [Link] Router
[Link] Router

Device Mobil
192.168.0.
B 192.168.0.
e
101 102
ARP Cache Poisoning
 Who has
[Link]? Tell
Who has [Link] Route
[Link]? Tell r Internet
[Link] 192.168.0
.1
[Link]
Victim [Link] Router

[Link] is
00
[Link] Hacker [Link]
Hacker
[Link] 00
[Link]

Hacker
Hacker 19 Hacker
01 Victim 01
192.168.0. 2.
16
100 Ha 8.
ck 0.1
er is

[Link]
Hacker
01
[Link] Router
[Link]
Victim
00 Hacker
192.168.0.
101