Preface |
|
xv | |
|
|
1 | (54) |
|
|
2 | (1) |
|
The Origins and History of TCP/IP |
|
|
2 | (5) |
|
|
2 | (1) |
|
|
3 | (3) |
|
|
6 | (1) |
|
Meet the Standards Groups that Manage TCP/IP |
|
|
6 | (1) |
|
TCP/IP Standards and RFCs |
|
|
7 | (1) |
|
OSI Network Reference Model Overview |
|
|
8 | (8) |
|
Models Break Networking into Layers |
|
|
9 | (1) |
|
The ISO/OSI Network Reference Model |
|
|
10 | (1) |
|
How Protocol Layers Behave |
|
|
11 | (5) |
|
The TCP/IP Networking Model |
|
|
16 | (5) |
|
TCP/IP Network Access Layer |
|
|
16 | (1) |
|
TCP/IP Network Access Layer Protocols |
|
|
17 | (1) |
|
TCP/IP Internet Layer Functions |
|
|
18 | (1) |
|
TCP/IP Internet Layer Protocols |
|
|
19 | (1) |
|
TCP/IP Transport Layer Functions |
|
|
20 | (1) |
|
TCP/IP Transport Layer Protocols |
|
|
20 | (1) |
|
|
20 | (1) |
|
TCP/IP Protocols, Services, Sockets, and Ports |
|
|
21 | (3) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
24 | (1) |
|
Data Encapsulation in TCP/IP |
|
|
24 | (1) |
|
|
25 | (7) |
|
Useful Roles for Protocol Analysis |
|
|
25 | (1) |
|
Protocol Analyzer Elements |
|
|
26 | (5) |
|
Placing a Protocol Analyzer on a Network |
|
|
31 | (1) |
|
|
32 | (2) |
|
|
34 | (11) |
|
|
45 | (4) |
|
|
49 | (4) |
|
|
53 | (2) |
|
IP Addressing and Related Topics |
|
|
55 | (46) |
|
|
56 | (1) |
|
|
57 | (1) |
|
|
58 | (4) |
|
More About Class A Addresses |
|
|
59 | (1) |
|
More About Class B Addresses |
|
|
60 | (1) |
|
More About Class C Addresses |
|
|
61 | (1) |
|
More About Address Classes D and E |
|
|
62 | (1) |
|
Network, Broadcast, Multicast, and Other Special IP Addresses |
|
|
62 | (4) |
|
Broadcast Packet Structures |
|
|
63 | (1) |
|
Multicast Packet and Address Structures |
|
|
63 | (3) |
|
The Vanishing IP Address Space |
|
|
66 | (2) |
|
Understanding Basic Binary Arithmetic |
|
|
68 | (3) |
|
Converting Decimal to Binary |
|
|
68 | (1) |
|
Converting Binary to Decimal |
|
|
69 | (1) |
|
|
70 | (1) |
|
|
70 | (1) |
|
IP Networks, Subnets, and Masks |
|
|
71 | (6) |
|
|
71 | (6) |
|
Classless Inter-Domain Routing (CIDR) |
|
|
77 | (2) |
|
Public Versus Private IP Addresses |
|
|
79 | (2) |
|
Managing Access to IP Address Information |
|
|
81 | (1) |
|
Obtaining Public IP Addresses |
|
|
82 | (1) |
|
|
82 | (3) |
|
|
82 | (2) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
86 | (4) |
|
|
90 | (4) |
|
|
94 | (3) |
|
|
97 | (4) |
|
Data Link and Network Layer TCP/IP Protocols |
|
|
101 | (66) |
|
|
102 | (5) |
|
The Serial Line Internet Protocol (SLIP) |
|
|
103 | (1) |
|
Point-to-Point Protocol (PPP) |
|
|
104 | (2) |
|
Special Handling for PPP Links |
|
|
106 | (1) |
|
|
107 | (11) |
|
|
107 | (7) |
|
|
114 | (4) |
|
Hardware Addresses in the IP Environment |
|
|
118 | (9) |
|
ARP Packet Fields and Functions |
|
|
121 | (3) |
|
|
124 | (2) |
|
|
126 | (1) |
|
|
127 | (1) |
|
About Internet Protocol (IP) |
|
|
127 | (5) |
|
|
128 | (1) |
|
|
129 | (3) |
|
Lifetime of an IP Datagram |
|
|
132 | (1) |
|
Fragmentation and Reassembly |
|
|
133 | (4) |
|
|
137 | (3) |
|
|
137 | (1) |
|
|
137 | (2) |
|
Differentiated Services (Diffserv) and Early Congestion Notification (ECN) |
|
|
139 | (1) |
|
IP Header Fields and Functions |
|
|
140 | (8) |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
140 | (2) |
|
New TOS Field Function: Differentiated Services and Congestion Control |
|
|
142 | (3) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
146 | (1) |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
147 | (1) |
|
Destination Address Field |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
148 | (2) |
|
|
150 | (7) |
|
|
157 | (3) |
|
|
160 | (5) |
|
|
165 | (2) |
|
Internet Control Message Protocol (ICMP) |
|
|
167 | (50) |
|
Understanding the Internet Control Message Protocol |
|
|
168 | (2) |
|
|
168 | (1) |
|
ICMP's Vital Role on IP Networks |
|
|
169 | (1) |
|
Testing and Troubleshooting Sequences for ICMP |
|
|
170 | (13) |
|
Connectivity Testing with PING |
|
|
170 | (2) |
|
Path Discovery with Traceroute |
|
|
172 | (2) |
|
Path Discovery with Pathping |
|
|
174 | (1) |
|
Path MTU Discovery with ICMP |
|
|
174 | (4) |
|
Routing Sequences for ICMP |
|
|
178 | (4) |
|
|
182 | (1) |
|
ICMP Packet Fields and Functions |
|
|
183 | (19) |
|
|
183 | (4) |
|
The Variable ICMP Structures and Functions |
|
|
187 | (15) |
|
|
202 | (1) |
|
|
203 | (3) |
|
|
206 | (4) |
|
|
210 | (6) |
|
|
216 | (1) |
|
Transport Layer TCP/IP Protocols |
|
|
217 | (42) |
|
UDP---A Connectionless Transport Layer Protocol |
|
|
218 | (6) |
|
|
219 | (1) |
|
UDP Header Fields and Functions |
|
|
219 | (4) |
|
UDP Port Numbers and Processes |
|
|
223 | (1) |
|
TCP---A Connection-Oriented Protocol |
|
|
224 | (22) |
|
|
225 | (1) |
|
TCP Startup Connection Process (TCP Handshake) |
|
|
226 | (5) |
|
|
231 | (1) |
|
TCP Connection Termination |
|
|
232 | (2) |
|
TCP Sequence and Acknowledgment Process |
|
|
234 | (2) |
|
TCP Error-Detection and Error-Recovery Process |
|
|
236 | (2) |
|
|
238 | (2) |
|
|
240 | (1) |
|
TCP Header Fields and Functions |
|
|
241 | (5) |
|
Choosing Between TCP and UDP |
|
|
246 | (1) |
|
|
247 | (1) |
|
|
248 | (3) |
|
|
251 | (4) |
|
|
255 | (2) |
|
|
257 | (2) |
|
|
259 | (46) |
|
How Application Layer IP Protocols Work and Behave |
|
|
260 | (1) |
|
|
261 | (6) |
|
|
262 | (2) |
|
Sample FTP Communications |
|
|
264 | (3) |
|
|
267 | (5) |
|
|
268 | (2) |
|
Sample Telnet Communications |
|
|
270 | (2) |
|
|
272 | (5) |
|
|
273 | (2) |
|
Sample SMTP Communications |
|
|
275 | (2) |
|
|
277 | (6) |
|
|
278 | (2) |
|
Sample HTTP Communications |
|
|
280 | (3) |
|
Other Common IP-based Services |
|
|
283 | (5) |
|
|
284 | (1) |
|
|
284 | (1) |
|
Character Generator (Chargen) |
|
|
284 | (1) |
|
|
285 | (1) |
|
|
285 | (1) |
|
|
286 | (1) |
|
Remote Procedure Call (RPC) |
|
|
286 | (1) |
|
Simple Network Management Protocol (SNMP) |
|
|
286 | (1) |
|
|
287 | (1) |
|
Decoding Application Layer Protocols |
|
|
288 | (2) |
|
|
290 | (1) |
|
|
291 | (3) |
|
|
294 | (4) |
|
|
298 | (5) |
|
|
303 | (2) |
|
|
305 | (48) |
|
DNS History and Background |
|
|
306 | (8) |
|
|
307 | (2) |
|
|
309 | (1) |
|
|
310 | (1) |
|
|
311 | (1) |
|
|
311 | (2) |
|
|
313 | (1) |
|
How Domain Name Servers Work |
|
|
314 | (2) |
|
The Importance of DNS Caching |
|
|
316 | (1) |
|
DNS Configuration Files and Resource Record Formats |
|
|
317 | (5) |
|
Start of Authority (SOA) Record |
|
|
318 | (1) |
|
Address (A) and Canonical Name (CNAME) Records |
|
|
319 | (2) |
|
Mapping Addresses to Names |
|
|
321 | (1) |
|
Handling the Loopback Address |
|
|
322 | (1) |
|
Obtaining and Storing Root Server Data |
|
|
322 | (1) |
|
Examining the named.root File |
|
|
323 | (1) |
|
|
323 | (4) |
|
|
325 | (1) |
|
|
325 | (2) |
|
DNS Query/Response Packet Formats |
|
|
327 | (7) |
|
|
334 | (3) |
|
|
335 | (1) |
|
Additional Readings on DNS |
|
|
336 | (1) |
|
|
337 | (1) |
|
|
338 | (4) |
|
|
342 | (3) |
|
|
345 | (7) |
|
|
352 | (1) |
|
The Dynamic Host Configuration Protocol (DHCP) |
|
|
353 | (38) |
|
|
354 | (5) |
|
|
355 | (1) |
|
|
356 | (1) |
|
|
357 | (1) |
|
|
358 | (1) |
|
|
358 | (1) |
|
Understanding IP Address Management with DHCP |
|
|
359 | (1) |
|
The Standard Address Discovery Process |
|
|
360 | (8) |
|
|
361 | (2) |
|
|
363 | (2) |
|
|
365 | (2) |
|
The Acknowledgment Packet |
|
|
367 | (1) |
|
The Address Renewal Process |
|
|
368 | (2) |
|
|
368 | (1) |
|
|
368 | (2) |
|
The DHCP Address Release Process |
|
|
370 | (1) |
|
|
370 | (6) |
|
|
372 | (4) |
|
Broadcast and Unicast in DHCP |
|
|
376 | (1) |
|
Communications with a DHCP Relay Agent |
|
|
377 | (1) |
|
Microsoft DHCP Scopes and Classes |
|
|
378 | (1) |
|
|
379 | (1) |
|
|
379 | (1) |
|
|
380 | (2) |
|
|
382 | (4) |
|
|
386 | (3) |
|
|
389 | (2) |
|
Securing TCP/IP Environments |
|
|
391 | (60) |
|
Understanding Computer and Network Security |
|
|
392 | (8) |
|
Principles of IP Security |
|
|
392 | (2) |
|
Understanding Typical IP Attacks, Exploits, and Break-ins |
|
|
394 | (3) |
|
Common Types of IP-Related Attacks |
|
|
397 | (1) |
|
What IP Services Are Most Vulnerable? |
|
|
398 | (1) |
|
Holes, Back Doors, and Other Illicit Points of Entry |
|
|
399 | (1) |
|
The Anatomy of IP Attacks |
|
|
400 | (3) |
|
Reconnaissance and Discovery Processes |
|
|
400 | (2) |
|
|
402 | (1) |
|
|
402 | (1) |
|
Common IP Points of Attack |
|
|
403 | (12) |
|
Viruses, Worms, and Trojan Horse Programs |
|
|
403 | (3) |
|
Denial of Service (DoS) Attacks |
|
|
406 | (2) |
|
Distributed Denial of Service Attacks (DDoS) |
|
|
408 | (2) |
|
Buffer Overflows/Overruns |
|
|
410 | (1) |
|
|
410 | (1) |
|
|
411 | (1) |
|
|
412 | (3) |
|
|
415 | (15) |
|
Apply Security Patches and Fixes |
|
|
415 | (1) |
|
Knowing Which Ports to Block |
|
|
416 | (1) |
|
Recognizing Attack Signatures |
|
|
417 | (2) |
|
Using IP Security (IPSec) |
|
|
419 | (1) |
|
Protecting the Perimeter of the Network |
|
|
419 | (2) |
|
Understanding the Basics of Firewalls |
|
|
421 | (3) |
|
Understanding the Basics of Proxy Servers |
|
|
424 | (1) |
|
Implementing Firewalls and Proxy Servers |
|
|
425 | (1) |
|
Planning and Implementing, Step by Step |
|
|
425 | (2) |
|
Understanding the Test-Attack-Tune Cycle |
|
|
427 | (1) |
|
Understanding the Role of IDS in IP Security |
|
|
428 | (1) |
|
Updating Anti-Virus Engines and Virus Lists |
|
|
428 | (1) |
|
The Security Update Process |
|
|
429 | (1) |
|
Understanding Security Policies and Recovery Plans |
|
|
430 | (2) |
|
Windows XP and 2003: Another Generation of Network Security |
|
|
432 | (3) |
|
|
435 | (1) |
|
|
436 | (6) |
|
|
442 | (4) |
|
|
446 | (3) |
|
|
449 | (2) |
|
Routing in the IP Environment |
|
|
451 | (42) |
|
|
452 | (7) |
|
How Entries Are Placed in the Routing Table |
|
|
453 | (1) |
|
Routing Protocols and Routed Protocols |
|
|
454 | (1) |
|
Grouping Routing Protocols |
|
|
454 | (5) |
|
|
459 | (5) |
|
|
459 | (1) |
|
|
459 | (1) |
|
|
460 | (1) |
|
|
460 | (1) |
|
Multicast Versus Broadcast Update Behavior |
|
|
461 | (1) |
|
ICMP Router Adverstisements |
|
|
461 | (1) |
|
|
461 | (1) |
|
Areas, Autonomous Systems, and Border Routers |
|
|
462 | (2) |
|
Interior Gateway Protocols (IGPs) |
|
|
464 | (10) |
|
|
464 | (5) |
|
Open Shortest Path First (OSPF) |
|
|
469 | (4) |
|
Enhanced Interior Gateway Routing Protocol (EIGRP) |
|
|
473 | (1) |
|
Border Gateway Protocol (BGP) |
|
|
474 | (1) |
|
Managing Routing on an In-House Internetwork |
|
|
475 | (2) |
|
|
477 | (1) |
|
Routing on and off a Wide Area Network |
|
|
477 | (2) |
|
|
477 | (1) |
|
|
477 | (1) |
|
|
478 | (1) |
|
|
478 | (1) |
|
Routing to and from the Internet |
|
|
479 | (1) |
|
Securing Routers and Routing Behavior |
|
|
480 | (1) |
|
Troubleshooting IP Routing |
|
|
481 | (1) |
|
|
481 | (2) |
|
|
483 | (3) |
|
|
486 | (4) |
|
|
490 | (1) |
|
|
491 | (2) |
|
Monitoring and Managing IP Networks |
|
|
493 | (34) |
|
Understanding Network Management Practices and Principles |
|
|
494 | (6) |
|
Network Management Architectures |
|
|
494 | (2) |
|
The OSI Network Management Model |
|
|
496 | (1) |
|
Practical Network Management |
|
|
497 | (1) |
|
In-band Versus Out-of-band Management |
|
|
498 | (2) |
|
|
500 | (9) |
|
Management Information Base (MIB) Objects |
|
|
501 | (5) |
|
|
506 | (1) |
|
|
506 | (1) |
|
|
506 | (2) |
|
|
508 | (1) |
|
Installing and Configuring SNMP Agents and Consoles |
|
|
509 | (3) |
|
|
510 | (1) |
|
|
511 | (1) |
|
|
512 | (1) |
|
SNMP Consoles, Tools, Utilities, and Key Files |
|
|
512 | (1) |
|
Integrating SNMP with Other Management Environments |
|
|
513 | (1) |
|
|
514 | (1) |
|
|
515 | (1) |
|
|
516 | (2) |
|
|
518 | (4) |
|
|
522 | (3) |
|
|
525 | (2) |
|
TCP/IP, Netbios, and Wins |
|
|
527 | (50) |
|
|
528 | (1) |
|
What Is NetBIOS (and Why Do I Care)? |
|
|
529 | (1) |
|
How Windows 2000, Windows XP, and Windows Server 2003 Work with NetBIOS |
|
|
530 | (1) |
|
|
531 | (2) |
|
|
531 | (1) |
|
|
531 | (1) |
|
Combining TCP/IP and NetBIOS |
|
|
531 | (2) |
|
|
533 | (3) |
|
|
534 | (1) |
|
Registering and Challenging NetBIOS Names |
|
|
534 | (1) |
|
|
534 | (1) |
|
|
535 | (1) |
|
|
536 | (2) |
|
Structure of NetBIOS Names |
|
|
536 | (1) |
|
NetBIOS Name Types and Suffixes |
|
|
537 | (1) |
|
|
537 | (1) |
|
NetBIOS Name Registration and Resolution |
|
|
538 | (6) |
|
Name Resolution Regimes by Node Type |
|
|
539 | (2) |
|
NetBIOS Name Cache and LMHOSTS File |
|
|
541 | (1) |
|
WINS Name Registration and Resolution |
|
|
541 | (2) |
|
|
543 | (1) |
|
|
544 | (1) |
|
NetBIOS and DNS Name Resolution |
|
|
545 | (3) |
|
Creating a Usable Host Name from a NetBIOS Name |
|
|
545 | (3) |
|
Converting an Encoded NetBIOS Name to a Fully Qualified Domain Name |
|
|
548 | (1) |
|
|
548 | (4) |
|
|
548 | (1) |
|
Different WINS Configurations |
|
|
549 | (3) |
|
|
552 | (5) |
|
Pointing DNS at WINS for NetBIOS Name Resolution |
|
|
554 | (2) |
|
Reverse DNS Lookup for NetBIOS Names |
|
|
556 | (1) |
|
Windows Server 2003 WINS Improvements |
|
|
556 | (1) |
|
Troubleshooting WINS and NetBIOS |
|
|
557 | (4) |
|
Common Sources of Failure |
|
|
557 | (1) |
|
Tools for Troubleshooting NetBIOS and WINS Problems |
|
|
557 | (2) |
|
Typical Errors in NetBIOS and Wins |
|
|
559 | (1) |
|
|
560 | (1) |
|
|
561 | (1) |
|
|
562 | (1) |
|
|
563 | (4) |
|
|
567 | (8) |
|
|
575 | (2) |
|
Internet Protocol Version 6 (IPv6) |
|
|
577 | (58) |
|
Why Create a New Version of IP? |
|
|
578 | (1) |
|
|
579 | (11) |
|
Address Format and Allocations |
|
|
579 | (4) |
|
|
583 | (6) |
|
|
589 | (1) |
|
|
590 | (3) |
|
Neighbor Discovery and Router Advertisement |
|
|
591 | (1) |
|
Path MTU Discovery and Changes in Fragmentation |
|
|
592 | (1) |
|
|
593 | (10) |
|
|
593 | (4) |
|
|
597 | (6) |
|
New and Enhanced IPv6 Features |
|
|
603 | (12) |
|
|
603 | (2) |
|
|
605 | (5) |
|
|
610 | (1) |
|
Router Alerts and Hop-by-Hop Options |
|
|
611 | (1) |
|
|
612 | (3) |
|
Coexistence of IPv4 and IPv6 |
|
|
615 | (2) |
|
|
615 | (1) |
|
Tunneling Through the IPv4 Cloud |
|
|
616 | (1) |
|
|
617 | (1) |
|
Transitioning to IPv6: The Reality |
|
|
617 | (3) |
|
|
618 | (1) |
|
|
619 | (1) |
|
|
620 | (1) |
|
|
620 | (2) |
|
|
622 | (4) |
|
|
626 | (5) |
|
|
631 | (2) |
|
|
633 | (2) |
|
APPENDIX A Important RFCs |
|
|
635 | (6) |
|
APPENDIX B Key IP Resources Online |
|
|
641 | (6) |
|
General IP/Internet Overviews |
|
|
641 | (1) |
|
|
641 | (1) |
|
General Pointers to Internet and Networking Topics |
|
|
642 | (1) |
|
|
642 | (1) |
|
IP Addressing, Subnetting, and Supernetting |
|
|
642 | (1) |
|
Binary Arithmetic Overviews |
|
|
642 | (1) |
|
General IP Protocol Information |
|
|
643 | (1) |
|
|
643 | (1) |
|
|
643 | (1) |
|
|
643 | (1) |
|
|
644 | (1) |
|
|
644 | (1) |
|
|
645 | (1) |
|
|
645 | (1) |
|
|
646 | (1) |
|
APPENDIX C Command-line IP Utilities |
|
|
647 | (8) |
|
|
648 | (1) |
|
|
648 | (1) |
|
|
649 | (1) |
|
|
650 | (1) |
|
|
651 | (1) |
|
|
652 | (1) |
|
|
652 | (1) |
|
|
653 | (2) |
|
APPENDIX D Windows 2000 and Windows XP Registry Settings |
|
|
655 | (8) |
|
APPENDIX E Contents of the CD |
|
|
663 | (4) |
|
|
663 | (1) |
|
Engineers Edition Toolset |
|
|
663 | (1) |
|
EtherPeek for Windows Demo |
|
|
663 | (1) |
|
|
663 | (1) |
|
NetScanTools Standard Edition |
|
|
664 | (1) |
|
|
664 | (1) |
|
|
664 | (1) |
|
|
664 | (1) |
|
|
664 | (3) |
|
APPENDIX F TCP/UDP Port Numbers |
|
|
667 | (2) |
|
|
669 | (2) |
Glossary |
|
671 | |